Security

Do these in order. Most take about 10 minutes.

1. Start with the accounts that unlock everything else
   1. Your email account matters most, because it can reset the password on every other account.
   2. Then your Apple, Google or Microsoft account, your password manager, your mobile carrier, and your banks and brokerages.
2. Use a password manager, with a unique password for every account.
   1. Default: use the one built into your devices. It’s free and already installed.
      1. Apple Passwords if you mostly use iPhone and Mac.
      2. Google Password Manager if you use Android, Windows or Chrome. Turn on “on-device encryption” in its settings so only you can read your passwords.
      3. Your passwords are then only as safe as your Apple or Google account, which the rest of this list protects.
   2. If you want one that works the same everywhere: Bitwarden, 1Password or Proton Pass. Protect it with a long passphrase and two-step verification.
   3. Do-it-yourself option: KeePass with the file synced to Dropbox.
3. Turn on two-step verification (also called multi-factor authentication or MFA)
   1. Best: passkeys on at least two devices, or two hardware security keys (one for daily use and a backup kept somewhere else).
   2. Where passkeys aren’t supported, use an authenticator app such as Google Authenticator. Sign in to the app so your codes are backed up and a lost phone doesn’t mean lost codes.
   3. Remove SMS as a second step wherever you can, since it’s vulnerable to SIM swapping. Set up the new method first, then remove SMS, or you can lock yourself out.
4. Enroll in Google’s Advanced Protection Program
   1. Google’s strongest setting, for anyone who has set up passkeys or security keys.
   2. It deliberately makes account recovery slow, with extra checks, so an attacker can’t talk their way in. Keep your backup key or passkey somewhere safe.
5. Your account is only as secure as its weakest backup sign-in.
   1. Go to myaccount.google.com/security and remove SMS codes, the recovery phone and old recovery emails. Keep only security keys, passkeys and printed backup codes.
   2. Print your backup codes before removing anything else, and keep them with your important documents.
6. Lock your phone number with your mobile carrier
   1. Set an account PIN and turn on the carrier’s number lock or port-out protection (check its app or call). This is the main defense against SIM swapping, where a scammer moves your number to their phone.
7. Turn on automatic updates for your phone, computer and browser.
8. Build habits against scams
   1. Treat urgency as a red flag in itself.
   2. No real company will ask you for a code. Banks, government agencies and tech support never ask you to read back a code, and someone who asks for gift cards, crypto or a wire transfer is a scammer.
   3. Verify unexpected requests for money, codes, or access through a separate channel you initiate.
   4. Never approve a sign-in prompt you didn’t trigger.
   5. Don’t click on links in emails you didn’t expect, especially ones asking you to log in, pay, or “verify.” Go to the site yourself instead.
   6. Agree on a family code word. Voice-cloning scams that impersonate a relative are now cheap to run.
      1. Unguessable from the outside. Avoid pet names, street names, school mascots, favorite teams, or anything visible in photos or social media posts. Scammers mine exactly that material.
      2. Memorable for everyone. That includes grandparents, who are frequent targets of these scams, and kids once they’re old enough.
      3. Odd enough not to come up by accident. A random two-word combination works well.
      4. Never written in texts or email. Agree on it in person, so it can’t leak from a compromised inbox.
      5. A private memory is often the stickiest choice, because it’s easy to recall under stress and meaningless to outsiders.
9. Randomize your security question answers
   1. Instead of a real answer, generate a random one and save it as a note in your password manager.
   2. Use random words rather than gibberish, since you may need to read the answer to someone over the phone.
10. Freeze your credit at all three bureaus
    1. It’s free, and it stops anyone from opening a loan or credit card in your name. You can lift it briefly when you apply for credit.
    2. Experian / Equifax / TransUnion
    3. Parents can freeze their kids’ credit too.
11. Use a secure messaging app
    1. Look for end-to-end encryption: Signal, iMessage, or WhatsApp.
    2. Protect your account from takeover: in Signal, turn on Registration Lock; in WhatsApp, turn on two-step verification. iMessage is protected by your Apple account.
12. Use an email alias for sign-ups
    1. It cuts down on spam, and a phishing email sent to the wrong alias is easy to spot.
    2. Easiest: add + and a word to your Gmail address, like name+shopping@gmail.com. It still arrives in your inbox.
    3. Or use iCloud Hide My Email or Firefox Relay to create separate addresses.