The Two Changes That Stop Most Account Hacks: Password Managers & Two-Step Verification

When we help someone whose email or bank account was taken over, the cause is almost always the same: a password that was reused somewhere else, and nothing standing behind it.

Companies get breached all the time. When they do, criminals take the leaked email-and-password pairs and try them on every other site. If you’ve reused that password, they’re in.

Fix #1: Use a password manager

A password manager creates a strong, unique password for every account and fills it in for you. You remember one master password; it remembers the rest.

• Bitwarden — free, excellent, works on everything
• 1Password — polished, great for families and small teams
• Apple Passwords — built into iPhone, iPad and Mac

You don’t have to change every password in one sitting. Start with your main email, your bank, and any site with a saved credit card. Update the rest as you log in to them.

Fix #2: Turn on two-step verification

Two-step verification (also called 2FA or MFA) asks for a second proof — usually a code from your phone — when you sign in somewhere new. Even if someone has your password, they can’t get in without that second step.

Turn it on in this order:

• Your main email account — it can reset every other password you have
• Banking and investment accounts
• Amazon and other shopping sites with saved cards
• Social media, especially Facebook

An authenticator app (Microsoft Authenticator, Google Authenticator, or the one built into your password manager) is stronger than text-message codes. Passkeys — sign-in with your face or fingerprint — are even better where a site offers them.

Don’t forget the backup codes

When you turn on two-step verification, most sites give you recovery codes. Save them in your password manager or print them and keep them somewhere safe. They’re how you get back in if you lose your phone.

Want help setting it up?

This is one of our most common appointments, especially for seniors and small offices. We’ll set up a password manager, move your important accounts over, turn on two-step verification, and show you how it all works. Curious where else you stand? Try our free Cyber Safety Checkup.