Protect my money and accounts

Lock the front door: your email

Your email is the master key. Whoever controls it can reset the password on your bank, your shopping accounts and your social media, because "forgot password" sends the link there. So it gets protected first.

Open your email provider's security settings and turn on two-step verification. Google calls it 2-Step Verification, Microsoft calls it two-step verification, Apple calls it two-factor authentication. If you are offered a passkey, choose that; it cannot be phished. If not, an authenticator app beats a text message.

• Turn on two-step verification or a passkey for your email.
• Do the same for your bank and any account that holds a card.
• Write down the backup codes and keep them somewhere a burglar would not look and you would.

One password each

When a site you signed up to years ago is breached, the password is sold in a list and criminals try it on every bank, shop and email provider automatically. One leak, five logins. This is how most "hacked" accounts actually happen.

A password manager fixes it without you having to remember anything. Your phone already has one built in (Apple Passwords, Google Password Manager) and both are fine. For one that works across every device and the family, Bitwarden has a free tier and 1Password is good and paid.

• Install a password manager, or start using the one built into your phone.
• Change the passwords that matter first: email, bank, anything with a card.
• Let the manager replace the rest as you log in over the next few weeks.

See what has already leaked

Have I Been Pwned is a free site run by a security researcher that lists which breaches have included your email address, with the year and what was taken. It is safe to use.

• Check your main email address.
• For every breach that included a password, change that password if you still use it anywhere.
• Sign up for its free notifications so you hear about the next one.

Urgent, secret, pay: the three words every scam uses

Scams change their costume every week: parcel fees, tax rebates, "Mum, I've lost my phone", bank fraud teams, energy refunds. Underneath, nearly all of them have the same three parts. It is urgent. It must be kept secret or handled right now. It ends with you paying or handing over a code. One of those is normal. All three together is the scam, every time.

The rule that beats it: anything that asks for money or a code, you hang up and call back on the number on your bank card or the official website, never the number in the message. If a call claims to be your bank, hang up and dial 159, the free UK line that connects you to your bank's real fraud team.

When it goes wrong

Eventually something slips through, and what you do in the first hour matters most.

• Money gone or a card compromised: call your bank first, on the number on the card, or dial 159. Then report it to Action Fraud (or 101 in Scotland). Keep the messages.
• An account taken over: use the provider's recovery page from a device you trust, change the password, turn on two-step verification, and check the recovery email and phone number have not been changed.
• You clicked and typed a password: change it now, and anywhere you reused it. That is the whole fix for most phishing.