How to Spot Fake Support Messages and Protect Your Account
A message about a locked account can make you want to act quickly. Before replying, check who is contacting you and what they want you to share. These checks apply to email, SMS and social-media messages.
Use this guide when checking an unexpected email, SMS or social-media message. Start with the quick checks below, then use the relevant section for more detail.
Start with a support channel you checked independently
A familiar logo or display name does not prove that a message is genuine. Avoid opening a login page through an unexpected message. Instead, use a website address you have independently verified and navigate to its contact page. If the destination or contact details differ from what you expected, stop and verify the change separately.
Keep passwords and verification codes private
Do not send a password, PIN or one-time authentication code in a support conversation. A request to read out a code can be an attempt to enter your account. Only enter a code into the legitimate authentication process you initiated. Do not approve an unexpected sign-in request.
Share enough to explain the problem
A useful first message describes the issue, when it happened and the error displayed. It does not need to include your password, complete bank details or an identity document. Before attaching a screenshot, check for private messages, balances, account identifiers and information belonging to other people. Remove anything unnecessary.
Check document requests before uploading
If a service requests identity information, verify the request and upload destination independently. Read the relevant privacy information and ask why the document is required, how it will be handled and which details are necessary. Do not send documents to an unverified social-media account or a link supplied by an unknown sender.
If you already shared information
Use a trusted device to secure affected accounts. Change a compromised password and any other account using the same password. Enable multi-factor authentication where available and review account activity. If money or banking information is involved, contact your bank using a number or app you already trust. Keep the suspicious message as evidence and follow official reporting advice.
A short checklist before you reply
- Did you initiate the conversation?
- Have you checked the destination independently?
- Is anyone asking for a password or authentication code?
- Can you explain the issue without sending sensitive details?
- Have you checked the privacy information before uploading documents?
Further reading
For related platform information, see account security, the privacy policy and contact information. These links do not establish that an unsolicited message is genuine.