Security for users

This section is advice. The account pages say which button does what. These pages say which choices are worth making, how to spot a message that is not from TDACorp, and what to do, in order, when something goes wrong. It is written for account owners, and it points to the exact pages in Your account where each step is done.

It also says what this book leaves out and why, so you know where the limits of the published detail are. How to build an application on top of the platform is in the Build with identity section, not here.

Account safety has three layers, and the pages follow them. The first is choosing well: a passkey added to your password, a second step that is really two-factor, and a way back in before you need it. The second is recognising trouble: a genuine message looks one way, a fake looks another, and there is a short list of secrets that identity never asks for. The third is responding: cut off the lost device or the intruder in the order that works fastest.

before:  choose a passkey, a second step, recovery codesduring:  recognise the real emails, never hand over a secretafter:   lost device -> sign out everywhere -> remove its passkey         taken over  -> sign out everywhere -> change password -> check methods

I want to set my account up well.

1. Passkeys and passwords: why a passkey comes first.
2. Choosing a second step: which second steps are really two-factor.
3. Keeping recovery codes safe: how to store the way back in.

I lost a phone or laptop.

1. Protecting a lost device: the steps in order.
2. What a security alert email means: the emails you will get as you do them.

I think someone else used my account.

1. If you think your account was taken over: the checklist that cuts an attacker off fastest.
2. Recognising a phishing email: in case a fake page started it.
3. Reporting a vulnerability: if the flaw is in identity itself.

Passkeys and passwords compares what each protects against and says when a password still has a place. Choosing a second step compares a passkey, an authenticator app, a recovery code and the extra steps, and says which do not count as two-factor. Keeping recovery codes safe covers storing, using up and replacing them.

Protecting a lost device gives the order: end every session, forget the device, remove its passkey, replace the authenticator app. If you think your account was taken over gives a checklist for when you can still sign in and when you cannot, and how to work out what happened. Security alert emails explains each alert email and what to do when the change was not yours.

Recognising a phishing email says how genuine messages are built and the signs of a fake. What identity never asks for states the one rule: identity never asks for your password by email. Security levels explained separates the checkup words Strong, Fair and Needs attention from the assurance level of a sign-in.

Reporting a vulnerability separates a flaw in identity from an account problem and says how to report. What we do not publish and why lists the kinds of detail this book leaves out on purpose.

Nothing is required. If you want to act on the advice at once, open the Security overview and the Security checkup in your account, which show where you stand. The first week of an account is when most of this is worth doing.

Which sign-in method is safest? A passkey. A password can be typed into a fake page and a passkey cannot. See Passkeys and passwords.

Does an emailed code count as two-factor? No, the optional extra steps do not. See Choosing a second step.

Will identity ever ask for my password by email? Never. See What identity never asks for.

I lost my phone. What first? Sign out everywhere from a device you trust. See Protecting a lost device.

Where do I report a flaw? See Reporting a vulnerability.

It does not say how to click through each account page, which is in Your account, or how each sign-in screen looks, which is in Signing in and recovery. It does not describe the signals identity uses to judge a sign-in, and it does not repeat the platform's formal practices, which are in the Security practices Trust page.