An unsolicited code
If you did not request it, do not approve it or share it. Check your account through a known route.
Protect credentials, devices and recovery access
Account safety is a sequence of practical decisions, from recognising a destination to responding to an unexpected request. The guidance here focuses on actions a visitor can take rather than promises about a system.
Protect the whole access chain
A strong password loses value if it is reused elsewhere or entered on the wrong page. Use a long, unique password and check the address before supplying it. A password manager can help keep different accounts separate.
Recovery access deserves equal attention. Protect the email or phone account used for confirmations, because access to that channel may affect other accounts. Where a service offers additional authentication, understand its purpose and keep backup material private.
Unexpected requests need a pause. Pressure to share a code, install remote-control software or act before a countdown ends can interfere with judgment. Verify through a channel you chose independently rather than the contact details inside the suspicious message.
Recognise a signal and choose an action
Match the signal to an action without pressure.
A request for remote access
Do not hand control of your device to an unverified helper. End the interaction and use the actual support process.
An unfamiliar session
From a trusted device, review available sessions and change the affected password. Secure the recovery channel too.
Evidence without exposing secrets
If you report a suspicious page, include its name, the message wording and the time. Remove codes, account identifiers and personal documents from screenshots.
If you believe credentials were exposed, secure the affected access first instead of waiting for a website response. The contact mailbox can receive a page report, but should never be used to send passwords.
Respond to a suspicious request
Pause the interaction
Stop entering information and do not approve an unexpected prompt.
Use a trusted device
Open the intended service through a known address.
Secure affected access
Change exposed credentials and review available session controls.
Report a clear summary
Send the page and symptom without secrets or unnecessary personal data.
Questions about this topic
Is a lock icon proof that a service is trustworthy?
No. It does not by itself establish the operator’s identity or the suitability of a request.
Should codes be shared with support?
No. Read what the code authorises and keep it private.
What if I reused a password?
Change it on the affected services, using a different password for each.
What can I report to hibaji?
Report a suspicious reference to a hibaji page or a content issue through [email protected].