Stay safe online

A few simple habits protect your accounts. You don’t need to be a tech expert. Start with your email account, then work down the list. There’s a printable checklist at the bottom.

Is something wrong? Signs an account may be hacked

The FTC lists these signs:

• You can’t log in.
• You get a notice that your password or username changed, and you didn’t change it.
• You get a notice of a login from a device or place you don’t recognize.
• Friends or family get emails or messages you didn’t send, sometimes with random links or fake pleas for money.

If any of these happen, skip to If an account is hacked.

Secure your email account first

The FTC explains why: if someone hacks your email, they can request password reset links for your other accounts, get those links from your inbox, change your passwords, and lock you out. So give your email a strong, unique password and turn on two-step verification before anything else.

Strong passwords and passphrases

CISA (the U.S. Cybersecurity and Infrastructure Security Agency) says a strong password follows all three of these tips:

1. Long: at least 16 characters. Longer is stronger.
2. Random: either a random mix of upper- and lowercase letters, numbers, and symbols, or a passphrase of 4 to 7 unrelated words (CISA’s example: Horse Purple Hat Run Bay; don’t use that example itself). The FTC adds: avoid common phrases, song lyrics, or movie quotes.
3. Unique: a different strong password for every account.

Why websites ask for different things: NIST, the federal standards agency, says in its digital identity guidelines (SP 800-63B) that organizations should require passwords of at least 15 characters when a password is the only sign-in step, should not impose rules like requiring a mix of character types, and should not make people change passwords on a schedule (only when there’s evidence a password was compromised). Not every website follows these yet.

Password managers

CISA says a password manager is an easy-to-use program that creates, stores, and even fills in your passwords, and tells you when a password is weak or reused. You only need to remember one strong password: the one for the password manager (CISA suggests a long passphrase). CISA notes some are free, like those built into web browsers, and some cost money, and suggests reading reviews from a trusted source. usaBob doesn’t recommend any specific product.

Two-step verification (multifactor authentication, MFA)

CISA says MFA means using more than a password to get into an account, such as a text code or your fingerprint. Its steps:

1. Go to the account’s Settings (it may be called Account Settings, Profile, or similar), then the Security section.
2. Look for two-factor authentication, two-step authentication, or similar, and turn it on.
3. Pick a method: a code by text or email, an authenticator app that makes a new code every 30 seconds, or a fingerprint or face scan.

Never share a sign-in code with anyone who calls or texts you. The FTC says no caller from your bank’s fraud department will ever ask for it.

Passkeys, briefly

A passkey lets you sign in using your phone or computer’s fingerprint, face, or screen lock instead of typing a password. Apple says passkeys are highly phishing-resistant and always strong. Google says the fingerprint or face data used for a passkey stays on your device. If an account offers passkeys, they’re worth trying. See Google’s passkey help or Apple’s passkey security page.

Keep your phone, computer, and browser updated

CISA says flaws in software can give criminals access to files or accounts, and updates fix them. Its three steps: watch for update notices, install updates as soon as possible (especially for your web browser and antivirus software), and turn on automatic updates. Look in your device’s settings, possibly under “Software” or “Security,” or search the settings for “automatic updates.”

Spot fake websites, ads, and search results

• The first search results may be paid ads. The FTC says scammers sometimes use paid search results with another company’s name or a government service’s name. Scroll to the unpaid results to find the right website or phone number.
• Don’t assume a phone number in search results is real (FTC).
• Type the address yourself if you know it. To pay a bill, use the address or phone number printed on the bill (FTC).
• Check the spelling of the web address (CISA’s example of a fake: amazan.com).
• A lock icon doesn’t prove a site is honest. The FTC says scammers create fake websites and encrypt them to make you think they’re safe.
• Pop-up warning with a phone number? The FTC says tech support scams often start with a fake pop-up warning. Close it and don’t call.

Safe habits on public Wi-Fi

The FTC says that because most websites now use encryption, connecting through public Wi-Fi in places like coffee shops and airports is usually safe. Look for https or a lock symbol in the address bar. Still: keep your devices and browser updated, use strong passwords and two-step verification, and make sure the website itself is real, because a scammer’s site can be encrypted too.

Back up your photos and files

A backup is a copy you can get back if a phone is lost or a computer breaks or gets hacked. Use the official steps for your device:

• iPhone or iPad: back up to iCloud or to a computer (Apple Support). Apple says iCloud backups are always encrypted; computer backups can be encrypted but that’s off by default.
• Android: back up to your Google Account (Android Help). Google says to use a PIN, pattern, or password screen lock to help protect your backed-up data.
• Windows PC: use Windows Backup, signed in with a Microsoft account (Microsoft Support).
• Check now and then that the backup is actually running.

Check your privacy settings

The FTC suggests:

• Phone apps: go to your phone’s privacy settings to see what each app can access, like your location, contacts, or photos. Consider turning off permissions apps don’t need, or deleting apps that ask for a lot.
• Ads: your phone’s privacy settings have an “advertising” section where you can opt out of personalized ads from the phone maker. Your browser’s privacy settings let you allow or block personalized ads based on your browsing history.
• Social media, smart TVs, and streaming devices: review the privacy settings and permissions on each.
• Google accounts: Google says its “Data & privacy” and “Security & sign-in” sections are in your Google Account settings.

Want your address and phone number off people-search sites and Google? See Remove your personal info online. Worried someone could steal your phone number? See how to lock it for free.

What to do if an account is hacked

The FTC says: first make sure your computer’s security software is up to date and run a scan. Then follow the company’s own account recovery steps. Only use official recovery pages like these:

• Google / Gmail: Secure a hacked or compromised Google Account
• Apple Account: If you think your Apple Account has been compromised
• Microsoft / Outlook: How to recover a hacked or compromised Microsoft account
• Other accounts (Facebook, Instagram, Yahoo, X, and more): the FTC links to each company’s recovery instructions in How To Recover Your Hacked Email or Social Media Account.

After you get back in, the FTC says to change the password to a strong new one, sign out of all devices, turn on two-step verification, check for signs someone had access, and tell your contacts to ignore messages from the hacked account asking for help or money. If money or your Social Security number is involved, see I already paid and identity theft.