Security basics · Module 1

Lock Down Your Accounts

Most account takeovers do not need clever hacking: a reused password or an unprotected email account is enough. These five steps close the doors attackers use most.

About 15 minutes to readAn afternoon to set upBeginner

1Start with your email

Your main email account is the master key to your online life. Almost every other account, from your bank to your social media, lets you reset the password with a link sent to your email. Whoever controls that inbox can take over the rest.

Why it matters

Attackers who get into an email account usually search it first for “password reset”, “invoice” and “bank”, then work through everything it unlocks. Securing email first protects everything else at once.

Do this
  1. Give your email a long, unique password that you use nowhere else.
  2. Turn on two-step verification (step 3), preferably with a passkey or authenticator app.
  3. Check the recovery email and phone number are yours and current (step 5).
  4. Review the list of devices and sessions signed in, and sign out any you do not recognise.

2Use a password manager

The single biggest risk is reusing passwords. When one website is breached, criminals automatically try the same email and password on hundreds of other sites. A password manager removes the problem: it creates a different, random password for every account and fills it in for you, so you only remember one.

Choosing one

Your master password

This is the one password you must remember. Make it a passphrase of five or six random words, for example from our Passphrase Generator. Do not use it anywhere else, and turn on two-step verification for the password manager itself.

The order to change your passwords

You do not have to do everything at once. Work down this list over a week:

  1. Email accounts
  2. Password manager
  3. Banking and payments
  4. Mobile phone carrier
  5. Apple, Google or Microsoft account
  6. Social media
  7. Shopping and food delivery
  8. Everything else, as you log in
Avoid

Passwords in a notes app, a spreadsheet, an email to yourself or a sticky note on the screen. If you are not ready for a password manager yet, a notebook kept at home is better than reusing passwords.

3Turn on two-step verification

Two-step verification (also called two-factor or multi-factor authentication, 2FA or MFA) asks for a second proof that it is you, on top of your password. Even if your password leaks, the attacker is stopped. Not all methods are equally strong:

Strongest
Passkey or security keyOnly works on the real website, so it cannot be phished or intercepted. A security key is a small USB or NFC device such as a YubiKey.
Strong
Authenticator appApps such as Google Authenticator, Microsoft Authenticator, Authy or the one in your password manager show a code that changes every 30 seconds. Some ask you to approve a sign-in and type in a number.
Better than nothing
Text message or email codeStops most attacks, but codes can be intercepted if a criminal takes over your phone number or email. Upgrade when the service allows it.
Weakest
Password onlyOne leak, guess or reused password and the account is gone.
Do this
  1. Look for “two-step verification”, “2FA” or “login security” in each account's security settings, starting with the order list above.
  2. Save the backup codes each service gives you, in your password manager or printed at home. They get you back in if you lose your phone.
  3. If you use an authenticator app, make sure it backs up or syncs, so a lost phone does not lock you out.
Never

Never read out or forward a sign-in code, and never approve a sign-in prompt you did not start yourself. No genuine bank, help desk or company will ask for your code. An unexpected prompt means someone has your password: deny it and change the password.

4Switch to passkeys where you can

A passkey replaces your password with something your device holds. You sign in with your fingerprint, face or phone PIN, and your device proves who you are using cryptography. There is nothing to remember, type, reuse or leak.

Do this

When a site offers “Create a passkey” or “Sign in faster”, accept it, starting with Google, Apple, Microsoft, Amazon and your password manager. Keep one other way in, such as backup codes, in case you lose all your devices.

5Fix your recovery settings

Account recovery is a back door. If it points to an old email address or a phone number you no longer have, someone else may be able to use it, and you may not be able to get back in.

Do this
  1. Check the recovery email address and phone number on your main accounts are current and secured.
  2. Remove old devices and signed-in sessions you no longer use.
  3. Review third-party apps connected to your Google, Microsoft, Apple and social media accounts, and remove ones you do not use.
  4. For security questions, use random answers stored in your password manager. A real mother's maiden name or first school can often be found online.
  5. Set up a trusted recovery contact or legacy contact where offered, so someone you trust can help you, or your family, get in.

6Myths and facts

You should change your passwords every few months.

US government guidance from NIST advises against forced regular changes, because people respond with predictable tweaks. Change a password when there is a reason: a breach, a warning or suspicious activity.

A complicated password like P@ssw0rd! is strong.

Attackers try those substitutions first. Length and randomness matter far more: a passphrase of random words is both stronger and easier to type.

Nobody would bother hacking my accounts.

Most attacks are automated and untargeted. Stolen passwords are tried against thousands of accounts at once, and any account is worth something: for sending scams, buying goods or reaching your contacts.

Putting all my passwords in one place is too risky.

Reputable password managers encrypt your vault with a master password the company never sees. With a strong passphrase and two-step verification, that is far safer than reusing passwords.

Check your understanding

Which account should you secure first?

Which two-step method cannot be used on a fake website?

Your phone shows a sign-in approval you did not start. What does it mean?

Your checklist

Your ticks are saved only in this browser. Nothing is sent anywhere.

This module is general educational information, not professional advice, and following it cannot guarantee your accounts will not be compromised. Products are named as examples only; Rondel Group is not affiliated with them. Settings and features change, so follow each provider's current instructions.