Why the email account comes first
Forget a password anywhere — the bank, the pharmacy, the store, social media — and what happens? A reset link is sent to your email. So whoever controls your email can reset everything else, one at a time, while you sleep. That is why criminals want it and why it comes first. Everything below starts there.
1. Make the email account yours again
- Password: long and used nowhere else. A phrase of four or five unrelated words — copper violin thursday lantern — is easy to type and remember and very hard to guess. Change it if it is short, if it is a pet's name, or if you have ever used it on another site.
- Two-factor authentication: the setting that asks for a code from your phone as well as the password. Turn it on. Prefer an authenticator app or the provider's own phone prompt over text-message codes if you are offered the choice; text messages will still do if that is what is available.
- Recovery settings: look at the recovery phone number and recovery email listed on the account. Make sure they are yours and current. This is how you get back in — and how a criminal who added their own number a year ago gets in too.
- Signed-in devices: most providers show a list of devices currently signed in. Sign out anything you do not recognize.
- Forwarding and filters: a common trick after a break-in is a hidden rule that forwards copies of your mail — or deletes the bank's alerts — silently. Look in the settings for “forwarding” and “filters” and remove anything you did not create.
2. The phone carrier: the PIN nobody sets
If your two-factor codes arrive by text, your phone number is a key too. Criminals call carriers pretending to be you and have your number moved to their phone — a “SIM swap” — after which your codes arrive with them. Every carrier lets you set an account PIN or passcode that must be given before any change; some call it a “port-out PIN” or “number lock.” Call your carrier or open its app and set one. It takes five minutes and closes a serious door.
3. Banking and money
- Two-factor on, using the bank's app or authenticator where offered.
- Alerts on: a text or email for every transaction over an amount you choose, and for any new payee or password change. Alerts are how you find out in minutes rather than at the end of the month.
- A unique password, not shared with the email account or anything else.
- Consider a credit freeze at Equifax, Experian and TransUnion, which stops anyone opening credit in your name. It is free, does not affect your existing cards, and can be lifted in minutes when you apply for something yourself.
4. Then the rest, without losing your mind
You are not going to change eighty passwords tonight, and you do not need to. Do the email, the carrier and the bank. Then, as you use each other account over the coming weeks, give it a unique password and turn on two-factor if it offers it — the social accounts (used to scam your friends), the shopping accounts with a saved card, the pharmacy and health portals, and anything to do with your home's cameras or locks.
Keeping the passwords: two honest options
A password manager — an app that generates and remembers unique passwords for every site, unlocked by one strong master password. This is the best answer for most people under most circumstances, and we are glad to help you choose and set one up.
A notebook — yes, really. A paper book kept at home, in a drawer, is a far better answer than reusing one password everywhere, and for some households it is the answer that will actually be used. The criminals who want your passwords are not in your kitchen; they are on the other side of the world. Write them down; keep the book where you keep the important papers; tell one trusted person where it is.
What is not an option: the same password on more than one account that matters. When any one site is breached — and they are, constantly — that password is tried against every bank and email provider within hours.
Devices, briefly
- Updates on and installed — phones, computers, tablets. Most break-ins use holes fixed months earlier.
- A screen lock on every phone and laptop, and “find my device” turned on so a lost phone can be located or erased.
- Photos and documents you would grieve to lose existing in two places — a backup drive, a second service, both.
Rather do this with someone at your side? This is the heart of our Household Security Checkup: you type, we guide, and nothing is written down except in your own plan. Free for seniors 65+, veterans, and Indiana nonprofits and houses of worship.