Category: Accounts and Passwords

The short version: a SIM swap is when a criminal moves your phone number to a phone they control. You can make it much harder in a few minutes. Start by adding a PIN to your phone account.

There is no need to panic

You may have heard about criminals who take over phone numbers. This guide explains what that means. It also shows what you can do about it. Most of the steps take only a few minutes.

What a SIM swap is

A SIM is the small chip that links your phone to your phone number. An eSIM does the same job, but it is built into the phone. You set it up with a code or an app, not a plastic card.

In a SIM swap, a criminal tricks or pays someone at your phone company. The goal is to move your number to a SIM or eSIM that the criminal controls. After that, your calls and texts go to the criminal’s phone. This includes text-message codes.

A port-out is a related trick. It moves your number to a different phone company, instead of to a new SIM at the same company. Both can end with a criminal controlling your number.

Why criminals do it

Many sites send a code by text to prove it is you. They also send a reset link or code if you forget your password. If a criminal gets your texts, they can use these codes to reset the passwords for your email, money apps and social media. The FBI describes this.

We have a separate guide about text codes. Read why text-message codes are the weakest 2FA.

Signs to look for

• Your phone suddenly shows “No service”, or it can make only emergency calls. (On an iPhone in the US, this can show as “SOS”.) Other people nearby have signal.
• You get a message from your phone company about a SIM change or a number transfer. You did not ask for it.
• You cannot sign in to your accounts.

These signs can have other causes. A network problem or a broken phone can look the same. If you are not sure, call your phone company.

How to protect your number

1. Add a PIN or passcode to your phone account. It can help stop changes you did not ask for. Never tell your PIN to someone who calls you. If someone says they are from your phone company, hang up. Then call the number on your bill or on the company’s real website.

2. Turn on a number lock, if your phone company has one. In the US, these companies offer locks. Check their help pages for the steps.

   • AT&T: Wireless Account Lock.
   • T-Mobile: SIM Protection and Port Out Protection.
   • Verizon: SIM Protection and Number Lock.

   A lock blocks changes until you turn it off. You will need to turn it off when you buy a new phone or move to a new phone company. In the UK, ask your phone company what security options it offers for your account, such as a PIN or password. To move your number to a new company, the UK uses a code called a PAC. Give a PAC only to a company you chose to join.

3. Move important accounts away from text-message codes. Use a passkey or an authenticator app. Read authenticator apps and two-factor authentication.

4. Keep your email account safe. Criminals use email to reset other passwords. Read secure your email.
5. Do not post your phone number in public. Also keep other personal details, such as your address, off public sites.
6. Turn on alerts. Ask your phone company and your bank to tell you by text or email when something changes. Choose email alerts if you can.

If a service only offers text-message codes, you can still use them. Do the steps above to protect your number.

If you think it has happened

Do these steps in this order.

1. Call your phone company from another phone. Use a friend’s phone, a work phone or a landline. Say: “I think my number has been moved.” Ask them to take back control of your number.
2. Call your bank and other money services. Ask them to watch your accounts. In the UK, you can dial 159 to reach most banks. It works on most big UK phone companies and may cost the same as a normal call. If 159 does not connect you, call the number on your card or in your banking app.
3. Change your email password first. Use a device you trust. Then change the passwords for your money and social media accounts.
4. Add an authenticator app to your email and other key accounts. Save your backup codes. Read recovery codes and backups.
5. Report it.
   • US: report at reportfraud.ftc.gov. You can also report to the FBI at ic3.gov and file a police report. If a criminal may have your personal details, IdentityTheft.gov gives you a step-by-step recovery plan.
   • UK: in England, Wales and Northern Ireland, use Report Fraud (formerly Action Fraud) at reportfraud.police.uk. In Scotland, call Police Scotland on 101.

Check your bank and card accounts for payments you do not know. If you see any, tell the company.

Scam texts

If you get a scam text, forward it to 7726 (SPAM). In the US and the UK, most phone providers accept this. Never read a code out to someone who contacts you.

Do this today (about 8 minutes in your phone company’s app)

1. Open your phone company’s app or website, or call them.
2. Add or change your account PIN.
3. Turn on a number lock if your company has one.

Another day: add an authenticator app to your main email account.

Never type a code or password into this website, and never read a code out to someone who contacts you.

Checked: 25 Oct 2026. Phone company feature names and app screens change. If yours looks different, search the company's help page.

The short version: a link set to “Anyone with the link” works for anyone who has the link. Check the files that hold personal details and switch them to “Restricted”.

Link sharing is handy, and easy to forget

Sharing by link is quick. You copy a link, send it, and the other person opens the file. Most shared links are harmless, like a recipe or a party plan.

You may forget the link exists. This guide helps you check the ones that matter. You do not need to stop sharing. Know which files are open to anyone with the link.

What “Restricted” and “Anyone with the link” mean

In Google Docs, Sheets, Slides and Drive, the General access setting decides who can open a file. Google describes these choices:

• Restricted: only people with access can open the file. You add them by email.
• Anyone with the link: anyone who has the link can use your file, without signing in to a Google Account.
• Public: anyone can search on Google and get access to your file, without signing in.

The options you see depend on whether your account is through Gmail, work or school.

What each person can do

Permissions are rules for what a person can do with a file. Google uses three roles:

• Viewer can open the file.
• Commenter can open it and add comments.
• Editor can change it.

When you share a link, you choose a role. Choose Viewer unless people need to change the file. When someone is not signed in, Google shows them in your file as an “anonymous animal”. You will not see their name.

How links travel

A link is like a key that anyone can copy. Someone can forward it in an email, paste it in a chat, or show it on a shared screen. You cannot control who passes it on. Your name and email address also show as the owner of a file you share by link.

What not to share by link

For files like these, use Restricted and add people one by one:

• scans of identity cards or passports
• bank or tax documents
• medical notes
• passwords (a password manager is the safe place for them)
• photos of children

Check one file

1. Open the file and click Share.
2. Under General access, open the drop-down list.
3. Choose Restricted, then click Done.
4. Look at the people with access. Remove anyone who no longer needs it. Change Editors to Viewers where you can. If the file is in a shared folder, removing someone can change their access to the whole folder.

To see who has access without opening the Share box, right-click the file and open File information, then Details. Google says a panel shows who owns the file and who has access.

Find files you shared by link

Start with the files that hold personal details, such as ID scans, tax papers and health notes. Open each one, click Share, and read the line under General access. If it says “Anyone with the link”, change it to Restricted.

Google’s help pages do not describe a way to search Drive for link-shared files, so check the files that matter one by one.

Safer ways to share

• Add people by email instead of sending an open link.
• Give Viewer access when you can.
• Stop sharing when the project is over. Open the file, click Share, find the person, choose Remove access, then click Save.
• Turn off “Editors can change permissions and share”. This stops editors from sharing that file. Open Share, click Settings, uncheck it, then click Done. If the file is in a shared folder, editors of the folder can still share the folder.
• If you use an eligible work or school account, you can set an expiration date on a person’s access with Add expiration.

If you publish a file to the web, that is different. Google says that, depending on your settings, publishing can make a file visible to everyone on the web. To remove it, you must stop publishing it.

School and work accounts

School and work accounts can have different rules, set by the school or employer. An administrator (the person who manages accounts for your school or employer) may stop you from sharing outside the organization. If you cannot change a setting, ask your administrator.

Related words: anyone with the link, public link, permissions, cloud storage, privacy settings, metadata. For the rest of your accounts, see the 30-minute account cleanup. Your email account matters here too: see how to secure your email account.

Do this today (about 8 minutes)

1. Open Google Drive and pick the three files that hold the most personal details.
2. For each one, click Share. If it says “Anyone with the link”, change it to Restricted.
3. Remove anyone on the list who no longer needs access. If the file is in a shared folder, removing someone can change their access to the whole folder.

Never type a code or password into this website, and never read a code out to someone who contacts you.

Checked: 25 Oct 2026. The steps are for Google Drive on a computer. Settings screens change. If yours looks different, search the company's help page.

The short version: a passkey lets you sign in with your fingerprint, face or phone lock instead of a typed password. The UK National Cyber Security Centre (NCSC) says to use passkeys where a service offers them.

Why people are moving away from passwords

Passwords are hard to remember and easy to give away. A criminal can trick you into typing one on a fake website, or steal it from a company’s data. Passkeys are a newer way to sign in.

What a passkey is

A passkey is a sign-in method that replaces your password. Apple and the FIDO Alliance (the industry group behind the standard) describe how it works. This is a simplified picture.

When you create a passkey, your device makes a pair of digital keys for that one site. Think of a lock and a key. The site keeps the lock. This is the public key, and it is not a secret. Your device keeps the key. This is the private key, and the site never sees it.

To use the key, you unlock your device as usual. That could be a fingerprint, your face, or your screen PIN. Google says your fingerprint or face data stays on your device and is never shared with Google. Biometrics means using your body, such as a fingerprint, to prove who you are.

Why it is safer

• Nothing to type. You have no password to type on a fake site.
• It works only for the real site. Your device ties each passkey to the real service. This is why passkeys resist phishing. Phishing is a trick message that gets you to give away a password or code.
• Less to steal. The site keeps the public key, which is not a secret. FIDO says that a breach of a site’s password list no longer matters, because there are no passwords on it. See data breach.
• Always strong. You never make up or reuse a password.

Passkeys do not solve everything. You still depend on your device and the account that protects your passkeys. FIDO says a passkey stored on a physical security key gives the highest security assurance, and that syncing (automatic copying) between devices is end-to-end encrypted (locked so the company storing it cannot read it). The key point is how well the account that syncs your passkeys is protected.

Where passkeys live

A passkey is saved in a credential manager. That is the part of your device or account that stores passkeys. Often it is built into your phone or computer, such as Apple Passwords (iCloud Keychain), Google Password Manager or Microsoft Password Manager. Some password managers store passkeys too.

Many credential managers sync passkeys to your other devices. Apple says iCloud Keychain is end-to-end encrypted. That means your passkeys are locked with a key made from your device and your passcode, so Apple cannot read them. A credential manager also makes a backup, so you should not completely lose your passkeys if you lose a device. A passkey saved only on one security key, or one device, does not sync. Apple says iCloud Keychain must be on, and two-factor authentication must be on for your Apple Account. Google says you need at least Android 9, iOS 16, Windows 10 or macOS Ventura, an up-to-date browser, and a screen lock on your phone.

How to create one (Google Account example)

Checked on Google’s help page in Oct 2026.

1. On a phone or computer you own, go to myaccount.google.com/signinoptions/passkeys.
2. Sign in if Google asks.
3. Choose Create a passkey and follow the steps on screen. The button names may differ on your device.
4. Next time, sign in and choose the passkey when it is offered.

Google says to create passkeys only on devices you personally own, because anyone who can unlock that device can reach your account. Do not create one on a shared computer. Google also says a new passkey may take up to 7 days to be available at sign-in.

For a Microsoft personal account, Microsoft’s page says to go to account.live.com/proofs/manage and choose Add a new way to sign in or verify.

Sign in on someone else’s device

Google describes how to use the passkey on your phone to sign in on a computer that is not yours:

1. On the computer’s sign-in page, choose Try another way, then use your passkey.
2. A QR code (a square pattern your camera can read) shows on the screen. Scan it with your phone camera.
3. Confirm with your fingerprint, face or PIN on your phone.

Google says to turn on Bluetooth for this. Do this only on a computer you trust, and sign out when you are done.

If you lose your phone

There is no need to worry. If your passkeys sync, they are also on your other devices or in your account. For a Google Account, remove the passkey of the lost device, or sign that device out. Then follow your provider’s steps. Keep your recovery options and backup codes up to date. Google says adding a passkey does not remove your other recovery options.

Honest limits

• Not every website offers passkeys yet.
• Where a site has no passkey, use a strong password from a password manager, plus a second step (an extra check after your password, such as a code from an app). See two-factor authentication.
• Some work or school accounts only allow passkeys as a second step. Your school or employer decides. Its administrator (the person who runs those accounts) sets the rules.

Passkeys or an authenticator app?

Use passkeys where a service supports them, and use two-step verification (an extra check after your password) where it does not. So choose a passkey first. An authenticator app is the next best choice. Text message codes are a last choice. Read why text message codes are weaker. Start with your email account.

Related words: passkey, two-factor authentication (2FA).

Do this today (about 8 minutes)

1. Open the security settings of your Google or Microsoft account.
2. Create a passkey on a device you own. On an iPhone or Mac, save a passkey the next time a website or app offers one. Apple says iCloud Keychain must be on.

Another day: the next time you sign in, choose the passkey. Google can take up to 7 days before it offers a new passkey. If it is not offered, sign in your usual way and try again later.

Never type a code or password into this website, and never read a code out to someone who contacts you.

Checked: 25 Oct 2026. The worked example uses a Google Account. Settings screens change. If yours looks different, search the company's help page.

The short version: a recovery code is a backup code that gets you into your account if your phone is gone. Make your codes today, keep them in a safe place that is not your phone, and never read one to anyone who contacts you.

The worry is reasonable

Many people worry: “What if I lose my phone?” Preparing takes a few minutes.

What recovery codes are

A recovery code is a backup way into your account if your phone is gone or broken. Google and Facebook give you a set of codes, and each one works once. Some services call them backup codes. Microsoft and Apple work differently: they give you one long code or key to keep safe. A second step is the extra check you do after your password, such as a code from an app on your phone. See two-factor authentication and recovery code.

Where to get them

Look in your account’s security settings.

• Google. In your Google Account, go to Security & sign-in, then 2-Step Verification, then Backup codes. Google gives 10 codes. Each has 8 digits and works once. If you make a new set, the old set stops working.
• Microsoft (personal account). Go to account.live.com/proofs/manage/additional. Under Recovery code, choose Generate a new code. It is one 25-digit code, not a set. A new code makes older codes stop working. Microsoft says you cannot look up an old code later. You use it if you forget your password or your account is compromised (hacked). If two-step verification is on, Microsoft says you must wait 30 days for changes to take effect.
• Apple. Apple has a recovery key, a 28-character code. It is optional. Apple says that if you set one up, you turn off Apple’s standard account recovery. If you then lose the key, you can be locked out permanently. Read Apple’s page before you decide. It is in Settings, your name, Sign-in & Security, Recovery Key.
• Facebook. In Accounts Center, go to Password and security, then Two-factor authentication. Choose your account, then Additional methods, then Recovery codes. Facebook gives 10 codes. Each works once.

Where to keep them

Keep your codes in a safe place that is not on your phone. Google suggests the place where you keep your passport or other important papers.

• On paper. Print the codes or write them down. Keep the paper somewhere safe at home. Bitwarden says this about its own recovery code: a printed copy kept in a safe place prevents digital theft and accidental deletion.
• In your password manager. Many password managers have a secure notes feature, and Bitwarden says you can keep a service’s recovery codes there. Use this only if you can open your password manager without your phone. Keep the password manager’s own recovery code on paper instead.

Avoid keeping codes in an email to yourself, in a screenshot in your photos, or on a sticky note, because other people could find them. Instagram’s own help page suggests taking a screenshot of its codes. We advise against it. Copy the codes to paper and delete the screenshot. This is our advice, not Instagram’s.

Microsoft says not to store the code on a device you use to sign in. Apple says not to store its recovery key in the Passwords app, Notes, iCloud Photos or iCloud Drive. Keep the key somewhere else. Apple says you can use more than one safe place.

If you lose your phone

1. Sign in with a recovery code. For Google or Facebook, choose another way to sign in at the second step and enter one code. Each code works only once, so cross it off your list. For Microsoft, choose Other ways to sign in, then Forgot password, and follow the steps until it asks for your recovery code.
2. Move your authenticator app. Set it up again on your new phone. Read authenticator apps.
3. Make new codes. Generate a new set after you sign in. The old set may stop working.
4. Remove the lost phone. In your account’s device list, remove or sign out the old phone.
5. If you have no codes, use the service’s own recovery steps. Microsoft has an account recovery form. If you use a passkey, it may also be on your other devices.

If you lose both your codes and your second step, some services cannot let you back in. Bitwarden says you may be locked out of your vault. Apple says you can be locked out permanently if you set up a recovery key and then lose it.

Backups of the things you need

A backup is a copy of your important files stored somewhere else. A backup can be on the internet (cloud storage) or on removable media, such as an external hard drive.

CISA’s guidance for small businesses describes the 3-2-1 rule. The same idea works at home:

• 3 copies of important files
• 2 different kinds of storage, such as a hard drive and the cloud
• 1 copy away from your home

A simple plan: turn on your phone’s backup, and copy your photos and key documents to a second place. Check that your backup has all your important data in it. Protect your cloud account with a second step, because anyone who can open it can open your backups.

Extra safety nets

• Recovery email and phone. Add a recovery email address and phone number to your account. Google says they help you recover your account.
• Apple recovery contact. You can choose a person you trust who can help you get back in. They get a code for you. They do not get access to your account.
• Legacy or trusted contacts. Apple’s Legacy Contact is for after your death only. Apple says it does not include your iCloud Keychain passwords and passkeys. Google’s Inactive Account Manager acts after a death or a period of no use that you choose. This is not legal advice.

Stay safe

Never give a recovery code or a verification code to someone who calls or messages you. Anyone who asks for your code is a scammer. If someone asks, hang up. Then contact the company using a phone number you trust, such as the one on your statement or in its app.

One case is different. With an Apple recovery contact, you ask your own trusted person for the code, and you start the request yourself.

If you lose money, report it. US: reportfraud.ftc.gov. UK: Report Fraud (formerly Action Fraud) at reportfraud.police.uk or 0300 123 2040. Scotland: call Police Scotland on 101. Related: secure your email and the 30-minute account cleanup.

Do this today (about 7 minutes for one account)

1. Open the security settings of your main email account.
2. Generate the backup or recovery codes for your Google or Microsoft account. For an Apple Account, skip the recovery key unless you have read Apple’s page first.
3. Print them and keep them in a safe place that is not your phone. A password manager’s secure note is another option if you can open it without your phone.
4. If you already saved codes, a new set cancels the old one. Destroy the old copy only after the new one is saved.

Never type a code or password into this website, and never read a code out to someone who contacts you.

Checked: 25 Oct 2026. Settings screens change. If yours looks different, search the company's help page.

The short version: two-factor authentication (2FA) adds a second check after your password. Turn it on first for your main email account.

A password is one lock. 2FA adds a second lock.

Think of a door with one lock. A second lock makes it harder.

What 2FA is

2FA means you prove who you are in two different ways. Usually that is:

• Something you know, like your password.
• Something you have, like your phone, an app on it, or a small security key.
• Something you are, like your fingerprint or your face.

You need two of these to sign in.

You will see other names for the same idea. Multi-factor authentication (MFA) is the general name. It is the term the US agency CISA uses. 2-step verification (2SV) is the term often used in the UK. Google uses “2-Step Verification”. We mostly say 2FA here.

Why it helps

Passwords can be guessed, stolen, or given away after a trick. With 2FA turned on, a stolen password is not enough on its own. A criminal also needs your second step. CISA says this is why 2FA can make you significantly safer online.

2FA is not perfect. A fake website can still trick people into typing a code. That is why the kind of second step matters.

Kinds of second step, from stronger to weaker

Second step	What it is	How strong
Passkey or security key	A passkey lets you sign in with your fingerprint, face or phone screen lock. A security key is a small device you plug in or tap. See passkeys.	Strongest. They help against fake websites.
Authenticator app code	An app on your phone shows a new code, usually six digits, about every 30 seconds. See authenticator apps.	Strong. Better than a text message.
Code by text message or email	A service sends a code to your phone number or email. See why not text-message codes.	Weakest common choice.

CISA ranks them in this order. Security keys are strongest, and apps are safer than text or email codes. A criminal can take over your phone number and get your text messages. That is called a SIM swap.

If a site offers only text message or email codes, use them. It is better than nothing: any 2-step verification is better than none. CISA’s guidance for organizations says these codes should be a last resort. Switch to an authenticator app or a passkey when the site offers one.

Where to turn it on first

Go in this order.

1. Your main email account. Email can reset the passwords for your other accounts. See secure your email.
2. Bank and money apps.
3. Your Apple, Google or Microsoft account.
4. Your password manager. See password managers.
5. Social media and shopping accounts.

How to turn it on

Steps are similar on most sites:

1. Sign in and open Settings. Look for Security, Sign-in or Account.
2. Find 2-step verification, two-factor authentication or multi-factor authentication.
3. Choose a passkey or an authenticator app if offered.
4. Save your backup codes. These are one-time codes for when you lose your phone. Keep them somewhere safe. See recovery codes and backups.

Example: Google Account

1. Open your Google Account.
2. Choose Security & sign-in.
3. Under How you sign in to Google, choose Turn on 2-Step Verification.
4. Follow the steps. Add a passkey or an authenticator app, and save the backup codes.

Google may suggest “Google prompts”. These are tap-to-approve messages on your phone. Google says they help against phone-number attacks.

Example: Apple Account

Apple says most Apple Accounts already use two-factor authentication. To check on an iPhone or iPad, open Settings, tap your name, then tap Sign-In & Security. On a Mac, open System Settings, click your name, then click Sign-In & Security.

What it feels like every day

After you set it up, most sites ask for the second step only in some cases. These include a new device or a big change, such as a new password. Some sites offer “remember this device”. Use it only on your own devices.

Before you erase an old phone, read recovery codes and backups. It explains how to move your codes to a new phone.

Never share a code

If someone who contacted you asks you to read out a code, it is a scam. This is true even if they say they are your bank, a tech company or a government agency. Google says you will not get a call from Google to check a code.

If this happens:

1. Hang up or stop replying.
2. Do not share anything.
3. Contact the company using a phone number from its real website or your card.

If you get a code or sign-in approval you did not ask for, someone may be trying to get into your account, or someone may have typed your number or email by mistake. Do not approve it or share the code. An unexpected approval request can mean an attacker knows your password, so change the password on a device you trust. Then check that 2FA is on.

If you lost money or lost control of an account: in the US, report it at reportfraud.ftc.gov. In England, Wales and Northern Ireland, use Report Fraud (formerly Action Fraud) at reportfraud.police.uk. In Scotland, call Police Scotland on 101. For a scam text, forward it to 7726 in the US and the UK. This is free in the UK. AT&T says it is free for its customers.

Do this today (about 8 minutes)

1. Open the security settings of your main email account.
2. Turn on 2-step verification. Choose a passkey if the site offers one, because it uses your phone screen lock. Otherwise choose an authenticator app. Avoid text message codes if you can.
3. Save the backup codes in a safe place.

Another day: repeat for your bank and money apps.

Never type a code or password into this website, and never read a code out to someone who contacts you.

Checked: 25 Oct 2026. Settings screens change. If yours looks different, search the company's help page.

The short version: a text-message code is much better than a password alone. Other second steps are stronger. When you can, move to a passkey or an authenticator app.

First: you are not doing it wrong

If you use text-message codes, there is no need to worry. You are already safer than someone with only a password. A text code is better than no second step.

This guide helps you go from good to better. Nothing here means “turn it off now”. Do not remove a text-message code until a better method works.

How a text-message code works

A website or app sends a short number to your phone number. This is an SMS, which is a text message. You type the number into the website. The site then knows you hold the phone. This is two-factor authentication (2FA). It is a second check after your password.

Why it is the weakest common choice

CISA (the US cyber agency) puts text and voice codes last on its list of second steps. NIST (the US standards agency) calls this method “restricted”. It describes it as a less secure approach. Here are the main reasons. Each one is a single idea.

1. Someone can take over your phone number. This is called SIM swapping. A criminal tricks your phone company into moving your number to a SIM card the criminal holds. A SIM card is the small chip that links a phone to your number. Then your calls and texts go to the criminal. The FBI says this lets criminals receive your text codes and reset your passwords. To learn more, read SIM swapping.

2. A fake website can ask for the code. Phishing means a fake message or site that copies a real one. A fake site can ask for your password and then your text code. The criminal types both into the real site right away. CISA warns about this. Codes from an app can be tricked this way too. A passkey is built to resist this.

3. A code can show on a locked screen. Depending on your settings, a phone can show the start of a text on the lock screen. Someone who holds your phone could see the code. You can change this in your phone’s notification settings, for example by hiding message previews. Check your phone’s help page. NIST says a service should not show a code on a locked device.

4. No signal can mean no code. A text needs a phone signal. NIST notes that people in places with limited coverage may not be able to get these codes. An authenticator app works without a mobile signal, as Google also points out.

These points describe the method, not you.

What to use instead, in this order

1. A passkey or a security key. A passkey lets you sign in with your fingerprint, your face or your phone screen lock. A security key is a small device you plug in or tap. Both protect you from fake sites. Read passkeys.
2. An authenticator app. This is an app on your phone. It shows a new short code every so often. It does not use the phone network, so it also works without a signal. Read authenticator apps.

Not every service offers these. Use the best one that the service has.

How to switch safely

Follow these steps in this order.

1. Add the new method first. Keep the text code for now.
2. Test it. Sign out, then sign in with the new method.
3. Save your backup codes in a safe place. These are one-time codes for when you lose your phone.
4. Remove text messages only if the service lets you. Some do not.

Never remove your only method. If you do, you could lose access to your account.

If a service only offers text messages

Some services only offer text codes. Keep using them. It is better than nothing. Then protect your phone number:

• Ask your phone company to add a PIN or a lock on your account. A PIN is a number only you know. The steps are in SIM swapping.
• Do not share a code with anyone.
• Use a strong, unique password for that account.

What a scam text can look like

Scammers may text you a code you did not ask for. They may call you and say they are from your bank. Then they ask you to read the code to them.

Do not do this. Anyone who contacts you and asks for your verification code is a scammer. Google says it will not call you to check a code. A real company will not ask you to read a code out to someone who called or messaged you. Never read a code to someone who contacted you first.

If this happens, hang up and stop replying. Call the company on a number from its real website, your statement or its app.

To report a scam text, forward it to 7726 (SPAM). Most phone companies in the US and the UK accept this. If it does not work, ask your phone company how to report scam texts. In the US, you can also report scams at reportfraud.ftc.gov. If you lost money or were hacked, in England, Wales and Northern Ireland use Report Fraud (formerly Action Fraud) at reportfraud.police.uk. In Scotland, call Police Scotland on 101.

Your email account is the main way into your other accounts, so protect it first. Read secure your email. To learn the basics of 2FA, read two-factor authentication.

Do this today (about 8 minutes)

1. Open the security settings of your main email account.
2. Add a passkey or an authenticator app as a second step.
3. Test it. Sign out, then sign in again with the new method.
4. Save your backup codes in a safe place.
5. If the service allows it, remove text-message codes.

Never type a code or password into this website, and never read a code out to someone who contacts you.

Checked: 25 Oct 2026. Settings screens change. If yours looks different, search the company's help page.

The short version: your email account can reset the passwords for your other accounts, so protect it first. Use a strong, unique password or a passkey, add a second step, and check for settings you did not make.

Why email is the master key

Click “Forgot password” on a shopping site. The site sends a reset link to your inbox. Whoever controls your inbox can use that link.

If someone gets into your email, they can ask for a reset link for any of your other accounts. Then they can change the password and lock you out. This is why your email is the most important account to protect.

There is no need to panic. Six checks make it harder for someone to take over your email.

Step 1: Give your email a strong, unique password, or a passkey

“Unique” means you use it for nothing else. If you reuse it and another site leaks it, a criminal needs only that one password. Change it as soon as possible if you have reused it.

A password manager can make and remember a long password for you. A passkey is a newer way to sign in with your fingerprint, face or screen lock instead of a typed password. Google says you can create one in its Security Checkup.

Step 2: Add a second step that is not a text message

A second step is called two-factor authentication (2FA) or 2-step verification. A stolen password is then not enough to get in. Choose a passkey or an authenticator app. Google says text message codes are open to common phishing tricks (scams that trick you into giving away a code). It names security keys (small devices you connect to your phone or computer) and Google prompts as stronger choices. Use a text message only if nothing else is offered.

Step 3: Check your recovery options

Recovery options are the phone number and backup email address the provider uses to help you get back in. Check that each one is current and yours. Remove old ones, such as a phone number you no longer have. Google says these details can also alert you to suspicious activity.

Also save your recovery codes, if your provider offers them.

Step 4: Check where you are signed in

Look at your devices and recent sign-ins. Sign out any device you do not know. Microsoft says mobile phone services can route activity through other places, so a strange location is not always a problem. A device you do not know is the clearer sign.

Step 5: Look for changes you did not make

A person who gets in once may leave a way to get back in. Check three places:

• Forwarding. This sends a copy of your new mail to another address. Gmail, Outlook and iCloud Mail all have it. Someone could read your mail without signing in.
• Filters or rules. These move, hide or delete messages on their own.
• Apps with access. Some apps and sites can get into your mailbox or account. Remove any that you do not know or no longer use.

Delete anything you did not set up. If you did not set up a forwarding address, also change your password.

Step 6: Do not type your password after clicking a link

Phishing is a fake message or call that tricks you into giving away a password, a code or other private details. If a message says there is a problem with your email, do not click its link. Open your email provider’s website or app yourself. Google says it never asks for your password in an email, message or phone call.

Where to look in four common providers

Gmail / Google Account

• Google Account > Security & sign-in > Security Checkup (look for any “Recommended actions”).
• In Gmail, open Settings > See all settings. Check the Forwarding and POP/IMAP tab, and check your filters.
• Open the “Linked apps” page in your Google Account to review and remove access.

Outlook / Microsoft account

• Sign in to your Microsoft account, open Security, and look at Recent activity (the last 30 days).
• In Outlook, open Settings > Mail > Forwarding (or Forwarding and IMAP), then check Mail > Rules.
• Microsoft’s activity list shows “Permission given to an application” when you let an app into your account. If you see one you do not recognize, change your password.

Apple Account / iCloud Mail

• On an iPhone: Settings > [your name], then scroll down to see your devices. Tap one to see “Remove from Account”.
• On icloud.com/mail: Settings > Mail Forwarding. Make sure “Forward my email to” is off, unless you set it.
• In the same Settings, check Rules.

Yahoo

• Open the Yahoo Account security page. Check “Current sign-ins”, “External connections” and “Recent account activity”.
• Sign out any device you do not know. To remove an app, delete its app password.
• Also check your Yahoo Mail settings for filters. Forwarding is a Yahoo Mail Plus feature, so a free account may not have it.

If you think someone got in

Take these steps in order:

1. Use a device you trust. Change your email password.
2. Sign out of all devices.
3. Check forwarding, filters and apps with access.
4. Check your recovery phone and email.
5. Tell your contacts not to click links or send money if they get a message from you.

If you lost money or data, report it:

• US: reportfraud.ftc.gov.
• England, Wales and Northern Ireland: Report Fraud (formerly Action Fraud) at reportfraud.police.uk, or call 0300 123 2040.
• Scotland: call Police Scotland on 101.
• Phishing email, UK: forward it to report@phishing.gov.uk.
• Phishing email, US: forward it to reportphishing@apwg.org.

For a wider check of your other accounts, see the 30-minute account cleanup. Related words: account takeover, single sign-on, recovery code.

Do this today (about 9 minutes)

1. Open your email provider’s security check (for example Google Security Checkup or the Microsoft account security page).
2. Remove any forwarding rule or sign-in that you do not recognize. If you find one, also change your email password on a device you trust.

Another day: turn on a passkey or an authenticator app, then save your recovery codes.

Never type a code or password into this website, and never read a code out to someone who contacts you.

Checked: 25 Oct 2026. Settings screens change. If yours looks different, search the company's help page.

The short version: you do not need a whole weekend. Five small steps, about 30 minutes in total, make your accounts harder to take over. You can stop after any step.

How it works

Set a timer for each step. When it rings, move on, or stop for today. A partly finished clean-up is still useful. The first steps matter most.

This will not make you “safe” forever. It makes your accounts harder to take over, and that is a good result.

Minutes 0-5: Secure your main email

Your email account can reset the passwords for your other accounts, so it is the one to protect first. Use a strong, unique password. Add a second step (an extra check when you sign in). Check your recovery phone number and recovery email.

Full steps are in How to Secure Your Email Account. Your first time may take longer. That is fine.

Minutes 5-10: Use a password manager

A password manager is an app that makes and remembers a different password for each account. Your phone or browser may already have one built in. It is hard to make and remember a strong, different password for every account. A built-in tool or a password manager can do it for you.

Change the password on your email account first. Then change the password on the one other account that matters most to you, such as your bank. See the password manager guide if this is new.

Minutes 10-20: Turn on a second step

A second step is called two-factor authentication (2FA). It asks for something more than your password. Turn it on for:

• your email
• your bank and money apps
• your Apple, Google and Microsoft accounts
• your social media accounts

Choose a passkey or an authenticator app if the account offers one. An authenticator app or a security key (a small device you connect to your phone or computer) is more secure than a code sent by text message. Passkeys should be your first choice wherever a service offers them. Use a text message only when nothing else is offered.

Do not try to finish all accounts today. Start with email, then the money accounts.

Minutes 20-25: Save your recovery options

Recovery options help you get back in if you lose your phone or password. Check that your recovery phone number and recovery email are current and belong to you. If an account gives you recovery codes, save them somewhere safe, such as a printed copy with your important papers. Do not share them with anyone. See Recovery Codes and Backups.

Minutes 25-30: Remove what you do not use

Fewer old accounts mean fewer places to protect. Pick one or two of these today.

• Close accounts you no longer use. Closing an account can be permanent, so save any photos or documents you need first. Do not close your main email, Google, Microsoft or Apple account in this step. Closing those can also remove other services. Look in the account settings for “delete account” or “close account”. Some services make this hard to find, so search the company’s help page.
• Remove old apps. Delete apps you no longer use. This does not always close the account behind them.
• Remove old sign-ins. In your email account, check the list of devices and sign out old ones. See the email guide.
• Check your sharing. Look at files you share by link: Google Docs “Anyone With the Link”.

There is no need to feel bad about old accounts. Most people have some.

Check for a data breach. A data breach is when a company’s data is exposed and your details may be in it. A free service called Have I Been Pwned (haveibeenpwned.com) lets you type in an email address to see which known breaches include it. Never type a password into a breach-check site. A result of “not found” does not prove you were never in a breach. The service says it holds only a small part of all the breaches.

Keep the habit

Once every three months, take under 10 minutes for a quick check. Do three things:

1. Install updates for your phone, computer and apps. Updates fix security problems. Turn on automatic updates if you can.
2. Look at your devices and sign-ins.
3. Close one account you no longer use. Save anything you need first.

Your checklist

Copy this list to a notes app or print it.

• ☐ Email: strong password or passkey, second step, recovery options
• ☐ Password manager started; email and bank passwords changed
• ☐ Second step on email, money, Apple/Google/Microsoft and social accounts
• ☐ Recovery options checked; recovery codes saved somewhere safe
• ☐ One unused account closed; old apps and sign-ins removed
• ☐ Email address checked in a breach-check service
• ☐ Updates on, with automatic updates turned on if offered
• ☐ Next check set for three months from now

If you lost money or lost control of an account: in the US, report at reportfraud.ftc.gov. In England, Wales and Northern Ireland, use Report Fraud (formerly Action Fraud) at reportfraud.police.uk. In Scotland, call Police Scotland on 101.

Related words: two-factor authentication, authenticator app, recovery code, privacy settings, identity theft, single sign-on.

Do this today (about 9 minutes)

1. Set a timer for 9 minutes.
2. Do only the first step: secure your main email account. Check the password, the second step and the recovery options.
3. Stop when the timer rings. The other steps can wait for another day.

Never type a code or password into this website, and never read a code out to someone who contacts you.

Checked: 25 Oct 2026. The time for each step is an estimate. Settings screens change. If yours looks different, search the company's help page.

The short version: a password manager lets you use a different strong password for every account while you remember only one.

Our disclosure. SafeinAI has no affiliate links and earns nothing if you pick any of these. We list built-in options first and say which choices are free. If this ever changes we will say so here, on this page.

Most of us reuse passwords. That is normal.

You probably have dozens of accounts. Nobody can remember dozens of strong passwords, so many people reuse a few.

What a password manager is

A password manager is an app with a locked, encrypted vault. Encrypted means scrambled so that only the right key can read it. You remember one strong master password. The app creates, stores and fills in a different password for every site. (Some services call it the “primary password”.)

A password is a secret you type to sign in to an account. A passcode is the number that unlocks your phone.

Why reuse is the real risk

When one website leaks a password, criminals try it on other websites. This is called credential stuffing: testing stolen sign-in details on many other sites. If you reused the password, they get in. If every password is different, the damage stops at the first site.

Is it safe to keep everything in one place?

• Bitwarden, 1Password and Proton Pass each say on their own pages that vault data is end-to-end encrypted. Bitwarden and Proton Pass also use the word “zero-knowledge”. The company says it cannot read what is in your vault.
• Your master password and a second sign-in step (two-factor authentication, or 2FA) protect the vault.
• No tool is perfect. If someone got into your manager, they could reach all your passwords.
• Cyber security agencies in the US and the UK both advise using one. For most people, unique passwords in a manager are safer than reused ones.

How to choose

Question	What to look for
Security record	Does the company publish independent security audits? How did it handle past problems?
Ease of use	Does it work on your phone, browser and computer?
Price	What is free? What do you lose on the free plan?
Family sharing	Can you share some passwords with family in a safe way?
Support	Are there clear help pages and recovery options?

The best choice is the one that meets your needs and is easiest for you to use.

Free and built-in options come first

Your phone or browser may already have a free password manager. It is generally safe to use them on your own devices. In alphabetical order:

• Apple Passwords (iPhone, iPad and Mac, iOS 18, iPadOS 18, macOS Sequoia or later). It also works on a Windows PC with iCloud for Windows, in Chrome and Edge.
• Google Password Manager (Chrome and Android). It saves to your Google Account when you are signed in to Chrome.
• Microsoft Edge has its own password manager. Sign in to Edge with your Microsoft account and turn on sync to use your passwords on more than one device.
• Mozilla Firefox has a built-in password manager too.

Standalone managers are separate apps. Three examples, in alphabetical order, not a ranking:

• 1Password is paid. Its page shows a 14-day free trial and a Families plan for up to five people.
• Bitwarden says its basic password manager is “always free”. It also has paid plans.
• Proton Pass has a free plan with unlimited logins and unlimited devices. It also has paid plans.

We chose these three as examples because Bitwarden and Proton Pass have free plans, 1Password has a free trial, and each explains on its own pages how it protects your vault. Other good managers exist.

Prices change. Check the company’s page.

Built-in or standalone? Built-in is simplest if you stay in one phone or browser family. Standalone is better for mixed devices or extras such as family sharing.

How to make a strong master password

• Use a passphrase of random, unrelated words joined together. Some advice suggests three random words. US CISA suggests four to seven unrelated words and at least 16 characters. For this one password, use four or more words. Make your own.
• Never use it anywhere else.
• Length matters more than symbols. Adding length protects more than adding complexity. US government guidance (NIST SP 800-63B-4) tells services not to force a mix of symbols, capitals and numbers.
• Do not keep it in a note on your phone. You can write it on paper while you learn it, keep the paper very safe, and destroy it afterward.

How to set one up

1. Pick one manager from above.
2. Create the master password.
3. Turn on 2FA for the vault if offered. Choose an authenticator app or a passkey, not text-message codes. See authenticator apps.
4. Import your browser’s saved passwords if you like.
5. Let it fill in your next sign-in. It fills a password only on the right website, which helps against fake sites.
6. Change your email password before the others. Email can often reset the passwords on your other accounts. See secure your email.

Common worries

What if I forget my master password? Recovery differs by product. Bitwarden says it cannot retrieve or reset your master password. Read about recovery before you choose. See recovery codes and backups.

What about passwords saved in my browser? That is a password manager too. Lock your device. Never save passwords on a shared computer.

Can I share with family? In some products. Apple Passwords has shared groups. 1Password and Proton Pass have family plans.

What comes next

Use a passkey first when a site offers one. See passkeys. For a full clean-up, see the 30-minute account clean-up.

If an account was taken over: in the US, report at reportfraud.ftc.gov. In England, Wales or Northern Ireland, report to Report Fraud (formerly Action Fraud) at reportfraud.police.uk. In Scotland, call Police Scotland on 101.

Do this today (about 8 minutes)

1. Open the password manager you already have (Apple Passwords, Google Password Manager or your browser’s).
2. Create or confirm the master password or device lock.
3. Change the password for your main email account to a new one that the manager creates.

Another day: choose a standalone manager.

Do not type any password into this website.

Checked: 25 Oct 2026. Settings screens change. If yours looks different, search the company's help page.

The short version: an authenticator app is a phone app that shows a short code. You type the code after your password. It is a stronger second step than a text message.

Our disclosure. SafeinAI has no affiliate links and earns nothing if you pick any of these apps. We list built-in options first and say which choices are free. If this ever changes we will say so here, on this page.

You may see a square code on the screen. That can be normal.

You turn on two-factor authentication (2FA) for an account. The site then shows a square black-and-white pattern. This is a QR code. It asks you to scan it with your phone camera. If you opened the account’s own security settings page yourself, this is a normal setup step.

What an authenticator app is

An authenticator app makes a code, usually six digits. The code usually changes every 30 seconds. The app works without mobile signal or internet, because your phone calculates the code.

When you scan the QR code, the site and your app share a secret. Both use the secret and the clock to calculate the same code at the same time. The technical name is a time-based one-time password (TOTP). It is described in a standard called RFC 6238, which suggests 30 seconds but lets each service choose.

You may also see “2-step verification (2SV)”, the term often used in the UK. It means the same as 2FA.

Which app to pick

Ask these questions first:

• Can I move my codes to a new phone, or restore them if I lose this one?
• Does it have a backup option I understand?
• Is it simple to use?
• Does it show ads?
• Is it from a company or project I can name?

Here are options, in alphabetical order inside each group. We checked them on 25 Oct 2026. Apps change, so read the app’s page before you install. This is a list of examples, not a ranking.

Built into your phone or from a big company

• Apple Passwords is on iPhone, iPad and Mac. Apple says it makes codes without text messages or extra apps.
• Google Authenticator is on Android and iPhone. If you sign in with a Google Account, your codes sync (copy automatically) to your devices. You can also use it without an account. Then the codes stay on that phone.
• Microsoft Authenticator is for iPhone and Android. Microsoft says it is not available for PC or Mac. It can back up codes. Backups restore only to the same kind of phone (iPhone to iPhone, Android to Android).

Inside a password manager

• 1Password is paid. It stores codes with your logins.
• Bitwarden Password Manager can store codes. Its help page says free accounts can store keys, and Premium shows the codes.

Standalone apps

• 2FAS (iPhone and Android) says it is free and needs no account.
• Aegis (Android only) is free and open source (anyone can read its code).
• Bitwarden Authenticator (iPhone and Android) is free and needs no Bitwarden account.

We did not review Authy because we could not confirm its current device and backup support.

Set it up on your email account

This example uses a Google Account. Other email services are similar.

1. On a computer, open your Google Account. Choose Security & sign-in, then 2-Step Verification.
2. Choose the authenticator app option. Google’s page calls it Set up authenticator.
3. A QR code appears. Open your app, choose the add button, and scan the code with your phone camera.
4. The app shows a code. Type it on the site to confirm.
5. Save the backup codes the site gives you. See recovery codes and backups.

If you cannot scan: the site also shows a setup key, a long text code. Copy it into the app instead. Anyone with this key can make your codes, so keep it private. Do not post it or save it in a chat.

If you use Google Authenticator, Google says it may take up to 7 days before it shows as a sign-in option. Google also advises adding another second step, so you do not lose access to your account.

Backups, and moving to a new phone

The most common problem is a new phone. If you erase or replace your old phone first, your codes may be gone.

1. Before you switch, check how your app moves codes. Each app has its own steps.
2. Move the codes, then test one on the new phone.
3. Only then erase the old phone.

Examples: Google Authenticator can export codes to a QR code on the old phone, then import them on the new one. 2FAS moves between iPhone and Android through an exported backup file. Bitwarden Authenticator uses your phone’s cloud backup, or an export file.

Save each account’s backup codes too. They help you get back in.

Limits

Authenticator app codes are stronger than text-message codes. CISA, a US cyber agency, says that app codes can still be tricked by phishing. Phishing means a fake site that copies a real one. A fake site can ask for your password and your code, then use both at once.

• A passkey is stronger against fake sites. See passkeys.
• Never type a code on a page you reached from an unexpected message. Go to the site yourself instead.
• Never scan a QR code that arrived in an unexpected email or text. These can lead to fake sites.
• A real company should never ask you to read a code out to someone who contacted you.

If a site offers only text-message codes, use them for now. See why not text-message codes.

If you gave a code to a scammer: in the US, report it at reportfraud.ftc.gov. In England, Wales and Northern Ireland, use Report Fraud (formerly Action Fraud) at reportfraud.police.uk. In Scotland, call Police Scotland on 101. In the UK, you can forward suspicious emails to report@phishing.gov.uk. See also secure your email.

Do this today (about 9 minutes if you already have an app)

1. Use the authenticator in your phone or password manager, or pick one from the list above and install it.
2. On a computer, open your main email account’s security settings and choose the authenticator app option.
3. Scan the QR code, type the code the app shows, and save the backup codes in a safe place.

Never share a code or a setup key with anyone.

Checked: 25 Oct 2026. Settings screens change. If yours looks different, search the company's help page.