each one closes a door that thieves are using this month. If you only do one section, do this one.

• 1.1 Lock your phone number with your carrier (section 3). This stops someone from moving your number to their phone and receiving your bank codes.
• 1.2 Add a passkey to your main email (section 2). A passkey is a sign-in that uses your face or fingerprint instead of a password. Your email can reset every other account you own, so protect it first.
• 1.3 Turn on bank alerts for every purchase, transfer and sign-in (section 4). You find out in seconds instead of at the end of the month.
• 1.4 Freeze your credit at all three bureaus (section 4). It is free, and it blocks anyone from opening a new loan or card in your name.
• 1.5 Update your phone and computer, then restart them. Many attacks use holes that updates already fixed.

whoever controls your email can reset your bank, your phone account and everything else, so it gets the strongest protection you have.

• 2.1 Add a passkey. Gmail: go to myaccount.google.com/signinoptions/passkeys (or myaccount.google.com > Security & sign-in > Passkeys and security keys) and tap Create a passkey. Do this only on a phone or computer you own. Outlook or Hotmail: go to account.live.com/proofs/manage > Add a new way to sign in or verify > Face, Fingerprint, PIN, or Security Key. Apple (iCloud mail): your iPhone already created a passkey for your Apple Account. Instead, open Settings > your name > Sign-In & Security and confirm Two-Factor Authentication is on and your trusted phone number is current. Add an Account Recovery Contact (a trusted family member) while you are there.
• 2.2 Run Google's Security Checkup at myaccount.google.com/security-checkup. It lists weak spots on one page.
• 2.3 Check your recovery phone number and recovery email. Make sure both are ones you still own.
• 2.4 Sign out devices you don't recognize. Google: myaccount.google.com > Security & sign-in > Your devices > Manage all devices > tap the device > Sign out.
• 2.5 Use a password manager (1Password, Bitwarden, or the one built into your phone) so every account has a different password. Start with email, bank and phone carrier.
• 2.6 Check whether your email was in a data breach at haveibeenpwned.com. If it was, change the password on that site and anywhere you reused it. Click Notify Me for future alerts.
• 2.7 Know the ranking of sign-in codes. Best: a passkey or security key. Next: a prompt or code from an app on your phone. Last: a code sent by text message. You may see posts saying text codes are safer than apps. That is backwards. Still, a text code beats no second step at all.

the biggest phone risk is not a virus. It is someone talking your carrier into moving your number to their phone, then receiving your bank codes. Every major carrier has a free lock for this.

• 3.1 T-Mobile. SIM Protection: T-Life app > Manage > gear icon > Security > SIM Protection > turn on for every line > Save Changes. Port Out Protection: T-Life > Manage > See Plans > Manage add-ons > choose a line > check Port Out Protection > Continue > Agree & Submit (repeat for each line). Account PIN: T-Life > Account > gear icon > Security > T-Mobile ID > Account PIN/Passcode (6 to 15 digits, not a birthday or phone number).
• 3.2 Verizon. My Verizon app > Account > Edit Profile and Settings > Security > Number Lock > turn on for every number > Save. In the same Security menu, turn on SIM Protection. (Store staff cannot turn these off for you; only you can, in the app.)
• 3.3 AT&T. AT&T app > tap the person icon at the top > Wireless account lock > swipe to lock. This one switch blocks number transfers, SIM and eSIM swaps and account changes. Also know your 4-digit AT&T account passcode and never read it to a caller. (AT&T's Number Transfer PIN is created only when you move your number and expires in 4 days, so there is nothing to set in advance.)
• 3.4 Google Fi or another carrier. Fi: on a computer, go to fi.google.com/account > Phone settings > Privacy & security > Number lock. Any other carrier: call and ask for a "port-out lock" and a "SIM change lock."
• 3.5 When you get a new phone, turn the lock off, move your number, then turn it back on the same day.
• 3.6 iPhone: Settings > Face ID & Passcode (or Touch ID & Passcode) > Stolen Device Protection > on. This stops a thief who watched you type your passcode from changing your Apple Account or passwords. Choose "Always" under Require Security Delay if you want it to work at home too.
• 3.7 Android: Settings > Google > All services > Theft protection. Turn on Theft Detection Lock, Offline Device Lock and Remote Lock. Some options need a newer phone and will be grayed out if yours cannot use them.
• 3.8 Use a passcode of 6 digits or more, not a birthday or 123456. Cover it when you type it in public.
• 3.9 Turn on automatic updates. Then check the date of your last security update in Settings. If it is more than about a year old, stop using that phone for banking and email. (Age alone is not the test: a 2019 iPhone 11 still gets updates; some newer budget Android phones do not.)
• 3.10 Delete apps you don't use. Install apps only from the App Store or Google Play.
• 3.11 Review permissions. iPhone: Settings > Privacy & Security. Android: Settings > Security & privacy > Privacy > Permission manager. Remove camera, microphone and location access from apps that do not need it.

the law protects you from charges you did not make if you report them fast, but money you were tricked into sending yourself is often gone for good. So the goals are to see problems the minute they happen and never hand anyone the keys.

• 4.1 Turn on alerts in your bank app for every purchase, transfer, sign-in, and any change to your phone number, email or address.
• 4.2 Use the strongest sign-in your bank offers: a passkey or an approval in the bank's app rather than a text code.
• 4.3 Freeze your credit at equifax.com, experian.com and transunion.com. It is free and takes about 15 minutes each, because you create an account at each one. When you apply for credit, log in and lift the freeze for a day or two. For children under 16, each bureau requires a mailed form with copies of the birth certificate and your ID.
• 4.4 Never give a code to anyone who calls or texts you, even if they say they are your bank. Your bank will never ask for the code it just sent you.
• 4.5 Never give your bank username and password to another app or AI assistant. This month JPMorgan, Bank of America, Citi and Morgan Stanley began blocking outside AI agents that sign in with a customer's password, and bank leaders say the risk shifts to you if you share it. If a budgeting app offers a connection approved by your bank that is read-only, that is the safer route.
• 4.6 Lock cards you are not using in the bank app. Use virtual card numbers for online shopping if your bank offers them.
• 4.7 Know the clock. Report a lost card or stolen PIN within 2 business days and any charge you did not make within 60 days of the statement. Later reports get less protection.
• 4.8 Write your bank's fraud phone number on paper. It is on the back of your card.

almost every scam has the same shape. Someone pretends to be a company or agency you know, claims a problem or a prize, pressures you to act right now, and insists on one payment method. Slow down and the scam falls apart.

• 5.1 Hang up and call back using the number on your card, your bill or the company's real website. Never use a number from the text, the email or caller ID. Caller ID can be faked.
• 5.2 Never read a code out loud, install a "support" program, or let anyone connect to your computer because someone contacted you first.
• 5.3 Don't tap links in texts about packages, unpaid tolls, refunds or account problems. Delete them. If you think you owe something, type the real website yourself.
• 5.4 Be careful with QR codes on parking meters, flyers and unexpected mail. Look at the web address your phone shows before you open it, and never pay through one you did not expect.
• 5.5 Set a family code word that only your family knows. AI can copy a voice from a short clip, so a panicked call from "your grandson" asking for money gets the code word question first.
• 5.6 Know the three-call scam. A "tech support" call that leads to a "bank fraud department" call that leads to a "government" call telling you to move money to a safe account is one scam with three actors. No bank or agency will ever ask you to move money to protect it.
• 5.7 Nobody legitimate asks for gift cards, crypto, a wire transfer or Zelle. That request alone means scam.
• 5.8 For private conversations, use Signal (works on both iPhone and Android), WhatsApp, or iMessage between iPhones. Those are end-to-end encrypted, meaning only you and the other person can read them. Plain text messages are not. Texts between an iPhone and an Android phone are encrypted only when the chat shows "Encrypted" or a lock icon.
• 5.9 Turn on your phone's filters. iPhone: Settings > Apps > Phone > Silence Unknown Callers, and Settings > Apps > Messages > turn on unknown-sender filtering. Android: Phone app > Settings > Caller ID & spam, and Google Messages > Settings > Spam protection.
• 5.10 Protect paper too. Hand checks to the mail carrier or drop them inside the post office; never leave outgoing mail in your box overnight.

over the years you have tapped "Sign in with Google" or "Allow access" dozens of times. Each one is a door that stays open until you close it.

• 6.1 Google: go to myaccount.google.com/linkedapps. Under "Access to your Google Account," open each app you don't use, tap See details, then Remove access.
• 6.2 Apple: Settings > your name > Sign in with Apple. Remove apps you no longer use. (On a computer: account.apple.com > Sign-In & Security > Sign in with Apple.)
• 6.3 Facebook and Instagram: Facebook: Settings & privacy > Settings > Apps and websites. Instagram: Settings > Website permissions > Apps and websites. Remove old ones.
• 6.4 Clean first, then sign out everywhere. Some malware copies the saved sign-ins (cookies) from your browser, which lets a thief skip your password and code. The fix is in this order: 1) update and scan the computer, or use a different, clean device; 2) sign out of all sessions on your email and social accounts; 3) change the password; 4) in Gmail, check Settings > Forwarding and Filters for rules you did not create.
• 6.5 Browser extensions: remove any you do not use every week. Each one can read every page you visit. In Chrome, also turn on Settings > Privacy and security > Security > Enhanced protection.
• 6.6 Shared and family access: check who is on your streaming, cloud photos, location sharing and bank accounts. Remove ex-partners, old roommates and old devices.
• 6.7 If you use AI assistants: don't connect them to your bank, and review which email and files you have connected in their settings.

your router is the front door for every device in the house. Most of these settings are in your internet provider's app or the router's web page.

• 7.1 Change the router's admin password from the one printed on the sticker. Make it long (16 or more characters) and store it in your password manager.
• 7.2 Use a strong Wi-Fi password and WPA3 (or WPA2-AES) security. WPA3 is the newest Wi-Fi password standard. If the router only offers WEP or plain WPA, replace it.
• 7.3 Turn on automatic updates for the router. If it has had no update in the past year, or cannot do WPA2 or WPA3, replace it. Gateways rented from your provider usually update themselves.
• 7.4 Make a guest network and put smart TVs, cameras, speakers, doorbells and visitors on it. If one of those is compromised, it cannot reach your laptop or phone.
• 7.5 Turn off WPS, remote management and UPnP if your router has them. WPS is the push-button pairing feature; UPnP lets devices open doors in the router on their own.
• 7.6 Optional: set your router's DNS to Quad9 (9.9.9.9 and 149.112.112.112). DNS is the phone book your network uses to find websites; Quad9 is free and refuses to look up known scam and malware sites for every device at once. It does not block ads.

speed matters most. Reporting the same day gives you the best chance; waiting days usually means the money is gone.

• 8.1 Money moved or a card charged: call the fraud number on the back of your card right away. Ask them to freeze the account and recall any transfers. If you sent money yourself through Zelle, a wire or a gift card, still call immediately and ask for a reversal.
• 8.2 Phone suddenly shows "No Service" or "SOS only" while others have signal: call your carrier from another phone. That can be a number transfer in progress. (Verizon: *611 or 1-800-922-0204.)
• 8.3 Email or social account taken over: use the official recovery page (accounts.google.com/signin/recovery, iforgot.apple.com, account.live.com/acsr). Then follow step 6.4 in order.
• 8.4 Change passwords from a clean device, starting with email, then bank, then everything else. If you think your computer has malware, use your phone or a different computer.
• 8.5 Report it: ic3.gov (FBI) for any online fraud, ReportFraud.ftc.gov for scams, and IdentityTheft.gov if someone used your identity (it builds you a recovery plan). If a federal site is offline, file a police report and tell your bank; you can file the federal report later. Keep screenshots, dates and amounts.
• 8.6 Expect follow-up scams. The FBI never calls you about a report, and anyone offering to recover your money for a fee is a second scammer.

if your phone is lost or the internet is down, paper still works. Keep one sealed envelope in a safe place and tell one trusted person where it is. See the template below.

• 9.1 Bank, credit card and carrier fraud phone numbers.
• 9.2 Backup codes for your email. Google: myaccount.google.com > Security & sign-in > 2-Step Verification > Backup codes (10 single-use codes). Also your password manager's emergency kit.
• 9.3 Where your credit bureau logins live (for example "in the password manager under Equifax"), not the passwords themselves.
• 9.4 Family phone numbers, a meeting place, and the family code word.
• 9.5 Copies of IDs, insurance cards and prescription lists.
• 9.6 A little cash in small bills for a few days of essentials.
• 9.7 Review the envelope once a year, and any time you change phones, carriers or banks.

One printed page, both sides if needed, large type. Fill it in by hand, seal it, and keep one copy at home and one with a trusted person.

• Date prepared / review by (Today's date and one year from now)
• Bank 1, Bank 2, Credit union (Name, fraud phone number (from back of card), last 4 digits of the account only, what the account is for) Never write: Full account number, PIN, online password
• Credit cards (Issuer, fraud number, last 4 digits) Never write: Full card number, expiration, security code
• Phone carrier (Carrier name, customer service and fraud number, account holder name, "Account PIN is kept: ___ (location, e.g. sealed inner envelope)") Never write: The carrier PIN in the open
• Credit bureaus (Equifax 888-298-0045, Experian 888-397-3742, TransUnion 800-916-8800, plus "logins are in: ___ (password manager name)") Never write: Bureau passwords
• Email provider(s) (Which email is the "master" email; recovery page address (accounts.google.com/signin/recovery, iforgot.apple.com, account.live.com/acsr)) Never write: The email password
• Backup codes ("Google backup codes are in: ___ (location)" or tape the printed codes inside the sealed inner envelope) Never write: Codes written on the outside of anything
• Password manager (Which one, and where the emergency kit or recovery code is stored) Never write: The master password
• Reporting (ic3.gov, ReportFraud.ftc.gov, IdentityTheft.gov, local police non-emergency number)
• Family contacts (Name, cell, a second number, and one out-of-town contact who relays messages if local lines are down)
• Family code word (The word, plus the rule: "no money moves without the code word, even if the voice sounds right")
• Meeting place (Primary (near home) and secondary (outside the neighborhood))
• Trusted person (Who knows where this envelope is, and who holds the second copy)
• Medical (Doctor and pharmacy numbers, allergies, prescription names and doses, insurance member numbers (these can go in the inner envelope))
• Accounts to notify (Short list of accounts tied to the master email (bank, carrier, cloud photos, social) so nothing is forgotten after a takeover)
• Devices (Phone make and model, carrier, and where the Find My or Find Hub login lives)

• Put the sheet in a sealed envelope and sign across the seal. Keep one at home in a place a visitor would not find (not the kitchen drawer) and a second copy with the trusted person or in a safe deposit box.
• Anything secret (carrier PIN, backup codes, insurance numbers) goes in a smaller sealed inner envelope inside the main one, so the outer page can be used without exposing them.
• Never write full passwords, full card or account numbers, Social Security numbers, or the password manager master password on paper. Write where they live instead.
• Do not photograph the sheet with your phone; a copy in your photo library defeats the purpose.
• Replace the sheet when you change a phone, carrier, bank or email. Shred the old one.