Every time you shop, bank, post or sign up for a newsletter, you leave a little bit of personal information behind. Most of the time, that’s harmless. But when passwords leak or a scam email gets through, that same information can be used to break into your accounts or open new ones in your name.
The good news is that you don’t need to be a tech expert to protect your personal data online. A handful of simple habits blocks most everyday threats. This beginner’s guide walks you through the most important steps, in the order that gives you the biggest benefit for the least effort.
Start With Strong, Unique Passwords
Reusing one password across many sites is one of the most common risks. If a single site is breached, criminals can try that same email and password everywhere else.
The fix is simple: use a different strong password for every important account. A strong password is long, ideally a phrase of several random words, and isn’t based on personal details like birthdays or pet names.
Remembering dozens of passwords isn’t realistic, so use a password manager. It creates and stores strong passwords for you, and you only need to remember one master password. CISA’s Secure Our World campaign recommends strong passwords and a password manager as easy ways to protect your accounts.
Treat security questions like passwords, too. Answers such as your mother’s maiden name or first school can often be found online. Consider giving a made-up answer and storing it in your password manager.
Turn On Multifactor Authentication
Multifactor authentication, often called MFA or two-step verification, adds a second check when you log in, such as a code from an app, a text message or a fingerprint. Even if someone steals your password, they still can’t get in without that second factor.
Turn on MFA first for the accounts that matter most:
- Your primary email, since it’s used to reset every other password
- Banking, credit card and payment apps
- Cloud storage that holds photos and documents
- Social media accounts
- Online shopping accounts with saved cards
Look for the option under “Security” or “Login” in each account’s settings. An authenticator app is generally more secure than text message codes, but any MFA is far better than none.
When you turn on MFA, many services offer a set of backup codes. Save them somewhere safe, such as your password manager or a printed copy at home, so you can still get in if you lose your phone.
Keep Your Devices Updated
Software updates do more than add new features. They also fix security holes that attackers look for. Turn on automatic updates for your phone, computer, browser and apps so you don’t have to remember to do it.
Lock every device with a PIN, password or fingerprint, too. If your phone is lost or stolen, a screen lock keeps your messages, email and banking apps out of reach. It’s also smart to back up your phone and computer regularly, so a lost device or a ransomware attack doesn’t mean losing your photos and files. Smart speakers, cameras and other connected gadgets need the same care, as we explain in our beginner’s guide to smart home devices.
Learn to Spot Phishing
Phishing messages try to trick you into clicking a harmful link, opening an attachment or sharing information. They often look like they come from a bank, delivery company or familiar service.
Watch for these warning signs:
- Urgent language, like “Your account will be closed today”
- Requests for passwords, codes or payment details
- Sender addresses or links that don’t quite match the real company
- Unexpected attachments or prizes you didn’t enter to win
When in doubt, don’t click. Go directly to the company’s website or app, or call a number you already trust, to check whether the message is real.
Share Less to Protect Your Personal Data Online
The less personal information you share, the less there is to misuse. Take 15 minutes to review the privacy settings on your social media accounts and limit who can see your posts, birthday, phone number and location.
A few other habits help to protect your personal data online:
- Remove apps you no longer use, and check what permissions the rest have.
- Avoid entering sensitive information on public Wi-Fi unless you’re using a trusted, secure connection.
- Give only required details when signing up for new services.
- Check your bank and credit card statements regularly for charges you don’t recognize.
If you think your identity has been stolen, IdentityTheft.gov, run by the Federal Trade Commission, lets you report it and get a personalized recovery plan. For serious financial or legal problems, contact your bank and consider speaking with a qualified professional.
Your 30-Minute Privacy Checkup
You don’t need to do everything today. Set aside 30 minutes this week to turn on MFA for your email, install updates and change any password you’ve reused. Then add one new habit each week. A faster, healthier computer helps, too, and our guide on how to speed up a slow laptop covers that.
Here at PKwys.com, we explain everyday technology in plain language. Explore more guides in our technology section.
