Lock down your life in an afternoon

A password manager makes, saves and fills in a different strong password for each account, so you only remember one (CISA).

1. Choose one. The one built into your phone or browser is free and fine to start with.
2. Install it on your phone and your computer.
3. Sign in to it on both, so your passwords follow you.

Read: What is a password manager?, Are browser password managers safe?

CISA says a strong password is at least 16 characters, or a phrase of 4 to 7 random words that have nothing to do with each other (CISA).

1. Pick 4 to 7 unrelated words, like a silly sentence only you would think of.
2. Make that your password manager's main password.
3. Write it on paper and keep it somewhere safe at home until you know it by heart.

Read: Glossary: master password

Use a different strong password for each account (CISA). Reused passwords let one leak open many doors.

1. Start with three: your email, your bank, and your phone company.
2. On each one, go to Settings, then Security, then Change password.
3. Let the password manager make the new password and save it.

Read: How to set up a password manager

Two-step login asks for a second proof, like a code or a tap on your phone, after your password (CISA).

1. Open your email account's security page: Google Security Checkup, Microsoft account security, or for iCloud mail, Apple's two-factor page.
2. Find 2-Step Verification or Two-step verification and turn it on.
3. If it offers an app or a passkey, pick that over text messages.

Read: How to turn on two-factor authentication, Glossary: passkey

Scammers who take over a phone number try to reset as many accounts as they can (FCC). Make sure resets go to you.

1. On the same security page, find Recovery phone and Recovery email.
2. Remove any number or address you no longer use.
3. Add a current one you control.

Read: Someone asked for your verification code?

The FCC suggests asking your phone company for a PIN or password that callers must give before changes are made (FCC).

1. Sign in to your phone company's app or website. AT&T calls it an account passcode (AT&T).
2. Find Security or Profile settings and set a PIN you don't use anywhere else.
3. Save the PIN in your password manager.

Read: Glossary: porting

Since an FCC rule from 2023, phone companies must offer a free lock that stops your number from being moved to another company (Federal Register). Verizon calls it Number Lock (Verizon). T-Mobile calls it Port Out Protection and also offers SIM Protection (T-Mobile).

1. In your phone company's app, open Security.
2. Turn on the number lock (port-out lock).
3. Turn on SIM protection too if you see it.
4. If you ever switch companies, turn the lock off first.

Read: I clicked a scam link. What now?

The FCC suggests turning on both email and text notifications for financial accounts (FCC).

1. Open your bank's app and find Alerts or Notifications.
2. Turn on alerts for withdrawals, transfers, new payees, and password changes.
3. Do the same in each credit card app.

Read: Got a bank fraud alert text?

CISA says to turn on two-step login (MFA) especially for email, social media and financial accounts (CISA).

1. In your bank app, go to Security or Sign-in settings.
2. Turn on two-step verification.
3. Repeat for any investment or payment apps you use.

Read: Glossary: two-factor authentication

If someone calls about your account, hang up and call the number you trust, such as the one on your bill (FCC).

1. Flip your debit card over and find the phone number on the back.
2. Save it in your contacts as "Bank (real number)".
3. Do the same for each card.

Read: Zelle scam: can you get money back?

An IP PIN is a six-digit number that stops someone else from filing a tax return with your Social Security number. Anyone with an SSN or ITIN who can verify their identity can get one, and a new one is made each year. The IRS will never ask for it by phone, email or text (IRS).

1. Go to the IRS IP PIN page and choose Get an IP PIN.
2. Sign in or create your IRS online account.
3. Open your Profile and request the IP PIN.
4. Save it in your password manager, and look it up again each January.

Read: Fake FTC and IRS calls

Your own account lets you review your earnings and watch for unusual activity. Social Security uses Login.gov or ID.me to sign you in (SSA).

1. Go to ssa.gov/myaccount.
2. Choose Login.gov (best for most people in the U.S.) and verify your identity.
3. Sign in and check that your earnings history looks right.

Read: Fake government calls

A credit freeze stops new lenders from seeing your report, so a thief can't easily open credit in your name. It is free (CFPB).

1. Go to the Equifax freeze page.
2. Create an account and confirm who you are.
3. Place the freeze. Save your login in your password manager.

Read: How to freeze your credit

You have to freeze at each bureau separately (USAGov).

1. Go to the Experian freeze center.
2. Create an account and confirm who you are.
3. Place the freeze.

Read: Credit freeze vs. fraud alert

TransUnion says freezing, unfreezing and lifting a freeze are free, and a freeze won't affect your credit score (TransUnion).

1. Go to the TransUnion freeze page.
2. Create a free Service Center account.
3. Choose Add a Freeze. Lift it later, for free, when you apply for credit.

Read: Glossary: credit freeze

ChexSystems is a report banks can check when you open an account. It offers its own free security freeze (ChexSystems).

1. Go to the ChexSystems freeze page.
2. Fill in the form and place the freeze.
3. Save the PIN or confirmation it gives you.

Read: What to do after a data breach

Many updates fix security risks, and automatic updates install them without you doing anything (CISA).

1. iPhone: Settings, General, Software Update, Automatic Updates. Turn them on.
2. Android: Settings, System (or Software update), and turn on automatic updates.
3. Turn on automatic app updates in the App Store or Google Play too.

CISA says to look in your device's settings, under Software or Security, for automatic updates (CISA).

1. Windows: Settings, Windows Update. Make sure updates are on.
2. Mac: System Settings, General, Software Update, Automatic Updates.
3. Restart when it asks. That is when most updates finish.

Read: Fake virus warning popups

The FBI warns that criminals use AI to copy a loved one's voice and recommends creating a secret word or phrase with your family to check who is calling (FBI).

1. Pick a word or short phrase that isn't online anywhere: not a pet, street or school name.
2. Share it in person or on a call, never by text or social media.
3. Agree: anyone asking for money in an emergency has to say it.

Read: Grandparent scams

The FBI suggests hanging up and calling the person or company back on a number you look up yourself (FBI).

1. Tell your family: if a call feels urgent, hang up.
2. Call the person back on the number already saved in your phone.
3. Share this checklist with them so they can do it too.

Read: Is this a scam? Check in 60 seconds