Read every signing prompt and confirm its origin and purpose. A legitimate sign-in should never require your seed phrase or private key. Reject unexpected or unclear requests.