An urgent email
An email says there has been suspicious activity on an account and you must confirm your details within the hour. It looks right.
What do you do?
Step 1: What Would You Do?
There is often more than one good answer. Pick one and see what happens.
A friend in trouble
A friend messages saying they are stuck and urgently need money transferred. It is their account and it does not quite sound like them.
What do you do?
Step 2: What That Was
The name for what you just worked out.
The commonest way accounts are lost is a password reused somewhere else that got breached. One password everywhere means one breach takes everything.
A manager, or a system
A password manager is the easy answer. Failing that, unique passphrases you can actually remember beat clever short ones you reuse.
The second factor
Two-factor authentication stops nearly every remote attack, because a stolen password alone is no longer enough. An app is better than SMS.
Recovery is the back door
An out-of-date recovery email or number is how people permanently lose accounts, and how attackers get in. Check it once a year.
Urgency is the tell
Almost every phishing message needs you to act immediately. Real organizations do not lock your account in the next ten minutes.
Step 3: Try It
These ones do have right answers.
Real, or Phishing?
Sort each message.
Which of these are worth suspecting?
Tap something to move it.
- Empty
- Empty
Step 4: Quick Check
Two questions, then you are done.
Question 1 of 1
You get a login code you did not ask for. What do you do?
Step 5: Your Life Mission
Something to do away from the screen. Nobody is checking.
Three checks this week
- Turn on two-factor authentication for your email first, then everything else.
- Check the recovery email and phone number on your main accounts.
- Change any password you have used in more than one place.
Why: Email first, because everything else can be reset through it. Securing it secures the rest.
Step 6: What You Learned
- Unique passwords, so one breach does not take everything.
- Two-factor authentication, preferably an app.
- Keep recovery details current.
- Urgency is the signal that something is a scam.
For the grown-up
Setting up a password manager together, once, does more than any amount of advice. It removes the reuse problem structurally rather than relying on discipline.
Recovery details are the most neglected item and cause the most permanent losses — an old email address on an account is how people lose things forever.
The "friend urgently asking for money" case is a compromised account, and it is worth agreeing a family practice: verify by voice on a known number before acting.