Passwords, MFA, phishing and backups
Strong, unique passwords
Length matters more than complexity. A passphrase made of four or more random words, such as maple-orbit-tulip-canyon, is long, hard to guess and easier to remember than a short jumble of symbols.
Use a different password for every important account. When one website is breached, attackers often try the same email and password on other sites.
A password manager creates and remembers strong passwords for you, so you only need to remember one strong main password. Many browsers and phones include one, and there are reputable free and paid options.
Multi-factor authentication (MFA)
MFA adds a second step when you sign in, such as a code from an authenticator app, a prompt on your phone or a security key. Even if someone steals your password, they can't get in without that second step.
Turn it on first for your email, banking and social media. Your email matters most because it's used to reset the passwords for everything else. Authenticator apps and security keys are stronger than text-message codes, but any MFA is much better than none.
Some services now offer passkeys, which let you sign in with your fingerprint, face or device PIN instead of a password. They're designed to resist phishing, so use them where they're offered.
Spotting phishing
Phishing messages pretend to come from someone you trust. Watch for these warning signs:
- Urgent pressure, such as "Your account will be closed in 24 hours"
- A sender address or link that doesn't quite match the real organization
- Requests for passwords, sign-in codes, payments or gift cards
- Unexpected attachments or prize notifications
- Greetings like "Dear customer" instead of your name
If you're unsure, don't use the links or phone numbers in the message. Contact the organization through its official website or app, or the number on your card or bill.
Updates and backups
Updates fix security holes, so turn on automatic updates for your phone, computer, browser and apps. Back up important files using the 3-2-1 rule: three copies of your data, on two different types of storage, with one copy kept somewhere else, such as in the cloud.
If something goes wrong
- Change the password for the affected account, and anywhere else you used it.
- Turn on MFA if it wasn't already on.
- Check recent account activity and recovery settings, such as forwarding rules and backup email addresses.
- Contact your bank right away if money or card details are involved.
- Report the scam to the organization that was impersonated and to your national anti-fraud centre.