Securing Accounts

Most account takeovers aren’t clever. A password leaks from one site or gets typed into a fake page, and someone (or something) tries it everywhere else. Securing an account mostly means making that first step fail, and making sure a second step stops the attacker if it doesn’t.

Three habits cover most of the risk: a different password for every account, a second check (or a passkey in place of the password), and extra care for your email account, because email can reset almost everything else. Plan on an evening. The first two steps in the action list below matter most.

This page covers personal accounts. It doesn’t cover protecting a company’s systems, and it isn’t a plan for someone facing a state-level adversary, who needs a different approach (see threat modeling).

What account security means in practice

Take a made-up but common case. In 2019 you join a small hobby forum with your email address and the same password you use for your email. In 2024 the forum is breached and its user list is sold. Software then tries each leaked email and password pair on popular sites, automatically. Nobody chose you. A script did.

This is called credential stuffing, and Microsoft’s security team names password reuse as the thing that makes it work (Microsoft, 2019). If the script gets into your email, it can use “forgot password” to reach the rest. The UK’s National Cyber Security Centre (NCSC) lists exactly that: a criminal inside your email can reset your other account passwords, read private information and impersonate you (NCSC).

So securing an account is three jobs. Make the password worthless to anyone who found it elsewhere. Add a second check that a leaked password can’t satisfy. And make sure the recovery route (your email, your phone number, your backup codes) can’t be turned against you.

How accounts get taken over

Four routes account for most of what ordinary people face.

• Reused passwords. The case above. It needs no skill and runs on its own.
• Phishing. A message sends you to a fake login page that collects your password and, if you type it in, your one-time code as well. NIST’s guidelines point out that keystroke logging, phishing and social engineering work just as well against long, complex passwords as short ones (NIST SP 800-63B-4, appendix A). Verizon’s 2026 breach report says people fall for mobile lures (texts, calls) more often than for email phishing (Verizon, 2026).
• Phone number takeover. In a SIM swap, a scammer tells your mobile carrier your phone was lost and asks for your number to be moved to a SIM card they hold (FTC, 2019). Your texts and calls, including login codes, now go to them. Google warns that codes sent by text or call can be vulnerable to phone-number-based attacks (Google Account Help). We couldn’t find a reliable worldwide count of SIM swaps, so we can’t tell you how likely one is. It needs a person at your carrier to be fooled or bribed, which makes it rarer than password reuse attacks that run by themselves, but it is a real route.
• The recovery path. If an attacker can reset your password through a weak email account, or through security questions with guessable answers, the strong password never mattered. NCSC also notes that criminals sometimes set up a forwarding rule in a hacked email account so they receive copies of your mail and can reset other passwords (NCSC).

One piece of context. Verizon’s 2026 report found, for the first time in its history, that exploiting software flaws (31% of breaches) overtook stolen credentials as the top way into organizations. It counts company breaches, not personal accounts, so it doesn’t tell you your own odds. It is still a fair reminder that unpatched devices are a way in too.

How each protection works

Long, unique passwords and a password manager

NIST’s current guidelines treat length as the main driver of password strength. They note that composition rules (must include a capital, a digit, a symbol) push people toward predictable choices such as Password1!. For a password that is the only login factor, NIST tells services to require at least 15 characters, to accept at least 64, to check new passwords against lists of breached ones, and to allow password managers and pasting (NIST SP 800-63B-4).

A password manager generates and stores a different password for each site, so one leak stays one leak. NCSC describes two kinds: the built-in manager in your browser or phone, and a third-party app. Its advice is to use the built-in one if convenience matters most, and a reputable third-party one if you want extra features, use many kinds of device, or don’t want to be tied to one vendor (NCSC, 2025). The trade-off is concentration: you now depend on one master password and one account. NCSC adds that someone who reaches your unlocked laptop may reach your saved passwords, so lock your devices and protect the manager account with a second step.

A second check

A second step means a stolen password alone isn’t enough. The kinds differ a lot in what they stop (as of October 2026):

The “No” entries come from NIST, which says methods where you type or approve a value are not phishing-resistant because the value isn’t tied to the real site. NIST also treats codes sent over the phone network as a “restricted” method, meaning services should offer an alternative. The SIM swap column is our reading of how each method works: an authenticator app or prompt doesn’t depend on your phone number, and Google says its prompts help protect against SIM swaps. A strong second step also fails if the service lets someone bypass it with a text message, so check what your recovery options allow.

The US cyber agency CISA calls the FIDO/WebAuthn standard (the technology behind passkeys and security keys) the strongest form of multi-factor authentication (CISA, 2022).

Passkeys

A passkey replaces the password. Your device creates a pair of cryptographic keys for each site: the site keeps the public one, your device keeps the private one, and you approve a sign-in the same way you unlock your phone (fingerprint, face or PIN). The private key never leaves your device in a form anyone can read, and it only answers to the real site’s address, so a fake page gets nothing. A breach of the site leaks nothing you can reuse (FIDO Alliance, 2026; NCSC, 2025).

Passkeys can be synced between your devices through a provider (Apple, Google, Microsoft or a password manager) or stay on a single device such as a hardware security key. The FIDO Alliance, which promotes passkeys, says syncing is end-to-end encrypted, and also that device-bound keys on hardware give the highest assurance. The practical catch is that a synced passkey is only as safe as the account that syncs it. Protect that account like your email.

As of April 2026, NCSC recommends passkeys as people’s first choice wherever a service offers them, after reporting that they are at least as secure as the strongest password plus a second step. Where a service doesn’t support them, it advises a password manager plus two-step verification (NCSC, 2026). NCSC had held back from this advice a year earlier because of implementation problems, so expect rough edges when moving between devices or platforms.

Recovery paths

Backup codes are the usual safety net if you lose your phone. Google, for example, lets you print or download a set and keep it somewhere safe (Google Account Help). NIST tells services not to use knowledge-based questions (“first pet’s name”) for passwords, because the answers are guessable or findable, so if a service forces them on you, treat the answers as extra passwords and don’t answer truthfully. NCSC also recommends backing up your recovery options, for example with recovery keys or trusted contacts.

What this protects against, and what it doesn’t

Done together, these steps stop the most common attack on ordinary people: automated tries of a leaked password. Microsoft reported in 2019 that multi-factor authentication blocks over 99.9% of account compromise attacks on its cloud services. Read that as one vendor measuring its own traffic. It counts over 300 million fraudulent sign-ins a day, which is mostly bots, so the figure says more about automated attacks than about someone targeting you.

They don’t stop:

• A real-time phishing page that collects your code and uses it at once, unless you use a passkey or security key.
• Malware on your phone or computer, which can read what you type or what’s saved.
• Someone with your unlocked device, or with the master password to your manager.
• A carrier or support agent who is fooled into resetting things for the attacker.
• Scams where you hand over money or codes willingly, such as a caller claiming to be your bank or your provider. Google states it won’t call you to verify a code.

A breach at a service you use can still expose your name, email and other data. Unique passwords limit the damage to that one service.

Common myths

“I should change my passwords every few months.” NIST says services shall not force periodic changes, and shall force one only when there’s evidence of compromise. Frequent forced changes mostly produce predictable variations.

“Passwords with symbols and capitals are stronger.” Length matters more. NIST’s guidelines say composition rules lead people to patterns attackers already guess. A passphrase of several random words, at least 15 characters, beats Tr0ub4dor&3.

“Text-message codes are useless.” They aren’t. They stop most automated attacks, and turning them off while you wait for something better leaves you worse off. Upgrade when a stronger option exists; don’t drop what you have.

“Putting every password in one place is risky.” It is a concentration of risk, but the alternative for most people is reuse, which is worse. NCSC’s view is that password managers are far safer than memory, sticky notes or reused passwords, provided you pick a reputable one and secure it properly.

What to do, in order

1. Secure your email account first (about 15 minutes). Give it a long password that no other account uses, and add a second step. If you have ever reused that password, change it today. Email is the key to all your other resets.
2. Move your important passwords into a password manager (about an hour). Start with email, banking and payments, your phone carrier, your Apple, Google or Microsoft account, and social media. Let the manager generate them, and make the master password a passphrase of several random words, at least 15 characters. The built-in manager on your phone or browser is a fine start.
3. Turn on a second step, using the strongest kind each service offers. Prefer a passkey or security key, then an authenticator app or approval prompt, then text codes. On a Google account, as of October 2026, go to your account’s Security & sign-in page and choose 2-Step Verification. Save backup codes somewhere other than the phone that receives the codes.
4. Create passkeys where services offer them. Keep a second device or a security key as a fallback, and protect the account that syncs them.
5. Protect your phone number. Add a PIN or passcode to your carrier account, as the FTC advises. Where you can choose, use a passkey, app or prompt instead of text codes. Never read a login code out to someone who contacts you.
6. Check, then keep it current. Search your email addresses on Have I Been Pwned, a free breach-lookup service run by security researcher Troy Hunt since 2013. Change any password that appears, and any other account that shared it. Turn on automatic updates for your devices, and recheck your recovery email and phone number once a year.

If you think an account is already taken

NCSC’s advice, in order:

1. Use the provider’s account recovery process.
2. If it’s an email account, check its filters and forwarding rules for anything you didn’t add.
3. Change the password, and change it on any other account that shares it.
4. Log out of the account on all devices and apps.
5. Set up a second step.
6. Update your apps and devices, tell your contacts to distrust recent messages, and check bank statements.

If money has moved, call your bank using the number on your card or its official website. This page is general information, not financial or legal advice. Report fraud to your national service (NCSC points UK readers to Report Fraud; in the US, the FTC points victims to IdentityTheft.gov).

Sources

• Authenticator and Verifier Requirements and Strength of Passwords (appendix A), NIST SP 800-63B-4, NIST, 2025: authenticators, passwords
• Use a strong and separate password for your email, NCSC, 2018 (reviewed 2021): link
• Hacked accounts, NCSC, accessed October 2026: link
• NCSC: Leave passwords in the past - passkeys are the future, NCSC, 2026: link
• Trusting the tech: using password managers and passkeys to help you stay secure online, NCSC, 2025: link
• Turn on 2-Step Verification, Google Account Help, Google, accessed October 2026: link
• Passkeys, FIDO Alliance, 2026: link
• One simple action you can take to prevent 99.9 percent of attacks on your accounts, Microsoft Security Blog, Microsoft, 2019: link
• Implementing Phishing-Resistant MFA, CISA, 2022: link
• SIM swap scams: how to protect yourself, FTC, 2019: link
• 2026 Data Breach Investigations Report, Verizon, 2026: link
• Who, What & Why, Have I Been Pwned, accessed October 2026: link

Related pages

• Threat modeling
• Digital privacy and security