Protect your online accounts in 10 minutes

Most account takeovers do not involve genius hackers. They rely on reused passwords, weak recovery settings and phishing, the same three tricks that have worked for years. The good news is that you can protect your online accounts against most of them in about ten minutes, with a phone, a laptop and a cup of coffee. Below are the four changes that matter most, in the order that gives you the biggest return for the least effort, plus a few bonus steps if you have time to spare.

Why a 10 minute checkup is enough to protect your online accounts

Attackers work at scale. When a site leaks a list of emails and passwords, criminals feed that list into software that tries the same combinations on banks, shopping sites and email providers. This is called credential stuffing, and it succeeds whenever someone reuses a password. Phishing works the same way: send a convincing message to a million people and some will type their password into a fake page.

You do not need to make yourself impossible to hack. You need to make yourself harder to hack than the next person on the list. A few basic settings do that.

Large breaches make this more urgent. When records like those in the recent Pentagon personnel data breach leak names, birth dates and contact details, criminals have exactly the information they need to guess security questions or sound convincing on the phone.

1. Secure your email first (3 minutes)

Your email is the master key, because every other password reset goes there. If someone controls your inbox, they can reset your bank, your shopping accounts and your social media one by one.

Do two things:

• Give it a long, unique password. A string of four or five random words is easier to remember than a jumble of symbols and far harder to guess. Never use it anywhere else.
• Turn on two step verification. In Gmail this lives under your Google Account's security settings. In Outlook it sits in your Microsoft account's security page. In iCloud it is under your Apple Account settings on your iPhone or Mac.

While you are there, look at the list of devices signed in to your account. If you see a phone or computer you do not recognize, sign it out and change the password.

2. Turn on two step verification everywhere it matters (3 minutes)

Two step verification, sometimes called two factor authentication, means a password alone is not enough to get in. You also need something you have, like your phone or a physical key.

Prioritize these accounts:

• Email.
• Banking and payment apps.
• Your phone carrier.
• Your Apple or Google account.
• Social media.

The best options, from strongest to weakest:

• Passkeys or a hardware security key. These are tied to the real website, so a fake login page cannot capture them. Many major services now support passkeys, and setting one up usually takes less than a minute.
• An authenticator app. It generates a fresh six digit code every 30 seconds on your phone. It is much safer than text messages because the codes never travel over the phone network.
• Text message codes, which are still far better than nothing.

Whatever you choose, save the backup codes the site offers. Store them in your password manager or print them and keep them somewhere safe. They are your way back in if you lose your phone.

3. Stop reusing passwords (2 minutes to start)

This is the step people put off, and it is the one that stops credential stuffing cold. You do not need to change every password today.

Install a password manager and let it create new passwords as you log in to each site over the next few weeks. Start with any account that shares a password with your email. Most managers will also flag passwords that have shown up in known breaches.

If you are not sure which one to pick, our guide on whether you need a password manager and how to choose one walks through the options. The built in managers from Apple and Google are a reasonable start if you stay inside one ecosystem. A dedicated manager makes more sense if you switch between Windows, Android and Apple devices.

4. Check your recovery options (2 minutes)

Recovery settings are the side door. If an attacker cannot get your password, they will try to convince the site that they are you and need to reset it.

Make sure the backup phone number and email on your key accounts are current and belong to you. Remove old numbers, especially from a previous job or a phone you no longer have. If a site still uses security questions, treat the answers like passwords: make them up, and store them in your password manager. Your real mother's maiden name or first school is often findable online.

Bonus steps

If you have a few more minutes, these close the next most common gaps:

• Add a carrier PIN or port out lock with your mobile provider to stop SIM swap attacks. In a SIM swap, a criminal talks your carrier into moving your number to their phone, then receives your text message codes.
• Freeze your credit at Equifax, Experian and TransUnion. It is free and you can lift it when you need a loan. It stops anyone from opening new credit in your name.
• Update your phone and browser. Many attacks rely on bugs that are already fixed. Turn on automatic updates and restart when prompted. If you are shopping for a new device, our guide to choosing a smartphone explains why the length of software support matters.
• Review app connections. Check which third party apps can access your Google, Microsoft or social media accounts and remove anything you no longer use.

Watch for phishing

Settings only go so far. Be suspicious of messages that create urgency, ask you to log in through a link, or ask for a code you just received. When in doubt, open the app or type the website address yourself.

A few warning signs show up again and again:

• A deadline that is suspiciously short, such as "your account will be closed in 24 hours."
• A sender address that is close to a real one but not quite right.
• A request to read back a code sent to your phone. No legitimate support agent needs it.
• A message that arrives right after big news, like a data breach or a company merger, and asks you to "verify" your details.

Scammers are also using AI to clone voices and faces. If a call from a family member asks for money or codes, hang up and call them back on a number you know. Our guide to protecting your family from deepfake scams explains how to agree on a family code word.

A simple routine to keep it up

Security is not a one time job, but it does not need to be a chore. Once a quarter, open your password manager's security report and fix anything it flags. Once a year, recheck the recovery details and signed in devices on your email and bank. When a company you use announces a breach, change that password and look for odd activity. For more practical security advice, browse our tech section.

Frequently asked questions

Is text message two step verification safe enough?

It is far better than a password alone, and it stops most automated attacks. It is weaker than an authenticator app or passkey because of SIM swap attacks, so upgrade your most important accounts when you can.

What if I lose my phone?

That is what backup codes are for. Save them when you turn on two step verification. If you use passkeys, they usually sync across your devices through your Apple, Google or password manager account.

Do I really need a different password for every site?

Yes. Reuse is the main reason credential stuffing works. A password manager makes it practical, because you only need to remember one strong password.

How do I know if my accounts were already breached?

Most password managers check your saved logins against known breaches. If one is flagged, change that password first, then turn on two step verification for that account.