Practical steps for safer passwords, two-factor authentication and phishing awareness.
Use a different long password for every important account. A password manager can generate and store unique passwords so you do not need to remember them all. Never send passwords, recovery codes or one-time codes by email or chat.
Enable two-factor authentication. An authenticator application or security key is generally safer than relying only on text messages. Save recovery codes in a secure place separate from the device you normally use.
Check the sender and destination before opening links. Attackers may copy familiar designs or use nearly identical domain names. Go directly to the known website when a message asks you to sign in or pay. Review recent login activity and trusted devices, remove access you do not recognize, and change credentials immediately if you suspect compromise.