Start with the address
Before signing in anywhere, read the complete domain in the browser address bar. Similar names can appear on unrelated websites, advertisements or messages.
Use a unique password
A password used for one service should not be reused for another. A password manager can make unique passwords easier to maintain.
Protect verification codes
One-time codes and authentication prompts are designed to protect accounts. Do not send them to another person because they ask you to “verify” an account.
Be cautious with urgent messages
Pressure is a common feature of phishing attempts. If a message says you must act immediately, close the message and verify the situation through a trusted route.
Keep devices updated
Operating-system and browser updates often include security fixes. Keeping software current is a basic but useful part of account protection.