The one rule: your OTP is yours
A one-time code is the final key to an account. Real support teams, delivery companies and banks do not need it from you, ever. Anyone who asks for it, however friendly or urgent, is trying to sign in as you. Say no and end the conversation.
The daily checklist
- Lock the phone with a PIN, pattern or fingerprint. Most account recovery flows assume your phone is in your hands only.
- Use a different password for each important app, and let a password manager remember them.
- Turn on two-step sign-in where an app offers it. An authenticator app is stronger than SMS if you can use one.
- Install apps only from your phone's store or the developer's own site. Skip APK files passed around in groups.
- Read the address before you sign in. Type it yourself or use a bookmark rather than tapping links in messages.
- Keep the phone updated. Security fixes arrive through system updates.
Red flags in messages
- A rush: “your account closes in 10 minutes unless…”.
- A request to share your screen, install a remote-control app or read out a code.
- An offer to unlock, recover or upgrade an account for a fee.
- A link whose address is close to, but not exactly, the one you know.
- A “support agent” who contacted you first, especially through a personal chat app.
Check who is signed in
Many apps list the devices or sessions using your account, usually under Settings, Security or Privacy. Once a month, look for phones or places you do not recognise and choose sign out of all other devices if anything looks off.
If you already shared a code or tapped a bad link
- Open the real app and change your password straight away.
- Choose sign out of all other devices if the app offers it.
- Turn on two-step sign-in if it was off.
- If money or a payment method is linked, contact that service through its own app or website right away.
- Remove any app you installed because a stranger asked you to.
- Tell friends if the account can message them, so they ignore odd requests sent in your name.
How this site keeps your card safe
The player card on this site holds a call sign and game scores, nothing else, and it never leaves your browser unless you copy its card code yourself. There is no password to steal and no OTP to intercept. More detail is in our privacy page.
Want to see what a code-guessing attack actually feels like from the other side? Try cracking a four-peg vault in eight tries on the game board, then imagine guessing a six-digit code with no hints at all. That is why a code you keep to yourself works.
