Security — Sessions & alerts (2)

What our security emails never contain: a link that performs an action. No "wasn't me — click to undo". A security alert is the single most impersonated kind of email there is, and training you to click buttons inside one would be building the phishing lure ourselves. Every message points at your account settings and asks you to act there, where you can see you are on the real site. Devices are recognised by a long-lived cookie rather than by IP address or browser fingerprint. Those change constantly for ordinary people — a phone moving between wifi and mobile data, a browser updating — and an alert that fires on every commute is one that gets filtered within a fortnight. Clearing your cookies looks like a new device, which is the safe direction to be wrong in.