Keep your online account secure: passwords and phishing
Most hacked accounts are not broken into by clever tricks. They are opened with a password that was reused, guessed or given away. These steps protect any online account, from email and social media to shopping and money accounts.
Use a long, unique password
- Longer is better than complicated. Aim for at least 12 characters. A passphrase of four or more random words is easy to remember and hard to guess.
- Use a different password for every account. If one site is hacked, the same password cannot open your other accounts.
- A password manager can create and remember a strong password for each account.
- Do not use your name, phone number, date of birth or simple patterns such as 123456.
- Never share your password, not with friends, an agent or anyone claiming to be support. No real support team needs it.
Turn on two-step verification
Two-step verification (also called two-factor authentication) asks for a second proof, such as a code from an app or a text message, in addition to your password. Turn it on wherever it is offered, and start with your email account, because it can be used to reset the passwords of all your other accounts. Never tell anyone the code you receive.
Spot phishing and fake support
Phishing is a message or page made to look real so that you give away a password, a code or money. Warning signs:
- The message is urgent or threatening: "your account will be closed in one hour".
- The address of the link is slightly different from the real one, for example an extra letter, a number instead of a letter, or a different ending.
- A stranger or a "support agent" contacts you first on a messaging app and asks for your password, a code or a payment to "release" money.
- You are told to install a remote-control app so someone can "fix" your account.
- A prize or bonus that needs you to log in through a link you were sent.
How to check before you log in
- Type the address yourself or use a bookmark you saved from the real site, instead of tapping a link in a message.
- Look at the whole address in the browser bar before you type a password.
- Download apps only from the official website or the official app store of the service.
- If you are unsure, close the page and contact the service through its official contact details.
Keep your devices safe
- Keep your phone, computer and browser up to date.
- Use a screen lock on your phone and install apps only from trusted sources.
- Avoid logging in to important accounts on public Wi-Fi or on a computer you do not trust. Mobile data is safer.
- Log out on shared devices, and do not let the browser save passwords there.
Protect your personal data
Share only the information a service really needs. Be careful when you are asked for a photo of an ID document or a selfie: send it only through the official site or app or to a contact you have verified, and never post it publicly. Read a service's privacy policy to see what it keeps and why.
If you think your account was hacked
- Change your password at once, from a device you trust, and change it everywhere else you used the same password.
- Log out of all other devices if the service has that option.
- Check your email, phone number and recent activity for changes you did not make.
- Contact the service's support through its official contact details and report what happened.
- Scan your phone or computer for malicious software if you installed something you do not trust.
Frequently asked questions
- Is it safe to let my browser save passwords? On your own device with a screen lock it is generally fine. Do not save passwords on shared computers.
- How often should I change my password? Change it when there is a reason: it was shared, it appeared in a data breach or you think it was stolen. A strong, unique password matters more than changing it often.
- If someone else created my account, who knows the password? Anyone who set it up may know it. Ask the service how to change it to one that only you know.