How to secure your online accounts: passkeys, phishing, recovery codes and breaches

TUREFF• •0

Most account takeovers do not involve clever hacking. They happen because someone reused a password, typed it into a fake login page, or could not get back into an account once it had been taken over. This guide covers the habits that close those doors, from passkeys to what to do after a breach.

Start with unique passwords

Every account should have its own password, and the easy way to manage that is a password manager, which generates and remembers long random passwords for you. Protect the manager itself with a strong master password you use nowhere else and with two-factor authentication. If you only have time for one change today, make it this one, starting with your email account, because email is how every other password gets reset.

Passkeys: the login that cannot be phished

A passkey replaces a password with a cryptographic key stored on your device. You sign in by unlocking your phone or computer with your fingerprint, face or PIN.

There is no password to steal, reuse or type into a fake site.
A passkey only works on the genuine website or app it was created for, so a lookalike phishing page gets nothing.
Passkeys can sync between your devices through your phone's or computer's account, or through many password managers.

Major services including big email, shopping and social platforms now support passkeys. Look for the option under security or sign-in settings and add one wherever it is offered. Keep at least one other way to sign in, too, in case you lose your devices.

Two-factor authentication: not all types are equal

Two-factor authentication (2FA) asks for something extra besides your password. From strongest to weakest:

Hardware security keys and passkeys: resistant to phishing, because they check the website's real address.
Authenticator apps, which show a six-digit code that changes every 30 seconds: much stronger than SMS, but a convincing fake site can still trick you into typing the code.
Push approvals ("Is this you trying to sign in?"): convenient, but attackers sometimes send repeated prompts hoping you tap Approve. Never approve a sign-in you did not start.
SMS codes: far better than nothing, but vulnerable to SIM-swap fraud, where a criminal persuades a mobile network to move your number to their SIM.

Use the strongest option each service offers, at least for email, banking, your password manager and your phone's account.

Recognising phishing

Phishing messages pretend to come from a bank, a delivery company, a streaming service, your employer or a friend. Warning signs:

Urgency or fear: your account will be closed, a payment failed, a parcel is waiting, act now.
A link to sign in or "verify" your details.
Sender addresses or links that are slightly off: extra words, misspellings or unusual domains. On a phone, press and hold a link to preview it.
Requests for codes: no genuine company will ask you to read out a 2FA code. Anyone who asks is trying to get into your account.
Unexpected attachments, gift card requests, or a "friend" suddenly asking for money on a new number.

The safe habit is simple: do not use the link. Open the app or type the website address yourself, or call the organisation on a number you already have.

Recovery codes and recovery options

When you turn on 2FA, many services give you a set of one-time recovery codes. These get you in if you lose your phone.

Store them in your password manager, or print them and keep them somewhere safe at home.
Keep your recovery email and phone number up to date.
For important accounts, set up more than one way back in: a second security key, a passkey on another device, or a trusted contact where offered.

Losing access to your own email can be as damaging as being hacked, so spend ten minutes on this.

What to do after a breach

If a company tells you your data was leaked, or you suspect an account has been taken over:

Change the password for that account, and anywhere else you used the same one.
Sign out of all other sessions in the account's security settings and remove devices you do not recognise.
Check the recovery email, phone number and forwarding rules; attackers often change these to keep access.
Turn on 2FA or a passkey if it was not already on.
Watch your bank statements and contact your bank immediately about anything unfamiliar.
Be extra wary of phishing that uses the leaked details to sound convincing.
Report fraud to your bank and the relevant authorities in your country, and consider a credit freeze where that is available.

Breach notification services let you check whether your email address appears in known leaks, which is a useful prompt to change passwords. Have you set up passkeys yet, or had to recover a hacked account? Share your experience or ask a question in the comments below.