Password
Use a strong, unique password for each service. Reusing the same secret allows exposure in one place to affect another.
Account security starts with separate secrets
Passwords, one-time codes and recovery methods serve different purposes. Keeping them separate helps you recognise a request that does not belong to the action you intended. Winbaji's security page focuses on warning signs and concrete responses rather than treating a familiar name or a browser padlock as a guarantee.
Protect three different things
Losing one element can affect the others. Understand its role before deciding what to share or change.
Verification code
A code may authorise a login, a password change or another sensitive action. Read its purpose and do not relay it to a person offering help.
Recovery access
A recovery email or phone can be used to regain access. Keep it current and secure so a password reset does not depend on an exposed channel.
Respond to a suspicious event
Stop the interaction
Do not continue entering information into an unexpected form or replying to a request for codes. Record the address and what was asked.
Use a trusted device
Open the relevant service independently. Secure the recovery email, change exposed credentials and review active sessions where those controls are available.
Keep a useful record
Note the time, alerts and actions taken. Contact the responsible service through an established route and conceal secrets in any supporting image.
Warning signs are often in the request
Urgency, a reward or a threat can be used to hurry a decision. A message asking for a password or a code deserves attention even if it uses a familiar logo. Check the actual address and reach the service independently instead of following the message's route.
An unsolicited verification code can mean someone attempted an action, but it does not by itself establish what happened. Read the code's stated purpose and review the relevant service from a trusted device. Do not send the code back to whoever contacted you.
If a phone is lost, recovery email and phone access become especially important. Use the available device and account controls to protect access, then review sessions and credentials. Closing a browser window is not equivalent to ending every active session.
A padlock has a limited meaning
A browser's connection indicator concerns the connection to the displayed address. It does not establish the business identity, commercial claims or safety of every action on that page. Check both the address and the reason for a request.
Screenshots can contain balances, account identifiers, documents or codes that are easy to overlook. Crop or cover confidential information before sharing. This site's content email does not need a password, one-time code or complete identity document.
Questions about account security
Can support ask me to read out a code?
Do not relay a verification code to another person. Read what it authorises and use the relevant service's established recovery process.
Is a reused password a problem?
Yes. Exposure at one service can put other accounts using the same password at risk.
Does the browser padlock prove a site's claims?
It concerns the connection to an address, not the truth of business claims or the trustworthiness of a request.
What should I secure after losing a phone?
Protect recovery email and phone access, then review sessions and credentials using available controls from a trusted device.