An email asking you to “confirm your identity” can sound routine, especially if it warns that an account will be limited. But a convincing logo, familiar name, or urgent deadline does not prove who sent it. The safest response is to treat the message as unverified until you check through a channel you locate independently. Do not reply with a password, sign-in code, or sensitive identity details. You can still deal with a real account issue—just begin from the service’s official site or a contact method you already trust, not from instructions in the message.
The useful bits
- Never send passwords or one-time codes in an email reply.
- Verify the request through a separately located official channel.
- For account actions, start at the service’s official site rather than an email link.
Why a reply is the wrong place to prove who you are
Email is not a safe place to disclose credentials or verification codes. A password can give someone access to an account; a one-time code may let them complete a sign-in or recovery step while it is still valid. A code is not harmless just because it expires. Treat it as a temporary key and enter it only into the official service flow you opened yourself.
Sensitive identity information can create risks beyond one account. Do not email items such as identity document numbers, payment details, or copies of documents just because a sender says they are required. A legitimate process may ask for information through an official channel, but an email asking you to reply with it does not establish that the process or recipient is genuine.
Pause before clicking, replying, or calling
Do not use the message’s links, phone numbers, attachments, or reply address as your way to verify it. Those details are part of the unverified message. Instead, open a saved bookmark, type the service’s known website address yourself, or use contact information from a trusted source you already have. If you use a search engine to find the service, check the address carefully before entering any account details.
Read the message for context, but do not let urgency decide your next step. A claim that access will disappear immediately, or that only a reply can prevent it, is a reason to slow down—not a reason to send a secret. You can preserve the email for reporting or review without following its instructions.
Check the request through a separate route
Sign in by navigating to the official account site independently and look for any account notice there. If the service provides an authenticated support or recovery process, use that route. You can also contact the organization using a phone number or address obtained separately from the email. Ask whether the request is real without repeating a password or giving a code.
Legitimate verification processes vary by service and situation. Some may use an account page, a recovery workflow, or another method; others may not need identity information at all. Do not guess which steps are legitimate, and do not treat a familiar-looking email as confirmation. Follow only the instructions shown in the official process you reached independently.
If you use BITTU Mail
BITTU Mail is powered by BITTU ICLOUD. All sign-in, registration, account recovery, and account actions go through https://mail.bittuicloud.com. If an email claims you must confirm your BITTU Mail identity, do not reply with a password or code and do not use a link in that message to sign in. Open the official account site by entering its address yourself, then use the relevant account process there.
This guidance does not establish whether any particular message is genuine or what verification a specific account may require. If the official site does not show the issue described, or the process is unclear, do not invent a workaround or send identity details by email. Seek help through an independently verified official channel.
A practical example
Imagine receiving a message that says your mailbox will be closed unless you reply with your password and the code just sent to your phone. The message may include your name or a convincing sign-off, but neither proves it is safe. Do not reply, provide the code, or follow its sign-in link. Navigate to the official account site separately and check for a notice or recovery step. If you cannot confirm the issue there, contact the provider through a trusted, independently found channel.
Message received: “Reply with your password and sign-in code to keep [account] active.” Safe response: Do not reply. Open the official site independently and check the account there. If contacting support: “I received a message about [issue]. Can you confirm whether any action is needed?”
If you already shared something
Act promptly through the official site, not through the message. If you disclosed a password, use the official account process to change it; if you cannot sign in, use the official recovery route. If you shared a one-time code, check the account through the official site and follow its available security steps. Do not send another code to someone who contacts you about the first one.
To confirm you responded safely, make sure you reached the account site independently, completed only the steps shown there, and did not send secrets in an email reply. If the request cannot be verified through that route, leave it unresolved until you can reach the organization through a trusted official channel.
- Do not reply with passwords, codes, or identity documents.
- Verify through an independently opened official site or trusted contact route.
- Use only the official account process, and do not guess at verification steps.
About this guide
Prepared with AI assistance for the BITTU Mail editorial library. Check important details against your original messages and current account settings. Product access depends on your role, plan and provisioning state. Provider interfaces and requirements can change.
View current plans · Security information · Suggest a correction