Security Brief #007 — Your Online Accounts: Five Simple Ways to Keep Them Safer

Think about the accounts you use every day: your work email and Microsoft 365, a Google account, banking, Facebook and LinkedIn, and the other online services your business relies on. Each one is a door into your information. Often, a criminal does not need clever hacking. A stolen, reused or guessed password is enough.

The good news is that a few simple habits make your accounts much harder to get into, and easier to get back if something goes wrong.

1. Give every account its own password

Using the same password in more than one place is risky. If one website is breached, criminals try that password on your other accounts.

Give each important account its own strong password. A good way is to join three or more random words. You do not need to remember them all: a password manager can create and store them safely for you. Protect the password manager itself with a strong password and an extra sign-in check.

2. Add a second check when you sign in

Turn on two-step sign-in, sometimes called multi-factor authentication or MFA, wherever it is offered. After your password, you confirm it is you with your phone, an app or a security key. A criminal who knows your password will usually still be stopped.

Start with your email, because it can be used to reset many other passwords. Then add banking, social media such as Facebook and LinkedIn, and any account that holds business information. Microsoft 365, Google, Facebook and LinkedIn all offer a second sign-in check. For work accounts, your IT team usually sets this up for you.

Some services now offer passkeys. Instead of typing a password, you sign in with your fingerprint, face or device PIN. Sign-in methods offer different protection: passkeys provide stronger protection against fake sign-in pages than passwords and one-time codes. They are not available everywhere yet, and work accounts may follow your organisation’s settings, so check with your IT team before changing how you sign in to work.

3. Be wary of unexpected requests

Never approve a sign-in request you did not start, and never share a sign-in code with anyone who asks for it, even if they say they are from your bank, a supplier or IT support. Our earlier brief on unexpected sign-in approval prompts explains why.

4. Keep your recovery details up to date

Recovery details are how you get back in if you forget a password or lose your phone. Check that each important account has a current backup phone number or email address, and that you still have access to them. If a service gives you backup or recovery codes, store them somewhere safe and separate from your phone.

Before handing in your old phone, set up and test your sign-in methods on the new one. Ask your IT team for help with work accounts.

5. Check who has access, and report anything odd

Most services let you see recent sign-ins and the devices linked to your account. Have a look now and then. If you see a sign-in, device or change you do not recognise, change your password and report it straight away. For work accounts, contact your IT team rather than trying to fix it yourself.

A note for owners and managers

Business accounts should belong to the business, not to one person. Know who has access to what, keep recovery details under business control, and remove access promptly when someone leaves. When changing sign-in methods for someone who still needs access, test the replacement before removing the old method. This must not delay removing a departing employee’s access.