Recognising suspicious account messages on mobile
Check message context and destination addresses, keep account secrets out of chat, and respond carefully to suspicious mobile account requests.
Published 21 10 月 2026
Treat the message and the destination separately
A familiar logo in a message is not proof of who sent it. Before following an account request, inspect the full address and consider whether you expected the conversation. Use a previously checked bookmark or contact route when you need to revisit an account. A shortened link’s label does not establish the identity of the page reached after redirection.
Keep account secrets out of messages
Use a strong, unique password rather than reusing one across unrelated services. Do not paste a password, recovery code or one-time code into an ordinary support conversation. If you are asked to install a file sent through an unexpected chat, stop and check the request through a separate established route before opening it.
Do not act on urgency alone
What the message asks you to do
An immediate deadline, an unexplained account threat or a request to move to a new chat should prompt a check. Read the request as a whole: what action is being requested, where will it happen and why is sensitive information needed? Do not treat a screenshot of a logo or a claimed reward as verification.
Respond to possible exposure
If you suspect a password has been exposed, use the account’s verified management route to change it and review active sessions where that service offers the control. Also consider the associated email account, because recovery messages may arrive there. Different services provide different settings; this article does not claim that a particular M2 security feature is currently available.
Use the right site route
Use the M2 Login page to access your account and Contact to find the existing support routes. This article helps you assess suspicious messages; it does not replace login, registration or downloads. Keep a description of the incident for a support enquiry without forwarding your credentials. Actual service identity must be confirmed through reliable information, not branding alone.
