Which account may need securing first?

The registered email or other recovery channel.

What activity should be reviewed?

Sessions, profile changes and financial transactions.

CHECK 01

Record device, location, time and route without clicking links inside the notification.

CHECK 02

Change the email password and confirm recovery details if the email channel may be exposed.

CHECK 03

Use the site's own recovery path, choose a unique password and end other active sessions.

CHECK 04

Compare deposits, withdrawals, balance changes and profile edits, then report unexplained events.

Should the alert link be trusted automatically?: No.
Which account may need securing first?: The registered email or other recovery channel.
What activity should be reviewed?: Sessions, profile changes and financial transactions.