Hard to Hack Checklist

01

Passwords and logins

The risks: Hacked websites leak passwords. If you reused one, criminals try it on your email and bank. Fake login pages steal the rest.

Basic

Get a password manager, and give every account its own passwordDo First1Password, Apple Passwords or Google Password Manager. It creates long, unique passwords and fills them in for you. Never reuse one.
Turn on two-step verification for your key accountsDo FirstEmail, bank, Apple or Google, medical portals and social media. Many turn it on for you, so check it's on and your backup phone number is current.
Use passkeys when a site offers themYou sign in with your face, fingerprint or phone. There's no password to steal or phish.
Check for leaked passwordsLook up your email at haveibeenpwned.com and change any password that shows up. Your password manager's security report flags these too.

Next Level

Use an authenticator app or security key instead of text codesText codes can be stolen in a SIM swap. Try Google Authenticator or the one built into 1Password.
Add security keys to your main accountThe strongest protection there is. Google calls it Advanced Protection; Apple supports security keys too.
Delete accounts you no longer useEvery old account is one more thing that can leak.
Sign out devices you don't recognizeCheck the device list in your Google, Apple and Meta security settings.

02

Email, your master key

The risks: Every "forgot password" link goes to your email. Whoever gets in can reset your bank, Apple and Amazon accounts, then quietly forward your mail to themselves.

Basic

Run the security checkup for each big accountDo FirstGoogle, Apple, Facebook and Instagram and Microsoft. Fix anything it flags.
Keep your recovery phone and email currentSo you, not a scammer, can get back in if you're locked out.
Review which apps can read your emailIncluding AI assistants. Remove anything you don't recognize or no longer use. Google: your third-party connections.

Next Level

Check for forwarding rules you didn't setIn your email settings, under Forwarding and Filters.
Use a separate email just for moneyBanks and payment apps only. Don't use it anywhere else.
Sign up for shopping and newsletters with email aliasesApple's Hide My Email or Firefox Relay.
Once a year, tidy up old "Sign in with Google" and "Sign in with Apple" loginsGoogle: the same connections page. iPhone: Settings, tap your name, then Sign in with Apple.

03

Phone and phone number

The risks: A scammer can talk your carrier into moving your number to their phone and receive your text codes. A stolen phone that's easy to unlock opens every app.

Basic

Lock your number with your carrierDo FirstIn your carrier's app: Verizon Number Lock and SIM Protection, T-Mobile Port Out Protection and SIM Protection, or AT&T Wireless Account Lock.
Use a six-digit passcode and turn on theft protectionNot four digits or a pattern. iPhone: Stolen Device Protection. Android: search Settings for "Theft protection."
Know how to find, lock or erase a lost phoneFind My for iPhone, Find Hub for Android. Act right away.
Only install apps from the App Store or Google PlayAnd delete the ones you don't use.

Next Level

Add a SIM PINSo a thief can't put your SIM card in another phone.
Give out a second number publiclyUse something like Google Voice for forms and stores, and keep your real number private.
Hide message previews and Control Center on your lock screenSo a thief can't read your codes or switch on airplane mode.
Turn on Lockdown Mode only if you're targetediPhone Lockdown Mode or Android Advanced Protection is for people facing spyware because of their job or public profile. Most families won't need it.

04

Updates and devices

The risks: Updates close holes attackers already know about, and attackers move fast once a flaw is public. An old device that no longer gets updates never gets those holes fixed.

Basic

Turn on automatic updates everywhereDo FirstPhone, computer, tablet and browser. Restart when asked: updates only finish after a restart.
Update the day a big fix makes the news, and only from SettingsNever from a pop-up, text or email offering a "security fix." Scammers ride the news.
Remove browser extensions you don't useTrusted extensions sometimes turn malicious after an update. Fewer is safer.
Back up your photos and filesiCloud, Google Photos or Drive, or OneDrive.

Next Level

Make sure disk encryption is onFileVault on Mac. Device Encryption or BitLocker on Windows.
Keep one backup on a drive you unplugRansomware can't reach what isn't connected.
Replace devices that no longer get security updatesCheck once a year, especially older phones, tablets and laptops.
Turn Bluetooth off when you're not using itOne less way in.

05

Home Wi-Fi and smart home

The risks: A router on its factory password or old software can be taken over, letting someone watch or redirect your household's traffic. Cheap gadgets are easy ways in.

Basic

Update your router and change its admin passwordMost routers now have an app (eero, Google, Orbi, Netgear) that does both. Turn on automatic updates.
Use a strong Wi-Fi password with WPA2 or WPA3Those are the modern kinds of Wi-Fi encryption. If yours says WEP or "open," anyone nearby can get on or listen in.
Unplug smart gadgets you don't useAnd turn on two-step verification for camera, doorbell and smart-home accounts.

Next Level

Put smart TVs and cameras on a guest networkSo a hacked gadget can't reach your laptops and phones.
Block scam sites for the whole houseTurn on your router's built-in security or safe browsing, or use the free Quad9 service.
Replace a router that no longer gets updatesCheck your router's app or the maker's website.
Use your phone's hotspot for banking on the goPublic Wi-Fi is safer than it used to be, but your own hotspot is safer still.

06

Money and identity

The risks: With your name, birthday and Social Security number (often already leaked), criminals can open accounts in your name or steal your tax refund, and you may not notice for months.

07

Scams, phishing and AI fakes

The risks: AI makes scams flawless: perfect emails, cloned voices, even live video of someone you know. Leaked data means scammers may know real details about you. Almost every scam creates panic, then rushes you.

Basic

Pause and verify anything urgentDo FirstHang up and call back on a number you already know, like the one on your card. A caller who knows your name or account details proves nothing.
Don't tap links in unexpected texts or emailsToll, package, bank alert and job texts are the most common scams. Open the app or type the address yourself. Forward scam texts to 7726.
Never share a code or let anyone remote into your computerApple, Google, Microsoft, Amazon, your bank, your carrier, the IRS and the police never ask, even after a phone is stolen.
Get support numbers only from the company's own app or websiteFake numbers show up in search ads and AI search answers.
Send unknown callers to voicemailUse call screening (iPhone and Pixel both have it), and ignore "wrong number" texts.
Check where a link really goes before you clickHover over it on a computer, or press and hold on a phone, and read the address. The real site is the part just before the first single slash: chase.com/login is Chase, but chase.com.verify-login.net/login is really verify-login.net. Not sure? Don't click.

Next Level

Keep your voicemail greeting genericWithout your own voice saying your name.
Let your password manager spot fake sitesIf it won't fill in your password, or a familiar site suddenly asks you to log in again or download something, leave.
Report scamsAt reportfraud.ftc.gov, and anything involving money at ic3.gov.

08

Privacy, AI and what you share

The risks: What you post helps scammers build a believable story. Public videos give them your voice to clone. And what you type into AI chatbots may be stored.

Basic

Think before you postSkip your home address, your kids' full names and schools, birthdays, and trips while you're away. Teach your kids the same.
Check your app permissionsLocation, microphone, camera, contacts and photos. Turn off anything an app doesn't need.
Keep secrets out of AI chatbotsNo passwords, codes, Social Security or account numbers, and go easy on details like your home address or your kids' schools.
Turn off training on your AI chatsIn each AI app you use, switch off the setting that lets your chats train the model. In ChatGPT: Settings, Data controls, "Improve the model for everyone."

Next Level

Review who can see your location and accountsiPhone: Safety Check shows everyone you share with. Google: Privacy Checkup.
Keep AI agents away from your bank and emailAI browsers and agents that act for you can be tricked by what they read on web pages. Give them only what they need, and watch what they do.
Remove your info from people-search sitesDo it yourself or with a service like DeleteMe or Optery. Google's Results about you removes it from search.
Limit public videos of your voiceAnd remove location from photos before you share them.

09

Kids and teens

The risks: Sextortion scams target teens, AI can turn an ordinary photo into a fake nude, and AI "friend" apps are built to keep kids hooked. A child's clean credit can be used for years before anyone notices.

Basic

Teach the red flags, and make "come to me" the ruleWatch for a new online friend who moves fast, wants to switch apps, or asks for photos (a photo or video doesn't prove who someone is). If anyone threatens or pressures them, they come to you, even if they sent something they regret. They won't be in trouble.
Know what to do if it happensDon't pay. Block the account but keep the messages. Report at CyberTipline.org or tips.fbi.gov. Take It Down helps remove images.
Talk about AI "friends"Common Sense Media advises no AI companion apps for anyone under 18.
Set up approvals and private accountsApprove downloads and purchases with Apple Family Sharing or Google Family Link, keep their social accounts private, and turn on two-step verification.

Next Level

Link ChatGPT parental controls if your teen uses itSet quiet hours, turn off memory and get alerts about serious safety concerns. How it works.
Share location only with familyAnd turn it off in social apps. On Snapchat, turn on Ghost Mode.
Skip AI talking toys for little kidsCommon Sense Media says avoid them for 5 and under, and be very cautious for 6 to 12.
Keep their Social Security number off formsUnless it's truly required.
Review game and social settings together each school yearPrivacy, who can message them, and spending limits.

10

Your family plan

The risks: When something happens, panic does the damage. A plan saves time, money and accounts, and older parents are favorite targets for "grandparent" and fake tech-support scams.

Basic

Pick a family safe wordDo FirstShare it with your kids and your parents, and use it to check any "it's me, I'm in trouble" call. The FBI recommends it.
Write down who to callYour bank's fraud line, your phone carrier, and identitytheft.gov.
Know the order if you're hackedFrom a safe device: change your email password first, then your bank, then the rest.
Help your parents do the BasicsStart with the items marked Do First.

Next Level

Keep a printed emergency sheetRecovery codes and key contacts, locked away.
Set up legacy and trusted contactsApple Legacy Contact, Google Inactive Account Manager, and a trusted contact at your bank.
Do a 15-minute family check-up every few monthsNew devices, new apps, new accounts.
Keep a few days of basics at homeSome cash, food, water and any medications you need. It's good preparedness anyway, and it covers you if bank apps, stores or pharmacies go down for a few days.

Hard to Hack.

Passwords and logins

Email, your master key

Phone and phone number

Updates and devices

Home Wi-Fi and smart home

Money and identity

Scams, phishing and AI fakes

Privacy, AI and what you share

Kids and teens

Your family plan

Stay a step ahead.

We can do it together in an hour.

Hard to Hack.

Who would you least like to see scammed?

Stay a step ahead.

We can do it together in an hour.