Passwords
Use a long, separate password and avoid saving it on shared devices.
Messages about urgent prizes or account closure can create pressure to act quickly. Open a familiar address yourself instead of following the message. Check the actual sender rather than trusting a displayed name.
Password reuse can allow a breach at one service to affect another account. Keep long, distinct passwords. Protect your email as well, because recovery messages may arrive there.
A verification code can authorise a particular action. Do not share it with someone claiming to help. An unsolicited code is a reason to inspect the relevant service's security controls.
These points separate the practical conditions and distinctions that matter for this subject. Read them together with the explanation above.
Use a long, separate password and avoid saving it on shared devices.
Read the action described in a code message. Do not approve a request you did not initiate.
Redact identity numbers, account details and secrets before sending a support screenshot.

If you entered a password on the wrong page, change the affected password from a trusted device. Replace it elsewhere if reused. Do not return to the suspicious page to provide more details.
If financial or identity information was exposed, contact the relevant bank or service through an official channel. Preserve the time and messages. Seek appropriate help rather than negotiating with a threatening sender.
Do not immediately open a file or share a code.
Use a familiar address or previously saved contact.
Change the password, close available sessions and notify the affected party.
No. Images can be copied; check the address and purpose.
Never share a secret code, particularly through an unexpected message.
A trusted manager can help maintain separate passwords.
Passwords, codes, identity numbers and full financial details.