Before opening a sensitive account
Connect on shared networks, verify the website address and use HTTPS. A VPN cannot make a fake sign-in page trustworthy. Keep recovery information away from the account it protects.
Keep your device and codes secure
Install system updates and apps from trusted stores. Use a passcode and multi-factor authentication. Never send passwords, one-time codes or recovery seeds in support messages.