Most account takeovers happen because a password was reused, guessed or typed into a fake page. Three habits stop most of them: a different password for every account, two-step verification on the accounts that matter and a way to end sessions if something goes wrong.
What makes a password strong
Length and uniqueness matter more than clever symbols. Attackers try common passwords and words with small changes first (this is what a dictionary attack is). A long random password or a passphrase of several unrelated words is far harder to guess. But a strong password reused on two sites is only as safe as the weaker site. When one site leaks its passwords, attackers try the same login everywhere else.
Use a password manager
You cannot remember dozens of unique passwords, so let a manager do it. Browsers and phones have built-in ones, and dedicated apps exist. A manager creates long random passwords, fills them only on the correct domain (which helps against fake login pages) and syncs between devices. Protect it with one strong passphrase and two-step verification. Start with your email, bank and main social accounts, then change others as you log in.
Two-step verification: which kind
- Passkeys and security keys: strongest, and not usable on fake sites. Use where offered.
- Authenticator app codes: good, and work without mobile signal.
- Text message codes: better than nothing, but can be intercepted or phished. Use if that is all that is offered.
Never read a code to someone who contacted you. A real service does not ask for it.
Where to start
- Email. It can reset every other account, so secure it first.
- Banking and payments.
- Phone account and cloud storage.
- Social media and shopping.
Sessions and cookies: ending a stolen login
When you log in, the site gives your browser a small token (a session cookie) so you stay signed in. If malware or a fake page steals it, someone can use your account without your password. Two-step verification does not always stop this. Good responses: sign out of all devices from the account's security page, change the password, remove unknown devices and review recent activity. Keep your browser updated and avoid unknown extensions.
Check for breaches
Search your email address on a trusted breach-notification site such as Have I Been Pwned. If it appears, change that password and any place you reused it. Never enter your actual password into a checking tool.
See where you stand
The security checkup turns your answers into a prioritised action plan. If you think you have already given a password to a fake page, read what to do next.