Use a strong unique password
A password should not be reused across unrelated services. Consider a reputable password manager for secure storage.
Protect OTPs and recovery codes
One-time codes and recovery codes are sensitive. Legitimate support should not require you to disclose them.
Mobile browsing
On a small screen, the full address can be easy to overlook. Expand the browser address area and verify the domain before entering credentials.
Keep devices updated
Use current browser and operating-system versions, a screen lock and sensible security settings.