Keeping your account secure is simple when you know what to look out for. Here are the key points about security, phishing, and what Picnic can or cannot do.

## Protect Your Access

At Picnic, login is done with **email + verification code (OTP)**. Therefore:

-   Use a strong and unique password for the email you use with Picnic.
-   Enable two-factor authentication (2FA) on your email.
-   Never share your Picnic verification code with anyone.
-   **Do not search for the Picnic website on search engines.**

If someone accesses your email, they could try to access your Picnic account.

## Beware of Phishing (Fake Links, Sites, and Messages)

Phishing scams try to trick you into stealing your codes or getting you to send money.

Be suspicious if:

-   The message is very urgent (“respond in 5 minutes or your account will be blocked”).
-   Someone asks you to **p**rovide a verification code, card details, or documents via chat, call, or WhatsApp.
-   The link looks strange or the site has a different address from the official one.
-   They ask you to install remote access apps (AnyDesk, TeamViewer, etc.) to “assist with support.”
-   They offer guaranteed returns, “exclusive investment,” or ask you to transfer everything to a “secure wallet.”

If in doubt, **do not click**. Access Picnic by typing the official address in your browser (www.usepicnic.com) or **opening the app directly from the store.**

## What Picnic Can Do

Picnic can:

-   Send emails with the @usepicnic.com domain (for example, to confirm login or notify you about something important).
-   Ask you to confirm actions within the app or website (like accepting terms or reviewing data).
-   Guide you through the platform chat or official channels if you have questions.
-   Help you report fake sites.

## What Picnic Never Does

Consider it a scam if someone, claiming to be from Picnic:

-   Asks for your verification code, card PIN, or email password.
-   Requests you to make a Pix transfer to “unlock account,” “increase limit,” or “join a special investment.”
-   Asks you to install remote access apps to “assist with support.”
-   Requests your full card number or CVV.

Picnic never needs this information to provide support.

## What to Do If Something Seems Wrong

If you receive something suspicious or think you’ve been scammed:

1.  **Stop everything**: do not click, do not respond, do not send codes.
2.  Review your transactions; if something seems off, follow the steps in the security articles.
3.  Contact support through the **official channels** and explain what happened.

When in doubt, treat it as a scam. It’s always better to confirm first than to fix later.