Protect the account before protecting a balance.

The recovery path is part of the account

A unique password is useful, but access to the recovery email can override it. Secure the email account, use multi-factor authentication where available and remove recovery details that are no longer controlled.

Before signing in

• Type or use a trusted bookmark rather than following an unexpected message.
• Check the full hostname before entering a password or identity document.
• Avoid shared devices and public networks for account changes or payments.
• Install operating-system and browser updates.

After an unexpected event

Start with the recovery email, then change the affected password, review active sessions and preserve any account or payment records. Do not continue a conversation with someone who contacted you unexpectedly claiming to be support. Return through a channel you can independently verify.