Use OTP only after the app identity is obvious
Do not treat a code as harmless. If the route changed, the app name looks different, or a reward screen appears before login, stop before entering OTP.
Compare login behavior before OTP
Use the login flow that keeps one app name and one OTP screen. Multiple code prompts after redirects mean restart.
Decide by symptom, not by panic
| Signal | What it usually means | Better action |
|---|---|---|
| Code arrives late | Carrier delay or repeated resend queue | Wait, then request one fresh code from the same verified screen |
| New page asks again | Redirect or session handoff changed | Go back to the app route and restart the login path |
| Support asks for screenshot | Private data may be exposed | Crop everything except the error text, never include OTP or wallet |
| Password works but app loops | Cache, old build or network block | Clear cache, switch network, then check current APK source |
Three stops that protect the account
Stop at hidden domains
If the address bar hides behind a short link or ad frame, do not type a phone number.
Stop at bonus pressure
A deadline reward is not a reason to rush OTP. Bonuses can wait; account access cannot.
Stop at document requests
KYC, ID proof and wallet evidence should never be handled through comment boxes or agents.
Recovery order that reduces lockouts
- Confirm the route and app name before requesting any code.
- Use the number linked to the account; do not test with another SIM.
- Wait for the first OTP window to expire before generating another one.
- After access returns, check wallet, profile name and active sessions.
- Remove saved passwords from borrowed or repaired phones.
Login choices that protect the account
Can I paste OTP into support chat?
No. A code is enough to enter the account, even if the person sounds helpful.
What if the app asks twice?
Restart from the verified route. Two OTP screens after redirects is a warning sign.
Should I continue after a bonus pop-up?
Only after closing it and confirming the original app identity. Do not mix rewards with login recovery.