Accounts: passwords, password managers, two-factor authentication and SIM swaps

Start with e-mail

Almost every online account lets you reset a forgotten password by e-mail. That makes your e-mail account the master key: whoever controls it can reset the passwords of everything else. Secure it first, with the strongest password and the strongest second factor you have.

Passwords that hold up

Attackers rarely guess passwords one at a time. They use lists of passwords leaked from other websites and try them everywhere, which is why reusing a password is so dangerous. Two rules do most of the work:

• Long beats complicated. NIST Special Publication 800-63B, the US standard for authentication, favours length over forced mixtures of symbols, and advises against making people change passwords on a fixed schedule without a reason. The UK NCSC suggests combining three random words to make a password that is long but memorable.
• One password per account. If one site is breached, the damage stays there.

Password managers, as an idea

Nobody can remember dozens of long, unique passwords. A password manager is software that creates strong passwords and stores them in an encrypted vault, protected by one main password that only you know. Many operating systems and browsers include one, and separate products exist too. We do not recommend particular products, but the concept has three useful effects:

1. Every account gets its own long, random password.
2. You only have to remember one strong main password.
3. Most managers only fill in a password on the exact website it was saved for, which helps you notice phishing sites.

If you prefer not to use a password manager, the NCSC notes that writing passwords down and keeping the list somewhere safe at home is better than reusing the same password online. Protect the main password carefully and turn on two-factor authentication for the manager itself. A password manager is a good place for passwords, but most security guidance advises keeping recovery phrases offline and separate.

Two-factor authentication

Two-factor authentication (2FA) means that logging in needs something in addition to your password, so a stolen password alone is not enough. Not all second factors are equal:

Text-message codes

A code sent by SMS is much better than nothing, but it can be intercepted through a SIM swap (see below) and can be read out to a fraudster on the phone.

Authenticator apps

An app on your phone generates a new six-digit code every 30 seconds. The codes do not travel over the phone network, so a SIM swap does not expose them. They can still be typed into a phishing site, so check the address before entering one.

Passkeys and security keys

Passkeys and hardware security keys use cryptography tied to the real website's address. They simply do not work on a look-alike site, which makes them resistant to phishing. Where a service offers them, they are the strongest common option.

Whichever method you use, save the backup codes the service gives you and store them safely offline. Without them, a lost phone can lock you out.

SIM-swap fraud

In a SIM swap, a fraudster persuades or bribes staff at your mobile provider to move your phone number to a SIM card they control, often using personal details gathered from data leaks or social media. From that moment, your calls and text messages — including 2FA codes and password reset codes — go to them.

Warning signs include your phone suddenly losing mobile service for no clear reason, or messages from your provider about a SIM change you did not request. To reduce the risk:

• Ask your mobile provider about extra account protection, such as a PIN or password required for SIM changes and number transfers.
• Move important accounts from SMS codes to an authenticator app, a passkey or a security key.
• Avoid publishing your phone number and other personal details widely.
• If your phone loses service unexpectedly, contact your provider at once from another phone.

Signs an account may be compromised

• Alerts about logins or password changes that you did not make.
• Friends receiving messages from you that you never sent.
• New forwarding rules, filters or recovery details in your e-mail settings.
• Two-factor authentication switched off, or a new phone or key added to the account.
• Password reset e-mails you did not request, for several services at once.

Any of these is a reason to act straight away, from a device you trust.

This guide is general safety education. It is not financial, legal or security advice for your individual situation, and it does not recommend acquiring, holding or disposing of any crypto-asset. If you think you are dealing with fraud, contact your bank and the police.