Why this matters
Some pieces of information are keys to your money and identity. Once a fraudster has them, they can access your account, impersonate you, or take payments. Knowing exactly what to keep private — and never hand over, no matter who asks — is a simple, powerful defence.
Never share these — with anyone
Your password. No legitimate company, including us, will ever ask for it.
One-time verification codes / OTPs. These are the final key to your account. Anyone asking for one is trying to get in.
Your card's PIN.
Full card number, expiry, and security code (CVV) — except when paying on a trusted, official site you opened yourself.
Crypto wallet recovery phrases or private keys. → See: Crypto Scams & Fake Platforms
Remote access to your device. Never install screen-sharing or remote-control apps at someone's request.
If anyone asks for these — by call, message, or email — it's a scam, full stop.
Share carefully and only when needed
ID and document details — only with verified, official services, through channels you opened yourself.
Address, date of birth, phone number — minimise where you post these publicly.
Account or transaction details — only through the official app or site.
Be mindful of what you post publicly
Fraudsters piece together public details to target you:
Birthdays and full names help with identity checks and impersonation.
Location check-ins and travel plans reveal when you're away.
Photos of documents, tickets, or cards can expose numbers and personal data.
Pet names, schools, family names are often answers to security questions.
Workplace details enable convincing work-related scams.
The less you broadcast, the harder you are to target. → See: Protecting Your Personal Data Online
The rule of thumb
Legitimate organisations ask you to prove your identity to them — never to reveal your secrets to them. A real bank confirms you're you; it never needs your password or code. If a request flips that around, it's fraud.
What to do if you shared something sensitive
If you shared a password, change it immediately — and anywhere you reused it.
If you shared a verification code, card details, or moved money, contact us right away through the 24/7 in-app support chat.
If you shared a crypto recovery phrase, treat that wallet as compromised.
If you granted remote access, remove the app and disconnect.
Watch for follow-up scams and report what happened.
→ See: I Think I've Been Scammed: Immediate Steps