The Basics · Step 4 of 13

Lock down your main accounts

Your email and phone accounts are the keys to your other accounts, so protect them first. If someone takes them over, they can reset the passwords on your other accounts. ¹

Why email and phone come first

Password resets for your other accounts go to your email. That makes email accounts a weak link in online security. ¹ Someone who gets into your email can reset the passwords on your other accounts. ²

Your phone number matters too. In a scam called a SIM swap, a criminal gets your phone company to move your number to a phone they control. ⁷ Then they get your calls and texts, including sign-in codes sent by text. They can use those to change your passwords and lock you out. ⁷

Use strong, unique passwords

CISA, the federal cybersecurity agency, says a strong password is long (at least 16 characters), unique (never used anywhere else), and randomly generated. ³

Using a different password everywhere is hard to remember. A password manager is a tool that creates strong passwords and stores them for you. ⁴ When you choose one, CISA suggests checking that it works on all your devices and that you understand how to recover your account if you get locked out. ⁴

A password manager has its own main password. CISA says not to lose it, and to turn on two-step sign-in for the password manager too. ⁴

Turn on two-step sign-in

Two-step sign-in asks for something more than your password, like a code. It is also called two-factor or multifactor authentication. ⁶ That makes it harder for someone who steals your password to get in. ⁸

There are a few kinds of second step: a code by text or email, a code from an authenticator app, or a physical security key. ⁶ The FTC says security keys are the strongest kind, and authenticator apps are safer than codes by text or email. ⁶ If someone does a SIM swap, they can get codes sent to you by text. ⁷ For important accounts, the FTC suggests an authenticator app or a security key instead. ⁷

Protect your phone company account

Your account with your phone company (your carrier) needs protection too. The FTC suggests setting a PIN or password on it to help prevent changes you didn't make, like a SIM swap. ⁷ Ask your carrier what other account protections it offers.

Don't give personal information to anyone who calls, emails, or texts you out of the blue asking for it. Contact the company yourself using a phone number or website you know is real. ⁷

What to do

Start with your main email account. Then do your phone company account. After that, CISA suggests checking your bank and other important accounts, and your social media accounts. ⁵

1. Change the password to a long, random one you have never used anywhere else. ³
2. Turn on two-step sign-in. Use an authenticator app or a security key if the account offers one. ⁶
3. Check the recovery email addresses and phone numbers. Make sure they are ones you entered and can still get into. ²
4. In your email settings, check for rules that forward your mail somewhere. Delete any you didn't set up. ²
5. Sign out of all devices, then sign back in on the ones you use. This kicks out anyone else who is logged in. ²
6. If the account uses security questions, avoid questions with answers someone could find online or in public records. ⁸
7. Set a PIN or password on your phone company account. ⁷

Watch for phishing

Step 1 explained how scammers send fake emails and texts to trick you into sharing information. Two-step sign-in helps, but stay careful. Don't click a link in an unexpected email or text. Go to the company's website or app yourself instead. ⁸

Last checked: November 8, 2026