A practical security baseline for your personal accounts

You do not need to become a security expert to be well protected online. A handful of steps, done once and checked from time to time, close off the most common ways personal accounts are taken over. This guide explains them in the order that gives you the most protection for the least effort.

Start with the accounts that matter most

Not every account deserves the same attention. Begin with these, roughly in this order:

• Your main email account. It matters most because password resets for almost everything else are sent there. Whoever controls your email can often take over your other accounts.
• Your phone and its platform account, such as your Apple Account or Google Account, which control your device, your backups and often your photos and messages.
• Banking, payment and investment accounts.
• Your password manager, if you use one.
• Social media and messaging accounts, especially the ones friends and family would trust a message from.

Work through these first. Everything else can follow at your own pace.

Stronger sign-in: passkeys and two-step verification

A password on its own is a single point of failure. Two-step verification, sometimes called two-factor or multi-factor authentication, adds a second check, so a stolen password is not enough by itself. These are the common options, from strongest to weakest in most situations:

• Passkeys. A passkey replaces the password with a credential stored on your phone, computer or a security key, unlocked with your fingerprint, face or device PIN. Passkeys are designed to resist phishing because they only work with the genuine website or app they were created for. Where a service offers them, they are usually the best choice. The FIDO Alliance explains how passkeys work (opens in a new tab).
• Security keys. Small physical devices that work in a similar way. They suit people who face a higher risk, and they make a good backup.
• Authenticator apps. Apps that generate a short code that changes every 30 seconds or so. They are much stronger than text messages, although a convincing fake website can still trick you into typing a code into it.
• Text message codes. Better than nothing, but vulnerable to SIM swap fraud, where a criminal persuades a mobile provider to move your number to their own SIM card. If text messages are the only option, use them, and ask your mobile provider whether you can add a PIN or passcode to your account.

Turn on the strongest option each important account supports, starting with your email.

Unique passwords, without the effort

The biggest password risk is reuse. When one website is breached, criminals try the same email address and password on other sites, a technique known as credential stuffing. A different password for every account stops one breach from spreading to the rest of your digital life.

A password manager makes this practical. It creates and remembers strong, unique passwords, and fills them in for you, but only on the website they belong to, which also helps you notice a fake site. Protect the password manager itself with a strong passphrase and two-step verification.

If you would rather not use one for everything, at least give your email account a strong password that you use nowhere else. The UK National Cyber Security Centre's top tips for staying secure online (opens in a new tab) suggest building passwords from three random words, which are easier to remember and harder to guess.

You can check whether your email address appears in known data breaches with Have I Been Pwned (opens in a new tab). If it does, change the password on that site and anywhere else you used the same one.

Prepare your recovery options now

Account recovery is how you get back in if you lose your phone or forget a password. It is also a route that attackers try. A few minutes now can save a great deal of trouble later:

• Check that your recovery email addresses and phone numbers are current, and that you still control them.
• Save backup or recovery codes when a service offers them, and keep them somewhere safe, such as on paper at home or in your password manager.
• Add a second passkey or security key where you can, so losing one device does not lock you out.
• Remove old phones, computers and signed-in sessions you no longer use from your account settings.
• Find out whether your important services let you name a trusted contact who can help you recover access.

Recognizing phishing and pressure

Most account takeovers begin with a message rather than a technical attack. Phishing emails, texts, calls and social media messages try to persuade you to hand over a password, a code or money. They are often well written, and they may use real logos or details about you.

The most reliable warning sign is pressure. Take extra care when a message:

• creates urgency: your account will be closed, a payment has failed, a parcel is waiting;
• asks for a one-time code, a password or remote access to your device;
• asks you to move money, buy gift cards or pay in an unusual way;
• comes from someone you know but asks for something out of character.

When in doubt, do not use the link, phone number or reply address in the message. Open the app yourself or type the website address, or call the person or organization on a number you already trust. A genuine organization will understand.

One-time codes are for signing in yourself. Nobody legitimate needs you to read one out to them.

Keep your devices up to date

Updates fix security weaknesses that criminals already know about. Turn on automatic updates for your phone, computer, browser and apps, and restart when you are asked to. Use a screen lock on your phone. When a device stops receiving security updates, plan to replace it when you reasonably can.

If you think something has gone wrong

If you suspect an account has been taken over, or you entered details into a site that turned out to be fake, act calmly and in order:

1. Use a device you trust. If you think a device itself is compromised, use a different one.
2. Secure your email account first: change its password, sign out of all other sessions and check that the recovery details have not been changed.
3. Change the password of the affected account, and of any account that shared the same password.
4. Turn on two-step verification or a passkey, if it was not already on.
5. Review recent activity: email forwarding rules, connected apps, new devices and changes to contact details.
6. Contact your bank straight away if money or payment details are involved.
7. Let people who might receive messages from your account know, so they can ignore requests that did not come from you.
8. Report the scam where you can, for example to the platform involved or to your national fraud reporting service.

Recovery is not always possible, and some steps depend on the service provider. Acting promptly gives you the best chance.

Getting help from Threatless

If you would like help putting these steps in place, or calm guidance after something has gone wrong, Threatless offers personal security help for individuals, including personal security reviews, account and privacy protection advice and incident guidance. Help is confidential and starts with a conversation, which you can begin from our contact page.

Threatless will never ask you for your passwords, one-time codes or recovery codes. If someone claiming to be from Threatless asks for them, do not share them.

This guide explains established security practice. It is general information, not advice for your specific situation. For that, talk to us.