Account Security Checklist

Your email account is the key to your other accounts, because password resets go to it. Securing it first protects everything else. This checklist takes about twenty minutes.

1. Secure your email first

1. Set a long, unique password that you use nowhere else.
2. Turn on two-step verification, preferably with an authenticator app or a security key rather than text messages.
3. Check the recovery email and phone number are yours and current.
4. Review recent sign-in activity and sign out of devices you do not recognize.

2. Use a password manager

• A password manager creates and stores a different strong password for every account.
• Protect it with one strong passphrase and two-step verification.
• Change reused passwords on shopping, banking and email accounts first.

3. Tighten your shopping accounts

1. Turn on two-step verification where offered.
2. Remove saved cards you no longer use.
3. Check the list of signed-in devices and sign out of old ones.
4. Review saved addresses and phone numbers.
5. Turn on purchase and sign-in alerts.

4. Watch for phishing

• Do not click links in unexpected messages about orders, refunds or locked accounts. Open the app or type the address yourself.
• Check the sender's address carefully, not just the display name.
• Never enter a one-time code you did not ask for, and never read one to anyone.

5. Keep devices updated

• Install system and browser updates.
• Use a screen lock on your phone and computer.
• Only install apps from official app stores.

If you think an account was taken over

1. Use the service's official password recovery to regain access.
2. Change the password and sign out of all devices.
3. Check for changes to the email address, phone number and saved payment methods.
4. Tell your bank if any payment details were exposed.
5. Change the same password anywhere else you used it.

Questions

Are text-message codes good enough?

They are far better than nothing. An authenticator app or security key is stronger where available.

How often should I change passwords?

Change them when there is a reason, such as a breach or reuse. A unique, strong password for each account matters more than a schedule.