All articles 7 min read

Passwords and Exposed Personal Information: Reducing Account Takeovers

This guide presents selected U.S. government consumer education from Federal Trade Commission. References to “we” or “us” in the source material refer to the issuing agency. Source dates and links appear below.

Creating Strong Passwords and Other Ways To Protect Your Accounts

You create and keep lots of personal information in your online accounts, so you want good protections in place. Here’s how to protect your accounts with strong passwords and other security methods.

Create a Strong Password

When you set up an online account, you’re usually asked to create a password. To protect your account from cyberattacks, create a strong password that’s hard to guess. How? Start by making your password long — aim for at least 12 characters.

Of course, a long password can be hard to remember. You may find it easier to use a passphrase — a series of words separated by spaces. But make sure that your passphrase consists of random words. Avoid using common phrases, song lyrics, or movie quotes that are easy for a hacking program to guess.

If the account doesn’t allow long passwords, mix uppercase and lowercase letters, numbers, and symbols to make your password strong.

Studies show that people aren’t very good at creating random, strong passwords, or remembering them. So, what to do? One option is to have your web or mobile browser create a password for you. Each browser has its own process. Here’s more info on how that works:

Another option is to use a third-party password manager to create a strong password — and remember it. To find a reputable password manager, read expert reviews. Make sure the password you’re using with the password manager is strong and secure.

A web browser, mobile browser, and password manager all can save your passwords for you.

Lock Down Your Email

It's critical to protect your email account with a strong password. That’s because password reset links often go to your email inbox. If a hacker takes over your email account, they can get password reset links for your other accounts. Then they can change the passwords and take over those accounts, too. If that happens, here’s how to recover a hacked account.

Use Two-Factor Authentication

A strong password is an important first step in protecting your account from hackers. But even strong passwords are vulnerable to cyberattacks. Using two-factor authentication means a hacker who steals your password can’t log in to your account without another authentication factor.

The most common type of multi-factor authentication is a verification passcode you get by text message or email. This one-time passcode is typically six digits or longer and it expires automatically. But this is the least secure type of two-factor authentication, so choose a more secure method like an authenticator app or a security key for more protection, if you have the option.

Pick Security Questions Only You Can Answer

When you create an account, you may have to give answers to a few security questions. Some sites may periodically ask you to answer these questions as a security measure to confirm your identity. You also may have to answer them if you need to reset your password.

Hackers could try to guess your answers to get into your account, so pick security questions only you can answer. Avoid questions with a limited number of responses that hackers can guess — like the color of your first car. And skip questions with answers that someone could find online or in public records — like your zip code, birthplace, or mother’s maiden name. If you can’t avoid those questions, treat them like a password and use random and long answers. Just be sure you can remember your answers. As with a password, make sure the question and answer are unique, not one that you use on other sites.

Image

Change Your Password If Someone Steals It

If a company or website tells you it lost your password in a data breach, change your password right away. Follow the advice above and create a new strong password. If you reused the same password, or a similar one, on other services, change it there, too.

If someone is using your personal information, report it and get help at IdentityTheft.gov.

Protect Your Personal Information From Hackers and Scammers

Your personal information is valuable. That’s why hackers and scammers try to steal it. Follow this advice to protect the personal information on your devices and in your online accounts.

Keep Your Software Up to Date

Criminals look for weak points to exploit before software companies can fix them. So, update the software programs on your computer, tablet, and mobile phone as soon as possible when a newer version comes out. Software updates often contain critical patches and protections against security threats.

Turn on automatic updates to automatically update your

  • security software
  • internet browser
  • operating system
  • mobile apps

Secure Your Home Wi-Fi Network

Your router is the access point between your devices and the internet. If malware gets onto any device connected to your home network, it can spread to other devices connected to the same network. Read How To Secure Your Home Wi-Fi Network to learn how to make your router and your network more secure.

Protect Your Online Accounts with Strong Passwords and Two-Factor Authentication

Your online accounts may contain a lot of your personal information. Protect them with a strong password that’s hard to guess and turn on two-factor authentication.

Passwords

When it comes to passwords, you have a few options:

  • create your own password
  • choose an automatically generated password
  • use a password manager

Create your own password. If you create your own password, make it long. Aim for at least 15 characters. Use a combination of uppercase and lowercase letters, numbers, and symbols.

Since a long password can be hard to remember, you may find it easier to use a passphrase. A passphrase is a series of words separated by spaces. If you use a passphrase

  • make sure it consists of random words
  • avoid using common phrases, song lyrics, or movie quotes that are easy for a hacking program to guess

Choose an automatically generated password. Studies show that people aren’t good at creating and remembering strong passwords. You can have your browser or device create a password for you. Here’s more info on how that works:

Use a password manager. A third-party password manager also can create a strong password. To find a reputable password manager, read expert reviews. Make sure the password for your password manager is strong. And protect it like you do your other passwords.

Strong passwords can be hard to remember. But your browser and device can save your password. So can your password manager. And they can auto-populate your password the next time you log in to a website or app.

Use Two-factor Authentication

Using a strong password is an important step in protecting your account from hackers. But even strong passwords are vulnerable to cyberattacks. Using two-factor authentication adds an extra layer of security to your account. A hacker who steals your password can’t log in to your account without the second authentication factor.

The most common type of two-factor authentication is a verification passcode you get by text message or email. This one-time passcode is typically six digits or longer and expires automatically.

The more secure types of two-factor authentication are an authenticator app or a security key. Choose one of these methods for more protection if you have the option.

Pick Security Questions Only You Can Answer

When you create an account, you may have to give answers to a few security questions. Some sites may periodically ask you to answer these questions as a security measure to confirm your identity. You also may have to answer them if you need to reset your password.

Hackers could try to guess your answers to get into your account, so pick security questions only you can answer.

  • Avoid questions with a limited number of responses that hackers can guess — like the color of your first car.
  • Avoid questions with answers that someone could find online or in public records — like your zip code, birthplace, or mother’s maiden name.

If you can’t avoid those questions, treat them like a password and use random and long answers. Make sure the question and answer are unique, not one that you use on other sites. And be sure you can remember your answers.

Protect Yourself from Attempts To Steal Your Information

It’s also important to know when someone is trying to trick you into giving them your personal information. Scammers send phishing emails or text messages to trick you into clicking on a link or opening an attachment that downloads malware. Don’t click on a link in an unexpected email or text. Instead, contact the company using a phone number or website you know is real.

Know What To Do if Something Goes Wrong

If you discover an issue, it’s important to act quickly. Find out what to do if someone hacked your email or social media account or if you think you may have installed malware.

If you think someone is using your personal information, go to IdentityTheft.gov to report it and get a personalized recovery plan.

Sources and publication details

The federal agency source text is U.S. government work in the public domain. Fynoptic selected, adapted, and formatted it for this guide. No agency endorsement is implied. Follow the linked sources for current program details and the rules applicable to your circumstances.

Back to all articles