How to avoid phishing attempts

Fraudulent messages, sometimes called phishing, are a common method attackers use to trick others into giving up their personal information, such as passwords, credit card numbers, social security, or other sensitive data. Fraudulent messages can be sent through email, SMS (text message), in-app messages, or messaging apps.

There has been a recent increase in attempts at phishing attempts against some of our advertisers. Here are some tips to be aware of and actions you can take to protect your brands.

How to avoid phishing attempts

1. Validate the send-from email of any emails you receive claiming to be from TikTok. In the "from" field of any emails, check that the email address ends with tiktok.com or bytedance.com.

   • Correct example: TikTok for Business <noreply-tt4b@notifications.tiktok.com>

   • Wrong example: TikTok for Business <support@tiktok-notifications-1000bd34db4af4cb514f2709.awsapps.com>

2. Refuse any request for credentials from anyone, even if they are stating they are from TikTok support. TikTok will never ask for your account password or multifactor code. We may only ask for information such as email via legitimate support channels in order to provide support.

3. Ensure your password is strong.

   • A strong password is at least 6-20 characters and should be a combination of numbers, letters, and special characters. This makes your password harder to figure out.

   • Use a different password for each of your important accounts and update them regularly.

     • Reusing the same password across multiple websites, apps, and platforms can be risky. If someone gets your password for one account, they could access other important accounts that use the same password.

4. Turn on 2-step verification for all users.

   • 2-step verification adds an extra layer of security to your account in case your password is compromised. It also helps protect your account from unrecognized and unauthorized devices or third-party applications. To learn more, refer to turn on 2-step verification.

5. Review roles in your TikTok for Business accounts.

   • Ensuring that members of your Business Center have only the privileges necessary for their jobs is important in reducing the risk posed from a phishing attack. To learn more, refer to adjust roles.

6. Review your user settings to ensure correctness.

   • Ensuring your email address and phone number are correct and validated is helpful in making sure you can stay up-to-date on activity on your account. To learn more, review your user settings.

For additional steps, refer to How to protect your account on TikTok for Business.