First time
Look at the web you gonna open
To verify that you already fill the true web not phishing
Second
Put the password on safe places, that only you can open it
Don't trust anybody who wanna use your account