Short and worth reading once.

Nobody from the team will ever ask for your password

Not in a message, not in a thread, not to "verify" anything, not to give you items. Anybody who does is not staff, whatever their username looks like.

Staff accounts carry a rank next to the name on every post. A name alone means nothing.

Signs of a scam

• Urgency. "Only for the next ten minutes."
• A website that looks like this one but is not on this address.
• An offer to multiply your Coins.
• Being asked to go somewhere else to continue the conversation.
• Real money, in any direction, for anything.

Your account

• Use a password you do not use anywhere else.
• Do not share the account. An account that two people use is an account neither of them can prove is theirs.
• If you think somebody has your password, change it in Settings and use Sign out on every device, which makes every existing session useless immediately.

Your privacy

Settings decides who may message you, who may send you a friend request, who can see your collection, and whether you appear in listings. The defaults are the cautious ones.

Think before putting your age, your school, your town or your other accounts in a blurb or a post. A forum post is readable by anyone, forever, including people who were not looking for you.

If something goes wrong

Report the post, then carry on with your day. You do not have to argue with anyone, and replying to a troll is what they came for.