Always verify that any communication referring you to a login page is legitimate. Emails and messages can be spoofed; when in doubt, navigate via your saved bookmark. Use device-based confirmations and do not reveal one-time codes to anyone.
Keep a dedicated machine or profile for high-value accounts where possible, and avoid public Wi-Fi for signing-in to sensitive services.
Read more about protecting accounts