Category: Account Security

Phishing is one of the most common ways accounts get taken over. Scammers send messages pretending to be banks, delivery companies, employers, government agencies, tech support or even friends, aiming to trick you into revealing passwords, codes or payment details, or into installing malware. Messages can be convincing, and new tools make them more polished than ever.

This guide covers the red flags to watch for and what to do when you are unsure.

Common Phishing Channels

• Email: Fake account alerts, invoices, shipping notices
• Text messages: Package delivery problems, toll bills, bank alerts
• Phone calls: Fake bank fraud departments, tech support, government agencies
• Social media and messaging apps: Fake friends, giveaways, job offers
• QR codes: Codes on fliers, parking meters or emails leading to fake sites

Red Flags

Urgency and Fear

Messages that say your account will be closed, a payment failed, you owe a fine or you must act immediately are designed to rush you.

Unexpected Requests

Be wary of messages you did not expect, especially asking you to log in, confirm details or pay.

Requests for Codes

Never share a two-factor code with anyone who contacts you. Legitimate companies generally will not call asking for it. See two-factor authentication setup.

Unusual Payment Methods

Requests for gift cards, wire transfers, cryptocurrency or payment apps to strangers are strong scam signs.

Mismatched Senders and Links

The display name may say a well-known company while the actual address is unrelated. Links may point to lookalike domains with small misspellings or extra words. On a computer, hover over links to preview the destination.

Generic Greetings and Odd Details

Some phishing uses generic greetings, but modern scams can be personalized using data from breaches or data brokers. Personalization alone does not mean a message is legitimate. See the data broker removal guide.

Attachments

Unexpected attachments, especially those asking you to enable macros or open archive files, can carry malware.

How to Check Safely

1. Do not click links or call numbers in the suspicious message
2. Go to the company’s website by typing the address yourself or using your bookmark
3. Call the number on the back of your card or on an official statement
4. Check your account directly for any alerts
5. If a friend asks for money, contact them through a different channel

Your Password Manager as a Phishing Detector

Password managers typically autofill only on the site where credentials were saved. If your manager does not offer to fill, double-check the address. See the password manager guide.

If You Clicked or Shared Information

What happened	What to do
Entered a password	Change it immediately, and anywhere reused
Shared a 2FA code	Change password, review account activity, contact the company
Shared card details	Contact your card issuer
Sent money	Contact your bank or payment provider immediately
Downloaded a file	Run security scans and update your device
Shared personal data	Consider a credit freeze

Report phishing to the impersonated company and to the FTC. Many email services have a report phishing button.

Protecting Family Members

Older relatives and teens are frequent targets. Agree on a family rule: no one pays or shares codes based on an unexpected call or message without checking with someone else first. Some families use a code word for emergencies.

Common Mistakes

• Trusting caller ID
• Clicking links in urgent messages
• Sharing codes with someone claiming to be from your bank
• Feeling too embarrassed to report

A Note on AI-Generated Scams

Scammers increasingly use tools that write fluent messages and can imitate voices. Poor grammar is no longer a reliable sign of a scam. Focus instead on the request: urgency, secrecy, payment or codes. If a call sounds like a relative in trouble, hang up and call them back on a number you know, or use a family code word.

A Note on Fake Websites and Ads

Phishing sites sometimes appear in search ads or results, especially for customer service numbers, banking logins and package tracking. Use bookmarks for important sites, check the address carefully and be cautious with phone numbers found through searches.

Questions to Ask Before Acting

• Was I expecting this message?
• Is it asking for money, codes or login details?
• Is it pressuring me to act fast or keep it secret?
• Can I verify through a channel I already trust?

Final Habit Checklist

• Bookmarks for important accounts
• Password manager autofill used
• Two-factor authentication on
• Family code word agreed

A Note on Workplace Phishing

At work, phishing often impersonates executives, vendors or IT staff, asking for urgent payments, gift cards or password resets. Follow your employer’s verification procedures, report suspicious messages to IT and never bypass payment approval steps because someone claims urgency.

Starting Small

This week, bookmark the login pages for your bank, email and main shopping accounts, and use only those bookmarks to sign in. That single habit sidesteps many phishing links.

A Note on Reporting

Reporting phishing helps email providers and companies block similar messages for others.

A Note on Delivery Texts

Fake delivery and toll texts are common. Check tracking directly on the carrier’s site.

Frequently Asked Questions

How do I know if an email is phishing?

Look for urgency, unexpected requests, mismatched senders and suspicious links, and verify directly.

Can phishing texts be dangerous if I do not click?

Generally the risk comes from clicking, replying or calling. Delete and report.

Is caller ID reliable?

No. It can be spoofed.

What if I already entered my password?

Change it right away and enable two-factor authentication.

Do passkeys help against phishing?

Yes. See passkeys explained.

The Bottom Line

Slow down, verify through official channels, never share codes and use a password manager, two-factor authentication and passkeys to make phishing much less effective.

---

Editorial note: Lock and Login is independent and reader-supported. This guide is based on research into manufacturer documentation, published specifications and widely accepted best practices; we have not been paid to mention any product. If we add affiliate links in the future, they will be clearly disclosed per our Affiliate Disclosure.

Passkeys are a newer way to sign in that can replace passwords on supported websites and apps. Instead of typing a password, you confirm with your device’s fingerprint, face recognition, PIN or a security key. Major technology companies and many websites support them, and adoption continues to grow.

This guide explains how passkeys work, why they are considered more secure than passwords and how to start using them.

How Passkeys Work

Passkeys use public key cryptography. When you create a passkey for a site, your device generates a pair of keys:

• A private key that stays on your device or in your password manager
• A public key that the website stores

When you sign in, the site sends a challenge, your device signs it with the private key after you unlock with biometrics or a PIN and the site verifies the signature with the public key. Your private key is not sent to the website.

Why Passkeys Are More Secure

Phishing Resistance

A passkey is tied to the specific website it was created for. A lookalike phishing site cannot use it, because your device will not offer it there. This is a major advantage over passwords and many forms of two-factor codes.

Nothing to Steal from the Server

Since websites store only public keys, a breach of the site’s database does not expose anything attackers can use to log in as you.

No Reuse

Each passkey is unique to a site, so there is no reuse problem.

Syncing Across Devices

Many passkeys sync through your phone or computer’s ecosystem or a password manager, so a passkey created on your phone can be available on your laptop. Some passkeys, such as those on hardware security keys, are device-bound and do not sync.

Signing In on Another Device

Many systems let you sign in on a nearby computer by scanning a QR code with your phone, which then confirms the login using its passkey.

How to Set Up a Passkey

1. Sign in to an account that supports passkeys
2. Go to security settings
3. Choose to create a passkey
4. Confirm with your device’s biometric or PIN
5. Choose where to save it, such as your device ecosystem or password manager
6. Test signing in

Passkeys and Password Managers

Many password managers can store and sync passkeys across platforms. See the password manager guide.

Recovery Planning

If you lose a device, synced passkeys remain available on your other devices or in your password manager. Make sure the account that syncs your passkeys has strong protection and recovery options. Keep alternative sign-in methods or recovery codes for important accounts.

Limitations

• Not every site supports passkeys yet
• Moving passkeys between ecosystems can be harder than moving passwords, though export options are improving
• Some sites still keep a password as a fallback, which can still be phished
• Shared family devices can complicate who has access

Should You Switch?

For accounts that support them, passkeys are a strong option. Start with major accounts such as email, and keep backup methods in place. See two-factor authentication setup.

Common Mistakes

• Creating passkeys without understanding where they are stored
• Not protecting the sync account
• Removing all recovery options

A Note on Shared Devices

Passkeys tied to a shared tablet or computer may be usable by anyone who can unlock that device. If family members share a device, consider separate user profiles or keep passkeys for sensitive accounts on personal devices. Use a strong device PIN or password, since that unlock step protects your passkeys.

A Note on Hardware Security Keys

Hardware security keys can store passkeys that never leave the key. They are often used for high-value accounts, such as email administrators or business accounts. Register more than one key and store the backup safely, because a device-bound passkey cannot be recovered if the key is lost.

Comparison Table

Login method	Phishing resistance	Convenience	Reuse risk
Password only	Low	Moderate	High
Password and SMS code	Moderate	Moderate	High
Password and authenticator	Moderate	Moderate	High
Security key	High	Moderate	None
Passkey	High	High	None

Starting Small

Create a passkey for one account you use often, such as your main email, and see how signing in feels across your devices.

Questions to Ask Before Switching

• Where will my passkeys be stored?
• Can I reach them on every device I use, including work devices?
• What happens if I switch phone brands?
• Does this account still allow a password fallback, and is that password strong?
• What recovery options does this account offer?

A Note on Workplace Accounts

Employers may manage passkeys or security keys for work accounts through their own policies. Follow your IT team’s guidance and do not store work passkeys in personal accounts unless allowed.

Final Passkey Checklist

• Passkey created for main email
• Storage location understood
• Sync account protected
• Recovery codes saved
• Fallback password strong and unique

A Note on Terminology

You may see passkeys described with terms such as FIDO2 or WebAuthn. These are the underlying standards that make passkeys work across devices and websites.

Frequently Asked Questions

Do passkeys replace passwords completely?

On some sites they can; others keep passwords as a fallback.

Are passkeys safe if my phone is stolen?

The thief would still need to unlock the device. Use a strong device PIN.

Can I use passkeys on multiple devices?

Synced passkeys can be available across your devices.

Do websites see my fingerprint?

No. Biometrics stay on your device.

What if a site does not support passkeys?

Use a strong unique password and two-factor authentication.

The Bottom Line

Passkeys offer phishing-resistant, convenient sign-ins. Use them where supported, store them in a place you trust, protect your sync account and keep recovery options.

---

Editorial note: Lock and Login is independent and reader-supported. This guide is based on research into manufacturer documentation, published specifications and widely accepted best practices; we have not been paid to mention any product. If we add affiliate links in the future, they will be clearly disclosed per our Affiliate Disclosure.

Passwords alone are not enough. Even a strong password can be stolen in a breach or typed into a phishing site. Two-factor authentication, often called 2FA or multi-factor authentication, adds a second check, such as a code from your phone or a hardware key, so a stolen password by itself is not enough to get into your account.

This guide explains the main 2FA methods, how to set them up and how to avoid locking yourself out.

How Two-Factor Authentication Works

Authentication factors typically fall into three types:

• Something you know, such as a password
• Something you have, such as a phone or security key
• Something you are, such as a fingerprint

Two-factor authentication combines two different types. When you log in from a new device, you enter your password and then confirm with your second factor.

2FA Methods Compared

Method	How it works	Strengths	Weaknesses
Text message codes	Code sent by SMS	Easy, widely available	Vulnerable to SIM swapping and phishing
Email codes	Code sent by email	Easy	Only as secure as your email
Authenticator app	App generates time-based codes	Works offline, stronger than SMS	Can still be phished
Push prompts	Approve a login on your phone	Convenient	Risk of approving prompts you did not start
Hardware security key	Physical key you tap or insert	Strong phishing resistance	Costs money, must not be lost
Passkeys	Device-based cryptographic login	Phishing resistant, convenient	Support still growing

Any 2FA is generally better than none. If a site offers stronger options, use them for important accounts.

A Note on Text Message Codes

SMS codes are better than nothing, but criminals can sometimes take over a phone number through a SIM swap. Ask your mobile carrier about account PINs or port-out protections, and use app-based or hardware methods where available.

Which Accounts to Protect First

1. Your main email account, since it can reset other passwords
2. Your password manager. See the password manager guide.
3. Banking and financial accounts
4. Your mobile carrier account
5. Cloud storage and photo accounts
6. Social media accounts
7. Shopping accounts with saved cards

How to Set Up an Authenticator App

1. Install an authenticator app on your phone; some password managers include one
2. Log in to the account you want to protect
3. Go to security settings and find two-factor or two-step verification
4. Choose authenticator app
5. Scan the QR code shown
6. Enter the code the app displays to confirm
7. Save the backup codes the site provides

How to Set Up a Security Key

1. Check that the account supports security keys
2. In security settings, choose to add a security key
3. Insert or tap the key when prompted
4. Register a second backup key if possible
5. Store the backup key somewhere safe

Backup Codes and Recovery

Backup codes let you in if you lose your phone or key. Store them offline, such as printed in a secure place at home, or in your password manager. Without backups, losing your second factor can lock you out.

When you get a new phone, move your authenticator app accounts before wiping the old phone. Many apps have transfer or backup features; check how yours works.

Avoiding MFA Fatigue

Some attackers send repeated push prompts hoping you will approve one. Never approve a login you did not start. If you get unexpected prompts, change your password, since someone may know it.

Passkeys

Passkeys are a newer login method that can replace passwords on supported sites and offer strong phishing resistance. See passkeys explained.

Common Mistakes

• Turning on 2FA without saving backup codes
• Approving prompts you did not start
• Relying only on SMS for critical accounts when better options exist
• Forgetting to transfer authenticator accounts to a new phone
• Giving codes to anyone who calls or texts asking for them

A Note on Shared and Business Accounts

For accounts shared with family members, decide who holds the second factor and how others will get codes. Some password managers can store authenticator codes in shared entries. For small business accounts, avoid tying critical logins to one employee’s personal phone; use security keys or managed authenticators and document recovery steps.

A Note on Recovery Email and Phone

Many accounts let you add a recovery email address and phone number. Keep them current, and make sure the recovery email is itself protected with strong two-factor authentication. Attackers who control a recovery address can often reset the account.

Final Setup Checklist

• Email protected
• Password manager protected
• Financial accounts protected
• Backup codes stored safely
• Recovery options current

Starting Small

Set aside an hour to protect three accounts: email, password manager and your primary bank. Save backup codes for each before moving on. Add other accounts gradually as you log in to them over the following weeks.

A Note on Trusted Devices

Many sites let you mark a device as trusted so you are not asked for a second factor each time. Use this only on personal devices you control, never on shared or public computers.

Frequently Asked Questions

Is SMS 2FA better than nothing?

Yes, though stronger methods are preferable where available.

What if I lose my phone?

Use backup codes or a backup method to log in, then update your settings.

Should I use a hardware key?

They offer strong protection, especially for high-value accounts.

Will a company ever ask for my 2FA code?

Legitimate companies generally do not call asking for login codes. Treat such requests as a scam. See phishing red flags.

Can my password manager store 2FA codes?

Some can. Consider whether you want both factors in one place.

The Bottom Line

Turn on two-factor authentication for your most important accounts, prefer authenticator apps, security keys or passkeys, save backup codes and never share codes or approve unexpected prompts.

---

Editorial note: Lock and Login is independent and reader-supported. This guide is based on research into manufacturer documentation, published specifications and widely accepted best practices; we have not been paid to mention any product. If we add affiliate links in the future, they will be clearly disclosed per our Affiliate Disclosure.