Secure your Goat Mart account

On your own phone or laptop, leaving Keep me signed in ticked reduces friction when you jump between /dashboard/buyer, /dashboard/seller, /dashboard/shop and /dashboard/farm without repeating the six-digit SMS or password each visit. On a shared computer, cyber café, or a relative's handset, untick it and sign out fully when you finish, since the setting is meant for hardware only you touch. A saved session on someone else's device is an open gate to manual payment proof orders, buyer and seller chat, and any verified badge you have earned, so treat convenience as a privilege reserved for trusted equipment.

Sign out from any device you no longer control, including old phones handed down to relatives or shop computers you have since replaced. If you suspect a yard hand or family member still has access they should not, change your password from a device you trust, or switch providers entirely if you signed in with Google or Facebook, and review active habits: do not share OTP screens, do not photograph passwords "for the office file", and never leave a verified session open on equipment that changes hands during the working day.

Several protections work quietly in the background without demanding your attention. A Turnstile bot check blocks automated abuse before it reaches the sign-in form. Sign-in attempts are rate-limited, so a script or a determined stranger guessing passwords at speed simply fails after a handful of tries. Error messages stay deliberately generic so attackers cannot tell whether an email is registered on Goat Mart at all. Suspended or banned accounts are blocked from sensitive actions such as listing, messaging or withdrawing funds, even if someone still remembers an old password or shared login.

These measures can occasionally frustrate a tired farmer typing on a bumpy mobile connection—wait a moment, check caps lock, and retry calmly rather than testing every old password in a rush. Rapid-fire failures look identical to an attack from the rate limiter's perspective, regardless of your good intentions. If you are locked out temporarily, pause for a minute and use Forgot password or switch to WhatsApp OTP instead of hammering the sign-in form repeatedly, which only extends the cooldown.

Switch workspaces rather than opening duplicate registrations for every role you play in the trade. Buyer tools live at /dashboard/buyer; selling sits at /dashboard/seller; shop operations run from /dashboard/shop; herd management belongs at /dashboard/farm—all reachable from one login. Verification badges and phone status carry with the account as a whole, which is why a second unofficial login "just for the shop" creates confusion, splits your order history, and weakens recovery options if you ever forget which email holds which listings.

Team access for a farm or shop should follow platform team settings where available, not informal password sharing among staff. Shared passwords destroy accountability when an order is confirmed too early, a listing is edited badly, or a buyer message goes unanswered and nobody can say who was responsible. If someone leaves your employment, remove their access immediately and change any credentials you ever shared in the past, since a former worker with your old password is effectively still signed in.

Manual payment proof, payouts and in-platform chat make your account financially sensitive in a way a simple browsing profile never is. Do not approve unknown browser extensions or third-party apps on the phone that holds your Goat Mart session, since a compromised device can quietly forward everything you type. Beware of "verification" links arriving by SMS that ask for a password—genuine phone verification on Goat Mart uses only a six-digit code you type into the site yourself, and that code expires after five minutes, never requiring you to click an external link.

Prefer identity verification with CNIC front and back when you sell at volume, so buyers see a reviewed seller badge while your documents remain private and are never displayed on your public profile. Security is not only cryptography and strong passwords; it is also refusing the off-platform payment pressure that often accompanies account takeover attempts during busy Eid weeks, when scammers know sellers are rushing to close deals quickly and may skip the caution they would normally apply to an unfamiliar buyer.

Unexpected password-change emails, OTP messages you did not request, or orders you did not place deserve immediate action: change your credentials from a clean device you trust, sign out of other sessions if the product allows, and contact support in Urdu or English, Saturday to Thursday, 9am–9pm. Do not argue with the attacker inside chat or attempt to negotiate, and never send them a code "to cancel" a transaction, since that code is the exact thing they need to complete the takeover they have already started.

Preserve screenshots of suspicious messages before you delete anything, since support may ask to see exactly what an attacker sent. Report related listings or chats with one-tap reporting when a takeover is being used to scam other buyers or sellers under your name. Recovering access itself is covered in a dedicated article; securing the account afterwards means reviewing your sign-in method, confirming your email again, and checking who still knows any codes or passwords you may have shared in the past.