Impersonation succeeds by borrowing familiar names and adding pressure. Verification must use an independent route that the suspicious message did not supply.
Inspect the contact change
A new number, handle or email should be treated as unverified even when the profile image and display name match. Compare it with an earlier receipt or saved conversation.
Recognize forbidden requests
Passwords, one-time codes, full card numbers, seed phrases and remote-control access are not ordinary troubleshooting evidence. Do not install a screen-sharing tool at a stranger’s request.
Verify through a separate channel
Open the known site or contact the saved provider directly. The agent-account guide helps separate platform information from independent provider claims.
Preserve evidence and secure the account
Save the sender identifier and redacted message, report it through a verified route, change the password from a clean device and review recent sessions and transactions.
Choose the next action from the evidence
If the check succeeds, record the working route and change nothing else. If it fails, keep the exact message, timestamp, device state and transaction reference, then escalate through a contact verified before the incident. Do not expose credentials or make a second transfer to “unlock” the first.
Control and harm-reduction boundary
This independent Fire Kirin material is for adults where use is permitted. Decide an affordable money ceiling and a clock-based stopping point before opening a session. End the session when either boundary is reached, while a payment is unresolved, or when frustration creates an urge to recover a loss. Access, credits, withdrawals and outcomes are never guaranteed.