A simple starting point for protecting accounts.
- Start with your email account. Use a different password for every account so one stolen password cannot unlock the others.
- Choose long, unique passwords. A reputable password manager can create and store them. Ask for help setting it up if needed.
- Protect the password manager with a strong master password. Keep its recovery instructions somewhere private and secure.
- Turn on two-step verification when offered: an extra sign-in check, such as a code, after your password. Enter codes only when signing in yourself. Never read a code to an unexpected caller.
- Check that your recovery phone and email are current. Never put passwords or recovery codes into a support form or email.
Official Resources: CISA online safety guidance