Trying to secure every account at once is exhausting. You do not need to do that. Start with the small group of accounts that can unlock your email, money, photos, devices, or other services.
Find the accounts that hold the keys
For many households, this is a useful order:
- Your main email. Password resets for other services often arrive here.
- Your Apple, Google, or Microsoft account. It may control photos, backups, saved passwords, and device settings.
- Banking and payment accounts. Include any service you use to send money.
- Your mobile carrier account. Your phone number may be used to confirm your identity.
- Important social accounts. Prioritize accounts used for work, community groups, or family memories.
Write down the account names, but not the passwords. Keep the list private. Five to eight accounts is plenty.
Begin with your main email
Open your email provider through its official app, a saved bookmark, or an address you type yourself. Do not use a sign-in link from an unexpected message.
Look for Security, Sign-in and security, or Account security. Then work through these steps.
Use a unique password
Change the password if you use it anywhere else or if someone else may know it. Make the new password long and unique. A password manager can create and remember one, but you do not need to choose a product today.
Turn on two-step verification
Two-step verification adds another check after your password. A passkey or security key offers strong protection when the service supports it. An authenticator app is another useful option. Text messages are less resistant to some attacks, but they can still improve security when no stronger method is practical.
Use the strongest option you can manage consistently. Our two-step verification guide explains the choices and recovery steps.
Check how you would get back in
Old recovery details can make a secure account difficult to recover. Confirm that:
- The recovery phone number is yours and still active.
- The recovery email belongs to you and is also protected.
- You recognize the signed-in devices and recent activity.
- You have saved backup codes if the service provides them.
Keep backup codes somewhere private and separate from your everyday phone. Do not keep the only copy in the photo library or cloud account that the codes unlock.
Repeat the same pattern
Move through one or two accounts at a time. For each account, check four things:
- A unique password or passkey
- A second sign-in step
- Current recovery details
- Recognized devices and recent activity
Shared access needs a plan too. Decide who is responsible for recovery and where instructions are kept. Use official family or delegated-access features when they are available. Avoid sending passwords or codes through ordinary email or text messages.
Know when to stop and get help
Use the service’s official recovery process if you see a device, sign-in, purchase, or setting change you do not recognize. For a financial account, call the number on your card or statement. Do not use contact details from an unexpected message.
If you think someone has access to your main email, use a trusted device. Change the password, review active sessions, and update recovery details. Then check the other accounts on your short list.
Your sensible stopping point
You are done for today when your main email has a unique password, a second sign-in step, and current recovery information.
Continue with the household safety check, or read the new phone setup guide before changing devices.