3patti security: recognise a symptom and respond
Account protection involves keeping credentials private, identifying destinations and responding to unusual activity. Attractive design or a padlock alone does not establish an organisation's identity.
Identity and credential boundaries
Phishing messages use familiar names and urgency. Open a known address yourself instead of following the message link. Notice small differences in spelling.
Separate passwords reduce the chance that one compromised service affects another. Prioritise changing reused credentials. Altering just one character is not meaningful separation.
A verification code may authorise a particular action. Do not disclose it even to someone claiming familiarity by phone. A request for a code under the name of support is a warning sign.
Keep a timeline of unusual events
Record the time of unfamiliar access notices, changes you did not make or unexpected recovery emails. Several symptoms together can clarify what happened. Avoid installing unfamiliar repair software in a panic.
If the device is suspect, change important passwords from a trusted device. Regaining email control may need to come first. Email can act as the recovery key for other accounts.
Different risks need different responses
Verify an unexpected link independently. A displayed sender name is insufficient. Confirm urgent requests involving money through a second known channel.
A lost device may retain active sessions. Remove unfamiliar devices where a service provides session controls. Device loss and password exposure may need parallel responses.
Screenshots can expose personal information unintentionally. Hide numbers, tokens and secret fields before sharing. The error wording alone is often enough.
First response to suspected compromise
Stop the action
Pause link opening, file installation and code sharing.
Restore control
Use a trusted device to update email and relevant passwords.
Review sessions
End unfamiliar access where controls are available.
Keep evidence
Record times and symptoms for the appropriate provider.
Questions about Security
Does a padlock prove identity?
Not by itself. Check the destination and organisation separately.
What if I disclosed a code?
Stop the related process and review credentials and sessions.
What should support receive?
Symptoms, times and error wording, without secret credentials.
What if I reused a password?
Replace it with unique credentials, starting with important services.