12 Steps to Keep from Getting Your Account Hacked

Steps you can take now to prevent issues later.

I don’t get this question a lot, but I really wish I did. What I get instead, repeatedly, is “I’ve been hacked, please recover my account/password for me!” (Which, for the record, I cannot do, no matter how often or how nicely, or not so nicely, I’m asked.)

The only salvation is prevention, and this applies to email, social media, and pretty much any online account you have.

What can you do to make sure your account doesn’t get hacked in the first place?

Preventing account hacks

To secure your account from hacking:

1. Select a good password.
2. Protect your password.
3. Set and protect your “secret answers”.
4. Set (and maintain!) an alternate email address(es).
5. Set (and maintain!) mobile or other telephone number(s).
6. Enable two-factor authentication.
7. Use other provider-specific techniques when available.
8. Use a different password on every site.
9. Use a password vault.
10. Be skeptical.
11. Remember that free services have little to no support.
12. Learn from your mistakes if it ever happens to you.

1: Select a good password

You’d be shocked at how easy many passwords are to guess. Your pet’s name, your pet’s name spelled backwards, your favorite TV character’s catchphrase, your boyfriend or girlfriend’s name (or “ilove” followed by that name), and so on.

If you think people can’t guess it, you are wrong. They can and will.

“iLoveMikey” is a bad password. “j77AB#qC@^5FT9Da” is a great password. You can see the problem, though: great passwords are hard to remember.

So compromise.

• Avoid single or pairs of full English words or names unless you make a longer passphrase of at least three and preferably four or more words.
• Include a mix of uppercase and lowercase letters and numbers.
• Make sure the password is at least 12 characters long, and ideally 16 or longer, if supported.

“Macintosh” is bad. “Mac7T0shB00k” (based on the easy-to-remember “Macintosh Book”) might be good. “HondaPrelude” is bad, but “SilbrPre7ood6” (based on “Silver Prelude 6”) might be ok.

Bottom line: pick a random-looking password YOU can remember but THEY would never guess… and assume that THEY are always really great guessers.

For more, see: What’s a Good Password?

2: Protect your password

A scenario I see much too often starts with “I thought I could trust my boyfriend/girlfriend/husband/wife/co-worker, so I gave them my password. Then we had an argument.”

How much damage can someone do if they’re angry with you and they have the password to your account? A lot.

It’s simple: Trust no one. I’m serious about this. Your friends are your friends until one day they’re not. Naturally, there are exceptions, but if there’s the least bit of doubt, don’t reveal your password. Especially if someone is pressuring you to do so.

For more, see: The Biggest Risk to Your Privacy.

3: Set and protect your “secret answers”

It’s fallen out of favor as not being particularly secure, but many systems still use a “secret question” and its answer as the key to account recovery or password reset. The problem is, many people choose secret answers nearly anyone can guess or easily find out.

However, there’s nothing that says your answer has to correspond to the question. Instead, pick an answer that is unrelated to the question. Perhaps your city of birth should be Crayola, Chardonnay, or WindowsExplorer. Treat secret answers like another password. Make it long, obscure, completely unrelated to the “question”, and impossible for someone else to guess.

As long as you can remember it when needed, it doesn’t matter what it is.

For more, see: How to Choose Good Security Questions.

4: Set (and maintain!) alternate email address(es)

Many services use one or more alternate email addresses to mail you a password recovery link if you forget yours. You must set this up before you need it.

First, make sure to configure that option using an email account on a different system. Create and use a Yahoo account for your Outlook.com alternate email, for example.

Second: don’t lose the alternate account. For many systems, if you can’t access that alternate email account, you cannot get your password back,  and you will not be able to recover your primary account. Remember to log into that alternate account every so often to keep it from being shut down for inactivity.

I’ve seen too many cases where people lose their alternate email address or let the account lapse and then find themselves totally out of luck when they really need it to recover their primary account.

For more, see: Please Set Up and Maintain Account Recovery Information.

5: Set (and maintain!) mobile or other telephone number(s)

This is very similar to an alternate email address, and can be used in place of one if you’ve configured it beforehand. Once again, you must set this up before you need it.1

If you can’t access your account, the service will text you a recovery code. If you don’t text or have a text-capable phone, some can call you with an automated voice recording of the recovery code. You then enter the code, proving you have access to the phone number that was previously configured as belonging to that account, and regain access.

Keep this number up to date! I regularly hear from people who’ve lost access to their accounts permanently because the phone number they originally configured is no longer theirs.

Also, keep in mind that this number must be able to reach you where you are, and may even be triggered as an additional security measure if you travel outside of your normal area. If that’s not possible, configure some other form of security, such as the alternate email mentioned above, or other techniques offered by your service provider.

For more, see: A One Step Way to Lose Your Account … Forever.

6: Enable two-factor authentication

Two-factor (or “multi-factor”) authentication is the current holy grail when it comes to account security. With two-factor properly enabled, hackers cannot get into your account even if they know the password.

The second factor that proves you are who you say you are is typically either:

• A mobile app that provides a random number on demand that you must provide when you log in
• A text message sent to a phone number you configure when you set up the account, which you then also enter at login

Once logged in, you can disable this requirement on machines you use frequently. Hackers are not able to provide the second factor, so they can’t get in.

For more, see: Two-Factor Authentication Keeps the Hackers Out.

7: Other provider-specific techniques

Some providers have additional recovery techniques. For example, you can create a recovery code for your Microsoft account that you save somewhere safe and use to recover your account.

Look for options like these or others within the services you use regularly.

And remember, you must set them up before you need them.

For more, see: Recover Your Microsoft Account Later by Setting Up a Recovery Code NOW.

8: Use a different password on every site

I’ve written about this extensively: it’s important to use different passwords on each of your important sites.

The reason is simple: if a hacker manages to discover your password on one account, they will go try your username and password, or email and password, on a multitude of other services. If you used the same password on another service they happen to try, that account will quickly be hacked as well.

Password managers like 1Password, RoboForm, and others are excellent ways to maintain multiple, complex passwords for multiple sites without needing to remember them yourself.

For more, see: Why Is It Important to Have Different Passwords on Different Accounts?

9: Use a password manager

I realize that “hard to guess” is at odds with “easy to remember” and both are at odds with not re-using passwords.

That’s where password managers (also called vaults or safes) come in.

If you forget your password, or you forget the answer to your secret question, or lose access to your alternate email account, or somehow lose the ability to use any of the password recovery mechanisms provided by the service, well, to put it bluntly, you are SOL: severely out of luck.

Don’t forget your own password. Don’t forget the answer to your own secret question(s). If you must write your information down, keep it in a secure place. A sticky note on your monitor under your mouse pad or other easy-to-get-to place is not secure. Your wallet might be secure. A locked cabinet or safe might be secure. A properly encrypted file on your computer might be secure.

But remembering this information securely is exactly what password managers are designed to do for you.

For more, see: Are Password Managers Safe?

10: Be skeptical

You should never be asked to email anyone your password.

EVER.

There are some very common phishing attempts that threaten you with account closure unless you respond to the email with information about your account (like your login name and password). Those emails are bogus. Mark them as spam and ignore them. Any email that requires you to respond with any information that includes your password is almost certainly a phishing scam.

Similarly, many phishing scams attempt to get you to click on a link to do something important relating to your account. Instead of taking you to the service, they take you to a fake page that looks like the service, but instead is a page designed to capture your username and password when you try to log in. If you have any doubt, don’t click the link in the email. Instead, go to the service in question yourself, using your web browser. If there’s something important, it’ll almost certainly be presented there.

For more, see: Phishing: How to Know It When You See It.

11: Remember that free services have little to no support

The vast majority of the account hacks I hear of — the hacks where people are ultimately unable to recover their accounts — involve free services with little to no support.

There may be a knowledge base or a peer-to-peer support forum, but there is rarely someone to email and almost never someone to call.

You are responsible for your own account security.

It’s often true, and certainly safest to assume, that no one will help you should something go wrong. That means it’s up to you to take the preventative measures I’ve outlined as well as keep your information up to date as things change.

For more, see: Are Free Email Services Worth It?

Podcast audio

Download (right-click, Save-As) (Duration: 9:50 — 13.6MB)

Subscribe: RSS

Related Video