Protect Your Account in 60 Seconds
These are the most important actions for protecting an online account. Complete as many as your account and device support.
Unique Passphrase
Never reuse the same password across your email, banking and entertainment accounts.
Turn On MFA
If available, enable multi-factor authentication for an additional security layer.
Protect OTP Codes
Never give verification or one-time security codes to someone contacting you unexpectedly.
Secure Your Device
Keep your browser, phone and operating system updated with current security patches.
Check Before Clicking
Be cautious with login links received through unexpected messages, email or social media.
Review Activity
Treat unknown logins, password resets or profile changes as possible security warnings.
Use a Strong & Unique Passphrase
A reused password creates unnecessary risk. If another website suffers a data breach, attackers may try the same password on your other accounts.
Longer passwords and passphrases are harder to crack.
Avoid names, birthdays and predictable phrases.
Never recycle the same password across multiple services.
Better password habit
Consider using a reputable password manager to generate and store different passwords or passphrases for different accounts.
MFA, Passkeys & Verification Codes
Multi-factor authentication adds another layer of protection even if someone obtains your password.
Passkey
Passkeys can provide phishing-resistant authentication using your trusted device, PIN or biometrics.
Authenticator
An authenticator application can provide an extra verification factor where supported.
One-Time Code
SMS or other one-time codes add protection but must remain private.
Support staff, callers or people contacting you through social media should never need you to send them a one-time security code received for your login.
Keep Your Phone & Browser Secure
Your account can only be as secure as the device used to access it. Old software, malicious applications or unsafe networks can create additional risk.
Keep your operating system, browser and applications updated.
Download applications from trusted or official stores.
Protect your phone or computer with PIN, password or biometric security.
Avoid entering sensitive login information on shared or public computers.
Prefer trusted Wi-Fi or your mobile connection for sensitive account activity.
Remove unknown software and review unnecessary app permissions.
Fake Support & Phishing Warning Signs
Attackers may impersonate trusted organisations or support agents to convince users to provide passwords, verification codes or payment information.
Urgent Login Request
A message pressures you to sign in immediately using a link provided in the message.
OTP Request
Someone asks you to send them a verification or security code you just received.
Unusual Website Address
The page name or domain contains unexpected characters, spelling changes or additional words.
Password Request
A person claiming to be support asks you to reveal your current account password.
Don't Share Your Login Credentials
Account credentials should stay with the account holder. Sharing passwords, OTP codes or recovery details increases the risk of unauthorised access and can make account recovery more difficult.
Shared Access
- Sharing passwords
- Sharing OTP codes
- Storing passwords in group chats
- Logging in on unknown devices
- Leaving an account signed in publicly
Private Access
- Keep login credentials private
- Use your own trusted device
- Use a unique passphrase
- Protect verification codes
- Review account activity
Signs Your Account May Be Compromised
A device, login time or location does not look familiar.
You receive a password-reset notification you did not request.
Contact, account or recovery information has changed unexpectedly.
You see account activity or transactions you do not recognise.
Your normal credentials stop working without explanation.
Think Someone Accessed Your Account?
If you believe your login details may have been exposed, respond quickly from a device you trust.
Avoid using password-reset links from suspicious messages.
Create a new, unique password or passphrase.
If the account provides session controls, remove unknown devices.
Check email, phone and recovery methods for unknown changes.
Remove any security method you do not recognise.
If money or banking information may be affected, contact your financial institution promptly.
Safe Password Reset Routine
Open the service directly rather than using an unknown message link.
Follow the account recovery process carefully.
Do not reuse your previous or another account's password.
Review devices and login sessions after recovery.
Check the Service Before Sharing Personal or Payment Information
Australian consumers should independently verify whether an online gambling service is permitted to operate in Australia before creating an account, providing identity information or depositing money.
The Australian Communications and Media Authority states that online casino services are among the interactive gambling services prohibited from being offered to people in Australia. Licensed wagering services can be checked through ACMA's register of licensed interactive gambling providers.
Frequently Asked Questions
What makes a strong password? +
Australian cyber security guidance recommends using long, unpredictable and unique passphrases. A useful approach is at least 15 characters using four or more unrelated random words.
Should I use MFA? +
Yes, where the service supports it. MFA adds an additional security factor beyond your password and can make account takeover more difficult.
Are passkeys better than passwords? +
Passkeys can provide strong phishing-resistant authentication. Availability depends on whether the service supports passkeys.
Should I give an OTP to customer support? +
Do not provide passwords or one-time verification codes to someone who contacts you unexpectedly. Verify the request using an official channel you locate yourself.
What should I do after a suspicious login? +
Change your password from the official service, review account-recovery information, remove unknown sessions or authentication methods where possible, and secure connected financial accounts if relevant.
Is public Wi-Fi safe for sensitive account activity? +
Public networks can carry additional security risk. Prefer a trusted home network or your mobile connection when accessing sensitive accounts.