Passwords
Use a separate secret for each important account.
Cricfy — Account safety
Turn warning signs into specific actions for passwords, devices and messages.
Protect access at its roots
Your email often controls password recovery, so its security matters as much as the account password. Use distinct credentials and protect the recovery address.
A familiar logo in a message does not prove who sent it. Requests for codes, remote access or urgent transfers should be checked through an independently known route.
Device sharing adds another risk. Saved passwords and open sessions can remain after a tab closes, especially on borrowed phones or public computers.
Respond to an unexpected alert
If an alert concerns an action you did not initiate, do not approve it. Open the service separately and inspect available security information. Avoid using the link inside the suspicious message.
If a password was exposed, change it from a trusted device and replace it wherever it was reused. Review recovery details and sessions; record the incident without saving the exposed password.
A practical sequence
Stop the interaction
Do not send codes or allow remote control.
Secure the recovery channel
Protect the email or phone used for resets.
Review affected access
Change exposed credentials and close unfamiliar sessions if available.
Questions answered
Does HTTPS prove a sender is trustworthy?
Encryption alone does not prove the identity or honesty of a service.
Can support ask for an OTP?
Do not disclose one-time codes to a helper.
What if I reused a password?
Replace it on every affected account with distinct passwords.
What may I report here?
Report misleading content or suspicious references to this domain, without secrets.