Online account security in South Africa: passwords, phishing and recovery

Protect the access chain, not just one password

Think of account security as a chain connecting the website, your sign-in method, your email, your phone and the device you use. A strong password is helpful, but it cannot answer every question. You also need to know where you are signing in, whether a message is genuine and how you would regain access after losing a phone.

Begin with a short personal inventory: which email receives account messages, which device holds saved credentials, and what recovery methods have you configured? Record the services and methods, without putting passwords or codes into an ordinary shared document. This inventory helps you find weak points before an urgent situation makes decisions harder.

The aim is to reduce avoidable risks, not to certify a website or promise that an account cannot be compromised. For the identity and official destination covered by this project, use the BravoBet South Africa brand guide. Here, the focus is controlling access rather than assessing licensing or products.

Check the destination before you enter credentials

Start from an address you have established independently, rather than a sign-in link in an unexpected message. Read the browser’s address bar, not just the text printed on a button. SABRIC’s consumer security guidance warns about imitation websites and explains that HTTPS alone does not establish a site’s legitimacy.

The examples below are invented addresses for illustration. Assume the expected host is service.example. A familiar word elsewhere in an address does not make that host the destination. On a phone, expand or select the address so you can inspect it rather than relying on a shortened display.

If you cannot explain why a sign-in page has a different host, stop and return through the independently known route. Some genuine services use separate identity providers, but a difference needs explanation from that service’s own information; guessing is not a useful security check.

Scroll sideways to read the full table.

Recognise the request behind a phishing message

Phishing is an attempt to persuade you to reveal information or perform an unsafe action through a deceptive message or destination. The useful question is what the sender wants you to do. A convincing logo and fluent wording do not establish who sent a message, so spelling mistakes should never be your only test.

Imagine receiving a fictional message saying an account will close in ten minutes unless you follow a link. Separate the claim from the proposed action. You can check an account concern through the provider’s established route without using the sender’s link, replying with credentials or opening an attachment.

The same approach applies to a supposed reward, an unexpected document request or an alleged security emergency. Treat urgency as a reason to slow the interaction down. Do not let a caller dictate both the problem and the channel through which you must solve it. SABRIC also warns that telephone numbers can be disguised; a familiar caller display is not independent authentication.

Use unique passwords and a manageable storage method

Use a different strong password for each account. The NCSC’s password-manager guidance explains why reuse matters: a password exposed by one service can be tried against other accounts. A password manager can generate and store separate credentials, reducing the need to remember or repeat them.

Choose a manager that fits the devices you actually use, and understand its recovery method before moving important credentials into it. This could be a tool built into your own browser or a separate product. Protect the manager itself with a strong primary password and extra authentication where available.

For a hypothetical household setup, ask who can unlock the device and which browser profile stores the credentials. A convenient arrangement for a private phone may be inappropriate on a shared computer. Do not approve password saving on a public device.

Keep the process simple enough to maintain: generate a unique credential, save it to the correct entry and confirm that it works through the genuine sign-in page. If autofill behaves unexpectedly, recheck the destination instead of immediately pasting a password into an unfamiliar form.

Enable extra authentication where it is offered

Multi-factor authentication, often labelled MFA, 2FA or two-step verification, adds another check to account access. The NCSC’s setup guide describes options such as authenticator apps and text-message codes. Use the provider’s instructions to see what is supported; this article does not assert that BravoBet offers any particular method.

During setup, identify the service you are configuring and complete the process through its established account settings. Do not follow an unsolicited instruction to enrol a new device or send someone a code. A code or approval can authorise access, so treat it as an active security decision rather than a routine message to clear.

Where a service offers passkeys, the NCSC’s password guidance recommends them as an alternative to passwords. Availability and setup differ. Whatever method you use, remain alert to unfamiliar prompts and retain a recovery route. An extra check strengthens protection; it is not permission to ignore the destination or approve activity you did not initiate.

Prepare recovery before you lose access

Your email deserves particular attention because it may receive password-reset messages for other accounts. Protect that inbox with its own unique credentials and extra authentication where available. Review whether the recovery phone number and alternative email still belong to you, especially before changing numbers or replacing a device.

If a service supplies backup codes, understand when they work and keep them somewhere you can access safely after losing the usual device. NCSC guidance explains that backup codes may be single-use. Do not keep your only recovery copy on the phone whose loss would prevent access.

Walk through a fictional lost-phone scenario without changing anything: how would you reach your email, access your password manager and contact the provider? If every answer depends on the missing device, investigate the provider’s supported alternatives while you still have access.

Do not test recovery by repeatedly submitting guesses or asking strangers to bypass the process. A legitimate recovery route may require checks, and its availability is service-specific. The useful preparation is knowing where that route begins, what you configured and which recovery details need updating.

Keep the device and browser ready for secure use

The NCSC’s update guidance recommends installing available software and app updates promptly, with automatic updates enabled where possible. Updates can address security weaknesses; an older device that no longer receives them needs particular consideration.

Use the device maker’s or software provider’s normal update route. An unexpected website claiming that you must install a special security tool before continuing is a different situation. Close that interaction and check through the software’s own settings or official support information instead.

Plan updates around a reliable connection and sufficient power rather than postponing them indefinitely. For a South African household sharing data or devices, a simple arrangement might be to check updates when connected to trusted home internet, then confirm any required restart has finished.

Keep the physical context in view as well: lock your device when stepping away, avoid leaving an account open for another person, and sign out after using a shared device. Private browsing should not be treated as permission to trust an unfamiliar computer. Choose a device you control for sensitive account changes wherever possible.

Handle suspicious contact through a separate route

If someone claims to represent a service, end the unexpected interaction and find the contact route independently. For a BravoBet-related question, begin at the BravoBet website and locate its current official contact information. Do not substitute a number supplied by the suspicious caller.

Describe the issue as a security concern: for example, an unsolicited reset message or a request to approve access you did not initiate. Do not include your password, one-time code or recovery codes in that report. A short description of the channel and requested action usually communicates the concern without repeating the secret.

If mobile reception disappears unexpectedly where you normally have service, check with your network provider using a verified channel. SABRIC identifies an unauthorised SIM swap as one possible concern; loss of signal alone does not establish that this has happened.

Avoid continuing the conversation to catch the sender out. Your immediate task is to protect access and reach the genuine provider, not to investigate the person behind the message.

Respond to suspected compromise from a device you trust

A sign-in failure can have several causes, so do not assume every error proves an attack. Unrecognised account changes, unexpected messages sent from your account or unfamiliar activity warrant prompt investigation. Start through the provider’s own recovery or security route, using another trusted device if the original device may be compromised.

The NCSC’s recovery guidance includes checking email forwarding rules, replacing compromised and reused passwords, and signing out other devices or apps. Follow the actual provider’s instructions; changing a password should not be assumed to remove every existing session automatically.

Where the service offers the controls, review recovery details, connected apps and active sessions, remove unfamiliar access and enable additional authentication. If you cannot sign in, ask the genuine provider about containment and recovery rather than creating a replacement account to work around the problem.

If bank or card details may have been exposed, or money has moved without permission, contact your bank promptly through its verified fraud channel. Do not let account troubleshooting delay that separate action. Recovery and reimbursement outcomes cannot be promised by a general guide.

Match the first action to what actually happened

The table below separates hypothetical situations by exposure. It is a practical starting point, not a diagnosis or a guaranteed incident-response sequence. Tell the provider what you actually did rather than using a broad label such as “hacked” for every event.

Several rows can apply at once. For example, entering a password and then approving an unexpected prompt creates a different situation from merely receiving a message. If financial information or a bank account is involved, contact the bank in parallel with the service provider.

Scroll sideways to read the full table.

Maintain a small routine you can repeat

After resolving an incident or setting up an account, write down the remaining actions without recording secrets: update an old recovery number, finish an MFA setup or review access on a retired device. Give each item a specific owner and a manageable next step. An unfinished checklist is useful only if you can return to it.

Revisit the access chain when something changes: a new phone, a different email account, a shared laptop or the loss of a trusted device. These are sensible moments to check the setup, rather than relying on the memory of what worked months ago.

Security and privacy are related but answer different questions. This article concerns preventing and responding to unauthorised access. The personal information and privacy guide addresses how to understand the information a service collects and the relevant privacy questions.

Keep account security separate from a decision to gamble. Good sign-in habits do not remove gambling risk or establish an operator’s legal permissions. Their purpose is narrower: help you recognise a suspicious interaction, protect your credentials and act through the appropriate genuine channel.