The best way to protect your online accounts is to use a unique password for each one, turn on multifactor authentication or passkeys, and learn to spot phishing. These steps stop many common attacks, and most take only a few minutes to set up.

The threat is real. The FBI's 2025 Internet Crime Report recorded more than 1 million complaints and about $20.9 billion in reported losses. Phishing and spoofing were the most reported crime type, with 191,561 complaints.

Businesses face the same risks. Verizon's 2026 Data Breach Investigations Report found that the human element was involved in 62% of breaches, and stolen credentials played a part in 39%.

1. Use a long, unique password for every account

If you reuse a password, one data breach can expose several of your accounts. The US Cybersecurity and Infrastructure Security Agency (CISA) recommends passwords that are long, random, and different for each account.

Length matters more than complicated character rules. Updated NIST guidance moves organizations away from forced character mixes and routine password changes. You generally only need to change a password if there's a reason to think it has been exposed.

2. Use a password manager

A password manager creates, stores, and fills in your passwords, so you only need to remember one strong master password. Protect that account with multifactor authentication too, because it holds the keys to everything else.

3. Turn on multifactor authentication

Person using a smartphone to confirm an account sign-in
A second sign-in step helps protect you if a password is stolen.

Multifactor authentication (MFA) adds a second check, such as a code or fingerprint, when you sign in. A stolen password alone is then usually not enough to get in.

Start with your email, banking, password manager, and social media accounts. Where you have a choice, an authenticator app or security key is generally stronger than a text message code. MFA isn't foolproof, so never share a code with anyone who asks for it.

4. Switch to passkeys where you can

Passkeys let you sign in with your device's fingerprint, face scan, or PIN instead of typing a password. In April 2026, the UK's National Cyber Security Centre began recommending them as the first choice where services support them, because they resist phishing and remove the risk of password reuse. Use two-step verification on services that don't offer them.

5. Learn to spot phishing

Person carefully checking an email message on a laptop
Pause and check before you click a link in an unexpected message.

Phishing messages try to rush you into clicking a link, sharing a code, or sending money. They can arrive by email, text, phone, or social media. Watch for these warning signs:

  • Urgent threats, such as your account being closed today

  • Requests for passwords, codes, or payment details

  • Sender addresses or website links that look slightly wrong

  • Unexpected attachments or prizes

If you're unsure, don't use the link in the message. Open the official app or type the website address yourself.

6. Keep your devices and apps updated

Updates fix security flaws that attackers can exploit. Verizon's 2026 report found that exploiting software vulnerabilities was the most common way into breached organizations. Turn on automatic updates for your phone, computer, browser, and apps.

7. Secure your recovery options

Attackers can use weak recovery settings to take over an account even without your password. Check that your recovery email and phone number are current, save your backup codes somewhere safe, and avoid security answers that people could find online.

8. Review your account activity

Most major services show recent sign-ins, connected devices, and linked apps. Check them every few months, sign out of devices you don't recognize, and remove apps you no longer use. Turn on login alerts where they're available.

What to do if an account is hacked

Act quickly, because a hacker may use one account to reach others. The US Federal Trade Commission (FTC) lists warning signs such as messages or posts you didn't send, an emptied Sent folder, or being unable to log in.

  1. Scan your device. Update your security software and remove any malware it finds, so an attacker can't capture your new password.

  2. Change your password. Use a new, unique password, and change it anywhere you used the same or a similar one.

  3. Use the service's recovery page. If you're locked out, follow the official steps to prove the account is yours.

  4. Check your settings. Remove unknown recovery details, forwarding rules, devices, and linked apps, then turn on MFA.

  5. Warn your contacts. Tell them not to click links or send money based on messages from your account.

  6. Watch your finances. If payment details may be exposed, contact your bank or card provider immediately.

  7. Report it. Report fraud to your national authority, such as the FBI's IC3 in the US, Action Fraud in England and Wales, or ReportCyber in Australia.

Start with your most important account

If you do only one thing today, secure your main email account. It can often be used to reset the passwords for your other accounts. Give it a unique password and turn on a passkey or MFA, then move on to banking and social media.

Sources

  • American Banker. Unpatched software is now the top way into banks. 2026.

  • Biometric Update. UK NCSC formally recommends switch to passkeys. April 2026.

  • CISA. Use Strong Passwords.

  • Enzoic. NIST 800-63B Rev 4: What's New in Password Security.

  • FTC. How To Recover Your Hacked Email or Social Media Account.

  • NINJIO. Verizon DBIR 2026: What the Human Element Data Means. 2026.

  • Stingrai. Cybercrime statistics 2026, citing the FBI IC3 2025 report.