Most account break-ins are not clever hacks. They happen because of reused passwords, fake login pages and missing updates. A few habits remove most of the risk.
1. Use a different password for every account
If one site is breached, criminals try the same email and password on other services. Unique passwords stop one leak from becoming many. Make them long: a passphrase of several unrelated words is stronger and easier to remember than a short, complicated one.
2. Use a password manager
Nobody can remember dozens of long, unique passwords. A reputable password manager creates and stores them, and fills them in for you. You then only need to remember one strong master password.
3. Turn on two-step verification
Two-step verification (also called two-factor authentication) asks for a second proof, such as a code, when you sign in. Use it first on your email, banking and social accounts. An authenticator app or a hardware key is safer than codes sent by text message.
4. Try passkeys where they are offered
Passkeys let you sign in with your fingerprint, face or device PIN instead of a password. They are tied to the real website, so they are very hard to steal with a fake page.
5. Be careful with links and attachments
Phishing messages pretend to come from a bank, delivery service or colleague. Be suspicious of urgency and threats. Instead of clicking, open the official app or type the website address yourself.
6. Keep your devices up to date
Software updates fix security flaws that attackers actively use. Turn on automatic updates for your phone, computer, browser and apps.
7. Secure your recovery options
Your recovery email and phone number can be used to take over an account. Keep them current, protect your email account most of all, and save backup codes somewhere safe.
Check whether you have been exposed
The website Have I Been Pwned lets you enter your email address to see whether it appeared in a known data breach. If it did, change that password and any other account that used it.
You do not have to do everything in one day. Start with your email account, because it is the key to resetting everything else.
