6 Club Account Security Checklist

Before signing in

• Check the domain carefully.
• Avoid links from unsolicited messages.
• Use a unique password.
• Confirm that the connection uses HTTPS.
• Do not sign in from a device you do not trust.

While using an account

• Never share OTPs or recovery codes.
• Do not install remote-access apps at the request of an unknown support agent.
• Avoid saving passwords on shared devices.
• Sign out when finished.

If you suspect account compromise

Use the verified password reset process, secure the email account linked to the service and contact provider support through a verified route. Review recent account activity where available.

Secure the email and phone number first

Email and mobile accounts often control password resets, so protect them as carefully as the account itself. Use a unique email password, enable multi-factor authentication where available and review recovery details. Remove old phone numbers or devices that you no longer control.

Be alert to SIM-swap and email takeover attempts. If mobile service unexpectedly stops or you receive a password-reset alert you did not request, contact the relevant provider using a trusted channel.

Use safer passwords and authentication

• Use a long, unique password for every service.
• Store credentials in a reputable password manager.
• Enable multi-factor authentication where supported.
• Never share an OTP, backup code or recovery link.
• Avoid saving passwords on public or shared computers.

Review sessions and account activity

Look for unfamiliar devices, sign-in locations, profile changes and security notifications. Sign out sessions you do not recognise and update your password from a trusted device. If the service offers login alerts, enable them and read unexpected alerts promptly.

Keep evidence of suspicious activity in a private place. Redact personal identifiers before sharing screenshots with support or a public community.

Respond to a suspected compromise

Secure the linked email account first, change the affected password, revoke unknown sessions and contact the provider through verified support. If payment details may be exposed, contact the bank or payment provider immediately. Do not pay a third party who promises to recover an account.