When people hear "my account was hacked", they picture a genius in a dark room. The reality is much more boring. Most accounts are taken over in one of two ways: a password that was reused and leaked somewhere else, or a fake login page that someone typed their password into. Both are easy to protect against. Grab a coffee (not too late — see why) and spend five minutes on these.
1. Start with your email
Your email is the master key to everything else. Anyone who controls it can press "forgot password" on all your other accounts. Give it the strongest protection you have: a password you use nowhere else, plus two-step verification (below).
2. One account, one password
Websites get breached all the time, and the leaked email-and-password lists are tried automatically on thousands of other sites. If you use the same password everywhere, one leak opens every door.
- Use a password manager. It creates and remembers a different strong password for every site, and you only need to remember one. Most phones and browsers have one built in, and dedicated apps exist too.
- Make the passwords you do remember long. The UK's National Cyber Security Centre recommends three random words, like teapot-glacier-violin. Length beats complexity, and it's easier to type.
3. Turn on two-step verification
Two-step verification (also called 2FA or MFA) means a stolen password isn't enough on its own. Whoever logs in also needs a code from your phone. Turn it on wherever it's offered, starting with email, banking and social media.
- An authenticator app or a passkey is better than codes by text message, but any second step is far better than none.
- Save the backup codes somewhere safe, so you don't lock yourself out if you lose your phone.
4. Learn the one phishing rule
Phishing messages pretend to be your bank, a delivery company, a streaming service or even a friend, and they're getting very convincing. You don't need to spot every trick. Follow one rule instead:
Never log in from a link someone sent you. If a message says there's a problem with your account, close it and open the app, or type the address yourself. If the problem is real, you'll see it there.
Also be suspicious of anything that's urgent ("your account will be closed today"), asks for codes, or asks for card details to receive money. No genuine company or friend will ever ask you for a login code.
5. Update, and tidy up
- Turn on automatic updates for your phone, computer and browser. Many updates fix security holes that are already being exploited.
- Check where you're logged in. Many services list your active sessions and devices. Log out of anything you don't recognise, such as an old phone or a shared computer.
- Delete accounts you no longer use. An abandoned account with an old password is an easy target. You can delete a LatePals account in one step on the account deletion page.
If something has already gone wrong
- Change the password of the affected account, and of your email, from a device you trust.
- Turn on two-step verification and log out all other sessions.
- Change the same password anywhere else you used it.
- If money or card details are involved, call your bank straight away. They can block cards and stop payments.
- Warn your friends, since hijacked accounts are often used to scam the owner's contacts.
If your LatePals account is affected, or someone is impersonating you, write to us using the address on the contact page.
