One weak point can open the rest. AI makes familiar attacks easier to research, personalize, and repeat. It does not magically break good encryption.
A password from an old site is tried against email or shopping accounts. AI adds little here; ordinary automation already does most of this.
Best defence: use a generated password for each account and protect email first.
AI can imitate writing or a familiar voice and tailor a story using public information. Caller ID, tone, and personal details are not proof.
Best defence: end the incoming contact and call back using a saved number or the number on your card.
An old phone number, recovery email, support process, or carrier account can bypass a strong sign-in. AI can help gather details and adapt a script.
Best defence: keep a tested recovery method for your most important accounts.
Malware or a stolen browser session can act as though the device is already signed in. Changing the password may not end that access.
Best defence: update devices, use a strong device passcode, and revoke sessions after suspected compromise.
AI can help skilled attackers inspect code and adapt known attacks against login, messaging, payment, or password systems.
Best defence: update software you control. If a provider reports a breach, use its official notice, review account changes, and distrust breach-related “support.”
Use a password manager to generate and save a different password for every account. Add stronger sign-in to the accounts that can unlock everything else.
Use your password manager to generate and autofill them. Use at least 20 random characters when the website allows it.
Use a different password for every account. Do not save passwords in email, messages, photos, spreadsheets, or ordinary notes.
For your password manager, use six randomly chosen words. Do not use a quotation, lyric, personal story, pet, address, or date.
Memorize it and keep one sealed paper copy in a protected physical location.
Use at least six nonpersonal digits; longer is better. Do not reuse a bank-card PIN or the same PIN across devices.
Face or fingerprint unlock is convenient, but the PIN is still the fallback key.
For ordinary accounts, save it in the password manager you already use across your devices. Confirm where the browser will save it. Your face, fingerprint, or PIN unlocks the passkey locally; the website does not receive your biometric.
For primary email, Apple, and your password manager where supported, select Security key when asked where to save the passkey. Keep printed recovery codes in a secure physical location.
Open the account’s official Security, Two-step verification, or Passkeys settings.
Add the first key, then add the spare separately. If prompted for a location, choose Security key.
Sign out and test each key. A spare that was never registered will not get you back in.
Carry the everyday key and store the spare elsewhere. Do not label either key with passwords or account details.
Turn off cloud sync: tap the cloud icon in the upper-right. The icon should be gray and crossed out.
Lock the app: open Menu → Settings → Privacy Screen.
Keep a way back in: print the recovery codes supplied by important accounts, label them, and store them securely offline. Do not keep the only copy inside the phone, email account, or password manager it is meant to recover.
Prepare while every account still works. During an incident, follow the order instead of improvising from a suspicious message.
Use a strong daily sign-in, keep printed recovery codes, and remove unknown sessions, forwarding rules, and connected apps.
Keep the recovery phone current, review trusted devices, and know which devices and passkeys depend on this account.
Use a unique six-word master password and keep sealed offline recovery instructions in a protected location.
Before anything goes wrong
Register both YubiKeys separately with each supported critical account.
Print fresh recovery codes. Label the service and date; many codes work only once.
Separate the backups. Do not keep phone, everyday key, spare key, and recovery paper together.
Verify normal sign-in with each key or authenticator. Do not consume the only recovery code merely to test it.
Plan for phone loss. Make sure access survives losing both the phone and primary email.
Prepare household access. Use provider emergency-access or legacy features, or sealed instructions—not a casually shared master password.
If an account or device may be compromised
Stop responding. Do not enter another password, code, or approval prompt.
Protect money immediately. Call the bank using the card, statement, or official app—not the message or a search advertisement.
Use a different trusted, updated device if the affected device opened a suspicious link or installed software.
Secure primary email first. Then replace any exposed or reused password with a generated one.
End persistent access. Sign out other sessions; remove unknown devices, passkeys, security keys, and app passwords.
Inspect recovery and email. Check phone, email, forwarding, filters, authorized apps, and connected services.
Call the carrier if service vanishes unexpectedly or a number transfer is suspected.
Preserve evidence. Keep suspicious messages and transaction details, but do not continue the conversation.
Remember: changing a password may not end an existing signed-in session. If untrusted software may have been installed, rebuild the device or obtain qualified in-person help before trusting it again.
Draw the sign-in and recovery routes across your important accounts. The result should show where one loss or compromise could spread.
Draw arrows directly on this map. Use the open space for routes, notes, and additional accounts.
Digital notes → Password manager → Cloud storage → Digital notes
Each service holds the next secret. Losing one may block recovery; compromising one may spread around the loop.
These are three examples. They live in different places and do not all depend on one phone or cloud account.
Circle a single point of failure. Put an X beside every loop. Star one route to separate or strengthen this week.
Do not write actual passwords, PINs, authentication codes, recovery codes, or private keys on this page. A completed map reveals how your accounts fit together. Store it securely, or destroy it after making the changes you identified.