Required for all team members · about 25 min · Updated Sep 2026
Start here
Before you begin
Most security breaches don't come from someone breaking through a firewall. They come from a person being tricked. The 2026 Verizon Data Breach Investigations Report found that 62% of breaches involve a human element, and phishing is the most common way attackers get in.
We run a platform that handles real money and player data, which makes us a target. The good news is that trained teams are far harder to breach. You are our strongest layer of defense. This isn't about blame or passing a test. It's about a few simple habits that stop the most common attacks.
Read each short module, then answer the quiz at the end. Your completion is recorded so we know the team is covered. We refresh this every few months.
Module 1 of 5
Phishing, the most common threat
Phishing is when an attacker pretends to be someone you trust, by email, SMS, chat, or phone, to trick you into clicking a bad link, entering your password on a fake page, opening a harmful file, or approving a login. It is designed to make you act fast, without thinking.
The tell-tale signs
Urgency and fear. "Account will be suspended," "expiring," "act now."
Unexpected sender. You weren't expecting it.
Mismatched address. The display name looks right but the real email address is wrong or random. Check the actual address.
Hidden links. A button that hides where it really goes. Hover over it without clicking to see the true destination, or press and hold on mobile.
Generic greeting. "Dear customer" instead of your name.
Verify, upgrade, renew, or confirm language that pushes you to log in through their link.
"Your urgent action is needed towards your webmail account ([email protected]) is expiring… follow the secure web URL below to upgrade… [UPGRADE DOMAIN HERE] — cPanel Support Team"
Every red flag is here
🚩 Sender is [email protected], a random personal address, not cPanel or our provider.
🚩 Urgency and fear: "urgent," "expiring," "so you do not lose your account."
🚩 A single mystery button hiding a link to a fake login page built to steal our password.
🚩 Spelling mistakes such as "adviced" and "loose" instead of "lose."
🚩 Generic greeting, and it imitates a real brand (cPanel).
What to do with an email like this: don't click anything. Report it, then delete it.
Golden rules
Never click a link in an unexpected email. Go to the service by typing its address yourself.
Never enter your password on a page you reached by clicking an email link.
Don't open unexpected attachments, especially .zip, .exe, .html, or files asking you to enable macros or content.
When in doubt, ask before acting. Checking is always fine.
Module 2 of 5
Passwords and accounts
A stolen or reused password is one of the most common ways attackers get in. These are our company rules, please follow all of them.
Company password rules
At least 32 characters, with letters and numbers. Symbols are fine too. Never anything short or simple like 12345678.
Generate every password with a generator. Use the 1Password generator. Don't invent passwords in your head, since generated ones are far stronger.
A unique password for every service. If you reuse one and any site is breached, attackers try it everywhere else. One password per service.
Use a password manager such as Bitwarden or 1Password to store them. You remember one master password and it handles the rest.
Never save the work password in your browser
Browser-saved passwords can be stolen by malware on your computer. Use the password manager instead, or type them.
Never share passwords
Don't send passwords over chat, email, or Telegram.
Everyone gets their own account. Ask an admin to set up access rather than sharing a login.
Module 3 of 5
Two-factor authentication (2FA)
2FA means logging in needs two things: something you know (your password) and something you have (a code from your phone or email). Even if an attacker steals your password, they still can't get in. It is the single most effective protection against stolen passwords.
The CRM now uses 2FA
When you log into the Blazebet CRM:
Enter your email and password as usual.
You receive a 6-character verification code by email, from "Blazebet Security."
Enter that code in the login window to finish signing in.
The code request is rate-limited. If someone is guessing a password over and over, the system will not keep sending codes. That is expected protection, not a bug.
If a CRM code arrives by email but you did not try to log in, do not use it and report it right away. It can mean someone else has your password.
2FA on your email account (required)
Turn on 2FA for all Gmail and company email accounts. Ask us if yours isn't set up yet.
For your authenticator, install Google Authenticator from the official store only. Get it from the Apple App Store or Google Play. Avoid other apps that show up in a web search, since some of them are fake and designed to capture your codes.
The 2FA rules
Never approve a login or read out a code you did not start yourself. Deny it and report it.
We will never ask you for your 2FA code. Anyone who does, by call or message, is an attacker.
Modules 4 and 5 of 5
Device hygiene and reporting
Keep your device clean
Keep your operating system and browser updated. Updates patch the holes attackers use.
No pirated software or random browser extensions. These are a common way infostealer malware gets in, which quietly steals saved browser passwords and login sessions. This is how strong passwords still leak.
Lock your screen when you step away.
Don't use the CRM on a shared or unsecured computer.
If your computer acts strangely, report it and stop logging into work accounts from it.
Reporting, and what to do if you slip
Report anything suspicious right away in our team group, or message Ethan or Vlad on Telegram. This includes a suspicious email, a CRM code you didn't request, or anything you're unsure about. Don't click, reply, or forward it to the sender.
If you think you clicked or entered something, tell us immediately. There is no blame for reporting fast. A password reported in the first five minutes is a non-event that we simply reset. The same password kept quiet for a day can turn into a serious breach. Speed protects you and the company.
CRM users, a few extra rules
Log out when you're done. Don't leave sessions open, especially on shared machines.
Confirm your logins when asked, so we can spot any login that isn't from a real team member.
Report any unfamiliar actions or changes in the CRM right away.
Confirmation quiz
Quick quiz
Answer all questions. You need 100% to pass. You'll see the correct answer as you go, and you can retake it if you don't pass.
Questions about anything here? Ask in the team group, or message Ethan or Vlad.