Reused password
Replace a password shared with another service with a unique value.
Recognise unfamiliar links, code requests and unexpected access messages. Match each warning sign with a specific protective action.

A unique password helps limit the effects of a breach elsewhere. Consider your own password manager. Avoid storing secrets in shared chats or ordinary shared notes.
A verification code belongs to a particular request. Never send it to someone claiming to assist you. If a code arrives for a request you did not start, check the contact channel and the relevant account.
A familiar name can be imitated through a slightly altered address. A logo or page image is not proof of identity. Check the address yourself, especially before sharing documents or money.
Record an unfamiliar request or unexpected change message.
Do not open further suspicious links or attachments.
Secure access to your own email or phone first.
Describe the information exposed without including the secret itself.
These situations have different causes and call for different responses. Match the description to the question you actually have.
Replace a password shared with another service with a unique value.
End the request and open a known address rather than revealing the code.
Use available device management to revoke access and recover your own contact channel.

Keep the time, sender address and type of request. Do not forward private tokens or codes. Redact secrets even when retaining evidence.
If a password was exposed, change it through the relevant service's authorised process and replace matching passwords elsewhere. Deleting the message alone does not end the risk.
No. Familiar symbols can be copied; check the address and purpose of the request.
Never disclose a code to another person. Use only the authorised verification interface.
Use a distinct password for each important service.
Provide time and error text, excluding passwords, codes and complete documents.