The account
- Do not share the Microsoft password, backup codes, or a session token. “I’m an admin, log in on my server website” is how accounts are stolen.
- Turn on two-step verification on the Microsoft account. A password alone is not a plan.
- A cape, a rare name or a paid rank is not worth logging into a third-party checker. Those sites are the scam.
Official support is help.minecraft.net. Billing questions go through the account site you paid on — Microsoft, PlayStation, Nintendo, Apple or Google — not through a Discord user with a Mojang avatar. If someone messages you first, they are not support.
What you install
Mods, launchers and resource packs should come from Modrinth, CurseForge, or the author’s own GitHub. “Free Minecraft plus 10,000 skins” sites ship a launcher that asks you to disable your antivirus. That is the virus. The licence problem with those downloads is on the EULA page; the practical problem is that they take the account too.
Bedrock add-ons from the Marketplace, or .mcaddon files you made yourself, are a different path. Random MediaFire links in a comments section are the same risk as a fake Java launcher. Places to build packs properly are listed on Create.
People
Voice chat with strangers is still talking to strangers. Do not share your town, your school, your age, or a photo. A player who asks a child to move the conversation off the server is a reason to block, screenshot, and tell an adult — not a reason to be polite. Family settings that limit chat to friends are on the accounts page.
On a server, report tools exist because staff cannot read every line. Use them. Then leave the argument. The behaviour rules around that chat are player etiquette.