Personal data security: protect your accounts and identity
Practical security setup for finance apps and email. Password managers, 2FA, phishing detection.
- Two-Factor Authentication (2FA)
- A login process requiring something you know (password) and something you have (phone, hardware key) before granting access.
- Example: After entering your password, the bank app sends a 6-digit code to your phone you must also enter.
- Password Manager
- Software that generates, stores, and auto-fills unique strong passwords for every site you use, behind a single master password.
- Example: 1Password, Bitwarden, and Dashlane are leading options as of 2026.
- Phishing
- A fraudulent attempt to obtain credentials by impersonating a trusted entity via email, text, or phone call.
- Example: An email claiming to be from your bank with a 'verify account' link to a near-identical fake site.
Most account compromise stems from three preventable mistakes: weak or reused passwords, no 2FA, and falling for a phishing message. Fixing all three takes about an hour and prevents the vast majority of personal financial cybercrime.
Use a password manager
Bitwarden (free, open source) and 1Password (paid, polished) are the standard picks. They generate 20+ character random passwords for every account so a breach at one site does not compromise others. Do not write passwords on paper or save them in your browser without a master password protecting them.
Enable 2FA on every financial account
Bank, broker, IRA, payroll, email tied to financial accounts. Prefer authenticator app (Google Authenticator, Authy, 1Password) over SMS where available — SMS can be SIM-swapped. Hardware keys (YubiKey) are the strongest option, supported by Coinbase, Vanguard, Fidelity, Google, and others.
Spot phishing in 5 seconds
Hover over (do not click) any link in a financial-looking email and check the URL. Real banks use their own domain; phishing uses look-alikes (citi-secure.com instead of citi.com). Generic greetings ("Dear Customer"), urgency ("account locked in 24 hours"), and unexpected attachments are all warning signs. When in doubt, never click — go directly to the site by typing the URL yourself.
Lock down your email account
If a thief compromises your email, they can reset every other account you own. Treat email as your most valuable account. Use a unique 20+ character password, hardware-key 2FA, and review all forwarding rules and connected apps yearly. Gmail, Outlook, and ProtonMail all support these.
Protect against SIM swapping
Add a port-out PIN with your mobile carrier (T-Mobile, Verizon, AT&T all support this — call and ask). Without it, a thief can social-engineer your phone number to their device and intercept SMS 2FA codes. SIM swapping has caused multi-million-dollar crypto thefts.
Public Wi-Fi rules
Treat all public Wi-Fi (cafes, hotels, airports) as compromised. Use a VPN (ProtonVPN, Mullvad) or your phone tether for any banking. Never log in to financial accounts on shared computers (libraries, hotel business centers).
Frequently asked questions
Are password managers really safe? What if they get hacked?
+
How often should I change passwords?
+
Is biometric login (FaceID, fingerprint) safer?
+
Plug in your own amounts with our free calculators.