Start with the accounts that can unlock everything else
Make a short inventory: primary email, phone provider, password manager, banking, cloud storage, social networks and shopping accounts. Your primary email matters especially because many other sites send password-reset links there. Sign in directly from a trusted bookmark or app, not from a link in an unexpected message. Review recovery addresses, phone numbers and signed-in devices. Remove unfamiliar sessions and update outdated contact information before changing security settings.
Give every service a different long password
A stolen password is particularly dangerous when reused across accounts. Use a password manager to generate and store a separate random password for each site, and protect the vault with a long, memorable, unique master passphrase. Never email passwords to yourself or save recovery codes in an unprotected screenshot folder. Start with accounts where a stolen login could expose money, personal files or other services. If an account supports passkeys, consider enabling one as well.
Prefer phishing-resistant authentication where possible
Turn on a passkey or FIDO2 security key for your most important accounts when supported; this type of sign-in is designed to resist fake login sites. An authenticator-app code is generally a useful extra layer where passkeys are unavailable, but codes can still be tricked out of users by phishing. SMS codes are less robust, especially if your phone number is taken over. Check the available fallback methods so an old SMS recovery setting does not silently defeat stronger protection.
Set up account recovery before you lose a device
Keep backup sign-in methods current and store one-time recovery codes securely, separate from the device you might lose. For a hardware security key, consider registering a second key kept somewhere safe. Test whether you can find the provider’s recovery page and understand its steps, without signing out of all your devices at once. Do not share backup codes with someone claiming to be support staff; legitimate support generally will not need your codes.
Finish with five checks you can repeat
Review recent security activity and connected third-party apps, remove access you no longer recognize, and install operating-system and browser updates. Add a screen lock and automatic backups to phones and laptops. Treat urgent messages about blocked accounts as potential scams: open the service yourself instead of following the message. Repeat this quick review periodically and after any breach notification. If you suspect account takeover, use the official recovery process from a known safe device.
A general educational overview, not a substitute for professional guidance. Check current local rules and trusted primary sources before making consequential decisions.
Share this article
