Support

Checklists

Make your accounts safer

Build a manageable routine for passwords, extra sign-in protection, and account recovery.

4 min read · Published

Start with one important account, such as your email. Email often helps you reset passwords elsewhere, so protecting it matters. You do not have to fix every setting at once; work through these steps at a comfortable pace.

Key warning signs

  • A sign-in alert describes activity you do not recognize.
  • You receive a code or approval request for a sign-in you did not start.
  • Your recovery email or phone number changes without your permission.
  • People receive messages from your account that you did not send.

What to do

  1. Use a different password for each account

    Choose long passwords that are hard to guess. A password manager can create and remember them for you; protect the manager with a strong password and its available extra sign-in protection.

  2. Add a second sign-in step

    Turn on multifactor authentication, sometimes called two-step verification. It adds a check beyond your password. Follow the service’s instructions; an authenticator app or security key can provide stronger protection than a text-message code.

  3. Keep a way back in

    Check that your recovery email and phone number are current. Store backup codes in a safe place separate from the device you normally use. Do not share them.

  4. Keep devices current

    Install software updates and use a screen lock. Review account activity through the genuine app or website, rather than a link in an unexpected alert.

What not to do

  • Do not reuse an email password on other sites.
  • Do not approve unexpected sign-in prompts or give a caller your one-time code.
  • Do not let someone providing informal help keep a copy of your passwords or recovery codes.

When to get help

If you cannot sign in or see activity you do not recognize, use the service’s official account-recovery process. From a device you trust, change the password, review recovery details, and sign out unfamiliar sessions where the service allows it. A trusted helper can guide you while you keep control of private information.

For U.S. scam reporting, visit ReportFraud.ftc.gov. For a personal identity-theft recovery plan, use IdentityTheft.gov. Outside the U.S., contact your local consumer-protection agency.

Try it together

Your phone asks you to approve a sign-in, but you have not tried to log in. Should you approve it to make the alert go away?

A safer next step

No. Deny the request, then open the service directly to review your account. Repeated unexpected prompts are a reason to check your password and security settings.

Sources & further reading

These public guidance sources informed this resource. Their inclusion does not imply endorsement of the Foundation.

ZoraSafe Foundation · https://www.zorasafefoundation.org/education/account-safety