Lock down your accounts in 30 minutes

Do these in order. Email comes first: it can reset the password on almost everything else. Type each address below yourself, or use the app. Don’t search for them. The FBI warns that fake ads for real companies show up in search results.

If something is already wrong

• Someone is on the line or on my screen right now
• I paid or sent money
• I gave out a code, password, or card number
• Someone got into my account, or you can’t sign in
• My phone suddenly has no service

Your email

Open its security page:

• Gmail: myaccount.google.com, then Security & sign-in.
• Outlook or Hotmail: account.microsoft.com/security, then Manage how I sign in.
• Yahoo: login.yahoo.com/account/security.
• iCloud: on your iPhone, Settings, tap your name, then Sign-In & Security.

Then:

1. Add a passkey or an authenticator app. A passkey signs you in with your face, fingerprint, or screen lock. There’s no code to read out to anyone.
   • Gmail: open 2-Step Verification and turn it on if it’s off. Then go to myaccount.google.com/signinoptions/passkeys and choose Create a passkey. Google says a new one may take 7 days to work.
   • Outlook or Hotmail: account.live.com/proofs/manage, then Add a new way to sign in or verify, then Face, fingerprint, PIN, or security key. Or add the Microsoft Authenticator app. Microsoft is phasing out text-message codes for personal accounts, so add a second email address you check.
   • Yahoo: 2-step verification, then an authenticator app.
   • iCloud: check that two-factor authentication is on.

   Where nothing else is offered, text-message codes are better than nothing.

2. Check the recovery phone and email. Remove any that aren’t yours or aren’t current. Someone else’s number or address in those settings can be used to take over the account.
3. Sign out devices you don’t recognize. In Gmail: Your devices, then Manage all devices.
4. If this password is used anywhere else, change it to one you use only here.
5. Write down the backup codes. Gmail: Security & sign-in, 2-Step Verification, Backup codes. Print them and keep them at home, not in your email.

Helping a parent? Make the passkey on their phone. Google says to create passkeys only on devices you own.

Your phone number

Whoever moves your number to their phone gets your text codes. AT&T, Verizon, and T-Mobile each have a lock you turn on in their app:

• AT&T: Wireless Account Lock. AT&T app, the person icon, Wireless account lock.
• Verizon: SIM Protection and Number Lock. Two switches; turn on both. My Verizon app: Me, Edit profile and settings, Security.
• T-Mobile: SIM Protection and Port Out Protection. T-Life app: Manage, the gear icon, Security, SIM Protection. Add Port Out Protection to each line under Manage add-ons.
• Any other carrier: call the number on your bill and ask.

Set an account PIN too. The carrier uses it to check that a caller is you, so give it only on a call or chat you started.

The lock will block your own phone upgrade. That’s it working. Switch it off in the app when you change phones, and back on after. On Verizon, SIM changes and upgrades stay blocked for 15 minutes after you switch it off.

Your bank and cards

In each bank and card app, open the alert settings. Turn on push or text alerts for:

• card purchases and money leaving the account, at the lowest amount allowed
• sign-ins from a new device
• changes to your phone number, email, or password
• someone new added to the people you pay (a new Zelle contact or bill payee)

With alerts on, a charge you didn’t make shows up on your phone when it happens, not on next month’s statement. On a debit card, what you can owe grows the longer you wait to report it. When an alert worries you, open the app yourself or call the number on your card, not a number or link in the alert.

What to say

• I'd like every free lock you have on my line: one that stops SIM changes, and one that stops my number being moved to another carrier. And I want to set an account PIN.

• I don't use the app. Can you set up text alerts for every card purchase and transfer on my accounts, and for any change to my phone number, email, or password?

Your phone

No screen lock or passcode on your phone? Set one first. The theft protections below need it.

• iPhone: Settings, Face ID & Passcode, Stolen Device Protection (iOS 17.3 or later). Away from home or work, saved passwords then need your face or fingerprint, not just the passcode, and changing your Apple Account password takes an hour’s wait.
• Android: Settings, Google, All services, Theft protection. Turn on Theft Detection Lock and Offline Device Lock. On Android 15 and later, set up Identity Check too.
• Find My: on iPhone, Settings, your name, Find My. On Android, Find Hub turns on when you add your Google account.
• Automatic updates: on iPhone, Settings, General, Software Update, Automatic Updates. On Android, search Settings for “update.”

When you have another half hour

A password manager. It makes a different password for every account and fills it in only on the address you saved it for. Pick one:

• the Passwords app on iPhone, iPad, and Mac (iOS 18 or macOS Sequoia and later)
• Google Password Manager, in Chrome and on Android
• Bitwarden, which has a free plan and works on all of them

With Bitwarden you type one main password, so make it at least 15 characters: four or five words from its passphrase generator. Let the generator pick the words. Ones you pick yourself are easier to guess. Bitwarden can’t reset it if you forget it. Write it on paper and keep it at home.

Rehearse first: the Practice Lab walks through installing a manager, letting it fill in a login, and making a passkey.

A credit freeze at all three bureaus. While it’s on, nobody can open a new credit account in your name. It’s free, doesn’t affect your score, and lasts until you lift it. You can lift it for a while when you apply for credit, a job, an apartment, or insurance. Freeze online at Equifax, Experian, and TransUnion, or call Equifax at 888-298-0045 and Experian at 888-397-3742. TransUnion’s number is on transunion.com. Each bureau has you make an online account for lifting the freeze later. Keep the sign-ins with your papers.

An IRS Identity Protection PIN. A six-digit number that stops anyone else from filing a tax return with your Social Security number. Get it in the IP PIN section of your IRS online account (irs.gov/ippin). A new one comes each year, from mid-January, in the same account. Give it only to your tax software or preparer. The IRS never asks for it. A call, email, or text that does is a scam.

Can’t set up the online account? Form 15227 works if your adjusted gross income on your last return is under $84,000 ($168,000 married filing jointly). Otherwise, book a visit at an IRS Taxpayer Assistance Center.

What it looks like

6:40 p.m. You tapped Review payment in an email about a failed Fernmont Bank autopay. Your password manager, which always fills in your Fernmont sign-in, offers nothing.

fernmontbank-secure.com/signin

Fernmont Bank

Sign in to Online Banking

Your scheduled autopay of $184.20 could not be processed. Sign in to review your payment details and avoid a late fee.

Username
Password

Sign in

The page looks just like your bank's. What do you do?

• Copy the password out of the password manager and paste it in
• Close the page, open Fernmont's app or your bookmark, and look for the failed payment there
• Check the address first. It has "fernmontbank" in it, so sign in

Show the answers

• Wrong move Copy the password out of the password manager and paste it in The manager goes by the address you saved the password for, not by how the page looks. It stayed quiet because this isn't that address. Pasting it in hands it to whoever runs this page.
• Best move Close the page, open Fernmont's app or your bookmark, and look for the failed payment there If autopay really failed, it shows in your account. If the manager fills in your password there, the other page was fake. If it still doesn't, it's a glitch, and you're on the real site to sort it out.
• Wrong move Check the address first. It has "fernmontbank" in it, so sign in Anyone can register an address with your bank's name in it, plus a word like "secure." The manager already compared the address for you, and it didn't match.

When the password manager doesn't offer your password, don't fill it in by hand. Go to the site the way you always do and see whether it fills there.

Saturday, 2:15 p.m. Moving your number to your new phone keeps failing, so you open the support chat in your carrier's app.

Corvane app Corvane Wireless Support

2:15 PM

I'm trying to move my number to my new phone and it keeps failing.

Thanks for waiting. I see SIM Protection is turned on for your line. It blocks any SIM or eSIM change, including yours.

Turn it off in the app under Account > Security > SIM Protection, then try the transfer again. You can turn it back on once the new phone has service.

Someone is telling you to turn off a lock. What do you do?

• Turn it off yourself in the app, finish the transfer, and turn it back on
• Close the chat. Anyone who tells you to turn off a lock is a scammer
• Send the agent your account PIN so they can turn it off from their end

Show the answers

• Best move Turn it off yourself in the app, finish the transfer, and turn it back on You started this, in the carrier's own app, and you're flipping the switch yourself. The lock did its job: it stopped a SIM change until the account holder said so. Turn it back on once the new phone works.
• Wrong move Close the chat. Anyone who tells you to turn off a lock is a scammer Not here. Your own transfer failed, you opened the chat in the carrier's app, and the agent explained the error you're seeing. A move to a new SIM or eSIM fails while the lock is on.
• Okay Send the agent your account PIN so they can turn it off from their end You started this chat in the carrier's app, so it isn't the danger it would be on a call you didn't make. It's just slower than the switch in front of you, and some carriers only let the account holder turn the lock off.

Turning a lock off is fine when you started the change and you flip the switch yourself. When someone who contacted you asks you to, that's the attack.

What they’ll ask for

From someone who contacted you, each of these undoes the setup above. Stop, and go to the account yourself.

“Read me the code we just sent you.” A code goes into a site or app you opened yourself. Don’t read it out or forward it to anyone who contacted you.

“Tap Yes on the sign-in prompt.” If you aren’t signing in right then, say no. Getting prompts you didn’t start? Change that account’s password.

“Give me your account PIN.” Only on a call or chat you started with the carrier.

“Turn off your SIM lock.” Only you, in the carrier’s app, when you’re the one changing phones.

“Read me your number transfer PIN.” You give it to your new carrier, and only when you’re moving your number yourself. Nobody who calls you needs it.

“Install this app so I can secure your account.” It lets them use your phone or computer. Say no, and hang up or stop replying. Already installed it? Turn the device off (hold the power button), then use another device: I let someone control my computer.

What not to waste time on

Changing every password today. Email, bank, and phone carrier first. Change the rest as the manager saves them, money accounts first.

Symbols and swapped letters. “P@ssw0rd” shows up more than 6 million times in Have I Been Pwned’s list of leaked passwords. What protects you is length, and using each password in one place only.

Paying for identity monitoring instead of freezing. Monitoring tells you after a new account is opened. A freeze stops it from being opened, and it’s free.