Recognizing Phishing Attempts

Phishing is a message that pretends to be from Xacheus (or a bank, a delivery company, anyone you might trust) to make you hand over your password or a code.

The signs

• Urgency — "your account will be closed in 24 hours", "verify now".
• A login page you reached by clicking a link — especially one that looks slightly wrong.
• Asking for secrets — Xacheus never asks for your password or a verification code by message, email or chat.
• A sender you cannot verify — the display name says "Xacheus Team" but the address or account is unrelated.
• Too good to be true — "you have won", "claim your grant".

What real Xacheus messages look like

• Verification codes arrive because you just asked for one — not out of the blue.
• Security alerts tell you a new device signed in; they do not ask you to "confirm your password".

What to do

1. Do not click, do not reply, do not enter anything.
2. If you already clicked but typed nothing — you are probably fine; be careful of that page in future.
3. If you entered your password — change it now: Resetting your password, then read Recovering a compromised account.
4. Report the message to Xacheus (see below) and delete it.

Reporting phishing

Use the report action on the message or post if it is inside Xacheus, or the Support inbox with the Report a scam department. You can also report a dangerous link directly — Xacheus checks reported links and warns members before they open flagged ones: Handling suspicious links.

One habit that beats them all

Never sign in from a link in a message. Open the app or type xacheus.com yourself.