Getting to know account security

Account security is about making it harder for someone else to sign in as you, while keeping a reliable way for you to get back in. You can improve it one account at a time. Start with an account you use often, especially your main email.

1. Give each account its own password

A password used in several places creates a chain of risk: if one service is breached, someone may try the same password elsewhere. Use a different, long password for every account. A passphrase made from several unrelated words can be easier to remember than a short password with predictable substitutions.

Avoid names, birthdays, or a familiar phrase with just a number added. You do not have to memorize every account’s password.

2. Let a password manager do the remembering

A password manager stores account logins in a protected vault and can generate unique passwords. Choose a reputable service, learn how its recovery process works, and protect the manager itself with a strong master password and extra sign-in protection when available.

If you want help setting it up, stay involved and enter your own credentials privately. A family member or support provider can explain the steps without needing a copy of your passwords.

The NIST’s guide to passwords and account protection explains longer passwords and password managers.

3. Add an extra sign-in check

Multifactor authentication, often shortened to MFA or called two-step verification, adds another check beyond your password. A service might ask for a code from an authenticator app, approval on a registered device, or a physical security key. Available choices vary by account.

Follow the service’s own setup instructions. Save any backup codes in a secure place you can reach if your usual device is lost. Treat those codes like spare keys to your account.

If an approval request arrives when you are not signing in, decline it. Do not read a sign-in code to an unexpected caller, even someone claiming to be support. Only enter it into the genuine sign-in process you started.

Read the FTC’s guide to two-factor authentication for the differences between common methods.

4. Get familiar with passkeys

Some services offer passkeys instead of a password. You may unlock a passkey using your device’s fingerprint, face recognition, or screen-lock code. Passkeys are designed to resist phishing, but you still need to protect your device and understand the service’s recovery options.

Before switching, check how you would sign in from another device or recover access if your phone were lost. A Login.gov account-protection guide explains stronger authentication choices and checking for unfamiliar account changes. Each service’s instructions may differ.

5. Keep a way back into your account

• Review your recovery email address and phone number. Update details you no longer control through the account’s security settings.
• Check for unfamiliar signed-in devices, recovery methods, or security changes. If something is unfamiliar, follow the provider’s official steps to secure the account.
• Keep your phone, computer, browser, and apps updated. Use a device screen lock.
• Open account settings from a trusted app or saved website, rather than a security alert link you were not expecting.

The FBI’s online-safety tips for adults cover unique passphrases, MFA, passkeys, and software updates.

Start small and keep control

For your first session, pick one account: review its password, turn on an additional sign-in check, and confirm recovery details. Test the new sign-in method before removing an older recovery option. If you are helping a parent or another adult, get their permission and let them make the decisions about their account.

If you think someone already has access, use the provider’s official recovery instructions from a trusted device. If you also reused that password elsewhere, change those accounts too. Never send passwords or backup codes through the website’s inquiry form.

Patient help, at your pace

Zero Trace can explain account settings, practice sign-in steps with you, and help you plan a Cybersecurity Checkup. Request a free review to discuss your devices, comfort level, and priorities. These habits reduce risk; no setup can guarantee that an account will never be targeted.