The second key

Approve sign-in?

New sign-in to online banking

Device: computer · Location: unknown · just now

You're having dinner and aren't signing in anywhere.

What do you do?

• ✓ Decline — and then change your password, in the app you open yourself. – Exactly. Someone seems to know your password but can't get past the second key. Change the password so it stays that way.
• ✗ Approve, so the message goes away. – That would let strangers into your online banking. Only approve sign-ins you've just started yourself.
• ✗ Swipe it away and carry on eating. – Nearly: swiping keeps the door shut. But someone knows your password — change it, or the next request will soon follow.

A trap: approving a sign-in you didn't start lets strangers in. The second key worked here — now change your password too.

Approve sign-in?

New sign-in at flickerhaven.example

Device: computer · just now

You've just signed in to Flickerhaven on your computer yourself — from your bookmark.

What do you do?

• ✓ Approve — you've just started this sign-in yourself. – Exactly. That's what the approval is for: proving it really is you.
• ✗ Decline — requests like this are always scams. – Not always: you triggered this one yourself. What matters is whether you're signing in right now.

Genuine. You started the sign-in yourself — that's exactly what the approval is for. The question is always: did I just start this myself?

Approve sign-in? (6th request)

New sign-in to your account

Device: unknown · just now

For ten minutes this question has kept coming back, in the middle of the night.

What do you do?

• ✓ Decline every time, change your password and let Tidewren know on a number you trust. – Exactly. The flood is meant to wear you down. Declining costs nothing — and a new password stops it.
• ✗ Approve once, just to get some peace. – That's exactly what attackers are waiting for: someone tapping “Approve” out of annoyance or by accident.

A trap: wearing you down. Attackers who know your password send request after request until someone approves out of annoyance. Decline, change the password, tell the provider.

Flickerhaven Support · 0800 ••• ••• 61

Caller: Hello, Flickerhaven support. Someone is trying to take over your account right now. We've sent you a confirmation code to protect it — please read it out to me and we'll lock the intruder out.

On your phone: “Your Flickerhaven code: 48•••1. Never share this code.”

What do you do?

• ✓ Hang up. You give the code to nobody — it's the second key. – Exactly. The code doesn't lock anyone out — it lets the caller in. The intruder is the caller.
• ✗ Read out the code — it's about protecting your account. – Then he'd have your account. If the message says “never share”, that includes callers claiming to be support.

A trap: anyone asking for your code on the phone wants your account. A one-time passcode is like a key — you don't hand it over, not even to “support”.

In your Kestrelmoor Bank app

“Sign in with a passkey from now on — with your fingerprint, face or phone PIN.”

You opened the app yourself.

What do you think?

• ✓ Set it up — a passkey only works on the bank's genuine site. – Good. A passkey can't be typed into a fake site — it's tied to the real address. The NCSC now recommends passkeys wherever they're available.
• ✗ Decline — otherwise the app sends my fingerprint to the bank. – Your fingerprint stays on your phone. The bank only learns that the check succeeded — it never gets the fingerprint itself.

Well done. A passkey replaces the password and only works on the genuine site — a fake one gets nothing. Your fingerprint never leaves your device.