Protecting your accounts and digital identity.

Start with email

1. 1Turn on a second login step for email, banking, healthcare and social media: a compromised email account can expose your other accounts ¹.

Choose the strongest second step you can

1. 1Prefer passkeys or security keys. The NCSC says passkeys “stop phishing”: each site gets its own passkey, so a lookalike site cannot use it ². NIST defines phishing-resistant authentication as cryptographic and bound to the verifier (WebAuthn is an example), and says passwords, one-time codes and out-of-band codes are not phishing-resistant ³.
2. 2An authenticator app or biometrics are better than nothing. CISA lists texted codes, apps and biometrics without ranking them ¹. NIST treats SMS and voice as a “restricted” authenticator and prohibits email for out-of-band use ³. The sources emphasise different things.

Passwords

1. 1Use a password manager, a unique password for every site, and a second login step on the manager itself ².
2. 2Follow current NIST advice: no forced periodic changes (change only on evidence of compromise), no composition rules, and a minimum of 15 characters when a password is the only factor or 8 when it is part of multi-factor authentication ³.

Recovery: what people forget

1. 1Save recovery codes offline and back up your recovery options, such as recovery keys or trusted contacts ².
2. 2Treat your phone number as a security asset: in NIST's terms, changing a registered phone number counts as binding a new authenticator ³.
3. 3Remember that a SIM change or number port is a risk indicator for SMS codes ³.

Impersonation

1. 1Claim your name or handle on the main platforms, and keep one page that lists your official channels.
2. 2Report impostors through the platforms' own routes. YouTube, for example, requires a privacy complaint to be filed by the affected person ⁵.
3. 3“Friend” messages asking to borrow money may come from a hacked account. Mintsyfra says about 44% of adults reported receiving them (the study is not specified in the statement) ⁶. Verify by voice or another channel (see the guide “Voice clones and fake calls”).

Reduce what scammers can use

1. 1Make accounts private, limit public voice and video, and review what you post ^{4 8}.

If an account is hacked

1. 1Recover access from a clean device.
2. 2Reset the password.
3. 3Revoke all active sessions.
4. 4Turn the second login step back on.
5. 5Tell your contacts that scam messages may have been sent from the account.
6. 6Report it to the Cyber Police ⁷.

Limits