📝 Protect existing accounts: passwords, verification and recovery

Start with a different password for each account, additional sign-in verification where available, and recovery that does not depend on one phone. These protections complement one another.

This guide concerns accounts you already own, including email and communication services. Options differ between services. Reach security settings yourself rather than using a link sent by someone requesting your information.

Why one strong password is not enough

If you reuse a password and it is exposed at one service, other accounts may face attempts using the same credentials. Length does not solve reuse.

CISA's online-security guidance recommends long, random, unique passwords and a password manager to help maintain them.

Consider email first if it receives recovery links for other accounts. Review where you reused its password. The aim is to prevent exposure at one service from exposing the same means of access everywhere.

How a password manager helps

A manager can generate and save different passwords instead of relying on a predictable pattern modified with each website's name. It manages login secrets; it is not a list to publish or send to support.

Protect the manager itself and understand its recovery instructions. Do not store its backup or unlocking information in a public conversation or broadly shared folder. Choose storage you can access when needed and understand who else can access it.

What additional verification provides

CISA's multifactor-authentication guidance describes an additional identity check when signing in. This might involve an authenticator-generated code or another supported method.

Open the account's security or two-step-verification settings, choose a supported method you can use, and read the recovery instructions before completing setup. Names and options vary. Do not assume that every service supports a particular feature.

Additional verification does not justify sharing codes or approving a login request you did not initiate. Reject an unexpected request and review activity through the known account interface.

Prepare before losing your phone

Imagine losing the phone holding your authenticator. A recovery copy stored only on that same device may be unavailable when needed.

Google Account Help explains that backup codes can help when the phone is unavailable and should be stored safely. This is an example of one service's recovery options, not a description of every account.

Check each service for backup codes, an additional security key or another recovery method. Store what is provided safely and separately from your only sign-in device. Do not give recovery codes to someone claiming to need them to “activate protection.”

Before changing your number or device

Review important accounts before relinquishing the old number or device. Update sign-in and recovery details according to each service's instructions, and verify access through the new method.

Do not assume that copying photos or contacts transferred your authentication settings. Check the authenticator's own transfer instructions.

Related reading

• Fake support messages
• Unknown apps and permissions
• Poker terminology and digital safety

FAQ

Should I change every password each week?

That is not the goal here. Prioritize unique passwords, protected access and action after suspected exposure or unfamiliar activity. Follow applicable service requirements.

Is adding a digit to an old password enough?

Do not treat a small predictable variation as an independent password. Generate a different one.

Should I send a recovery code to support?

Do not hand it to someone in a conversation. Use the official recovery process you reach independently.

Does two-step verification prevent every compromise?

No. Device security and caution about phishing and fake login requests still matter.