Protecting Your Online Accounts: A Practical Guide

Most account takeovers rely on reused passwords or tricking you into handing over a login. A few habits close those doors.

Use a password manager

A password manager generates and stores a unique password for every site, so a breach at one service does not unlock the others.

Turn on two-factor authentication

Two-factor authentication (2FA) adds a second check beyond your password. Authenticator apps and hardware security keys are stronger than SMS codes, but any 2FA is better than none.

Consider passkeys

Many services now support passkeys, which replace passwords with a cryptographic credential stored on your device. They are resistant to phishing because they only work on the genuine website.

Recognize phishing

Be suspicious of urgent messages asking you to sign in, pay, or confirm details. Open the site yourself instead of clicking the link.

Secure your recovery options

Keep your recovery email and phone number current, and store backup codes somewhere safe. Ask your mobile carrier about a port-out PIN or number-lock feature to reduce the risk of SIM-swap fraud.

If an account is compromised

Change the password, sign out other sessions and review recovery settings. In the US, identity theft can be reported at IdentityTheft.gov (run by the Federal Trade Commission), which also generates a recovery plan.

Know the limits of other tools

A VPN does not protect your passwords; see VPN Privacy Basics and Limitations. Site owners should also read Cybersecurity Basics for Small Websites.

Start with the accounts that matter most

You probably have dozens or hundreds of online accounts, and fixing all of them at once is overwhelming. Prioritize instead:

1. Your primary email account. It is the key to password resets for almost everything else.
2. Your password manager (if you use one), protected by a strong, unique master password and two-factor authentication.
3. Banking, credit card, brokerage and retirement accounts.
4. Your mobile carrier account, since attackers who control your phone number can intercept text-message codes.
5. Your Apple, Google or Microsoft account, which often controls backups, photos and device access.
6. Social media and work accounts that could be used to impersonate you.

Secure these first, then work through the rest as you log in to them over the coming weeks.

Protect your phone number

SIM-swap and port-out fraud occur when a criminal convinces a carrier to move your number to a device they control. Major US carriers, including AT&T, T-Mobile and Verizon, offer account PINs or passcodes and number-transfer protection features. Log in to your carrier account or call customer service and turn on whatever extra protection is available. Where possible, move important accounts from text-message codes to an authenticator app, a security key or a passkey, so that losing control of your number does not mean losing your accounts.

Freeze your credit

A credit freeze does not protect your existing online accounts, but it makes it much harder for someone to open new credit in your name using stolen information. Under federal law, freezing and unfreezing your credit with the three nationwide credit bureaus, Equifax, Experian and TransUnion, is free. You need to contact each bureau separately. You can temporarily lift a freeze when you apply for a loan or a new card.

Review connected apps and active sessions

Over time, you may have granted dozens of third-party apps access to your Google, Microsoft, Apple or social media accounts. Visit each account's security page and remove apps you no longer use. While you are there, review the list of signed-in devices and sessions and sign out of any you do not recognize. Many services also let you see recent security events, such as new sign-ins or password changes.

Use security checkups

Google, Microsoft and Apple each provide security checkup tools that walk you through recovery options, two-factor settings and connected devices. Taking ten minutes to run through them once or twice a year catches outdated recovery phone numbers and forgotten devices.

Be careful with security questions

Answers to questions like "What was your high school mascot?" are often discoverable through social media or public records. If a site forces you to use security questions, treat the answers like passwords: use random answers and store them in your password manager.

Watch for scams that ask for codes

No legitimate company will call or text you asking you to read back a verification code. Scammers impersonate banks, carriers, delivery companies and tech support to trick people into sharing one-time codes or approving login prompts. If you receive an unexpected request, hang up or ignore it and contact the company directly using the number on its official website or the back of your card. If you get repeated push notifications asking you to approve a login you did not start, deny them and change your password; that is a sign someone already has it.

Report and get help

If you are a victim of identity theft in the US, the Federal Trade Commission's IdentityTheft.gov provides a personalized recovery plan and official reports you can use with creditors. Online fraud can also be reported to the FBI's Internet Crime Complaint Center (IC3). Contact your bank immediately if money was taken; acting quickly improves the odds of recovering funds.

A 30-minute action plan

• Install a reputable password manager and change your email password to a long, unique one.
• Turn on two-factor authentication for email, banking and your mobile carrier.
• Add a carrier account PIN and number-transfer protection.
• Freeze your credit at Equifax, Experian and TransUnion.
• Run the Google, Microsoft or Apple security checkup and remove old devices and apps.

These steps will not make you invulnerable, but they block the most common ways accounts are taken over and make recovery faster if something goes wrong.