Credential harvesting

Credential harvesting is when criminals collect people's usernames and passwords, usually with fake log-in pages. A phishing email or text links to a page that looks exactly like Microsoft 365, Google, a bank or a delivery company. Whatever you type goes straight to the criminal, who may then sign in to your real account, read your email, or try the same password on other sites. Some fake pages also ask for your one-time code and pass it on instantly. To stay safe, do not sign in from links in unexpected messages. Open the app or type the website address yourself, and use two-step verification so a stolen password alone is not enough.