Editorial illustration.
Originally published 16 June 2023; rewritten and reviewed on 15 October 2026.
An unexpected message asks for a quick sign-in, and the page looks familiar. The moment that matters is often the small pause before entering information. I would build security habits around such ordinary decisions rather than assuming an attack will look obviously suspicious.
Make verification routine
- Open important services through a known route. For an unexpected request, use the official app or an address you already trust instead of the supplied link.
- Verify unusual requests independently. A familiar name, profile picture or voice does not establish that a money or account request is genuine.
- Use unique credentials and suitable stronger sign-in methods. Where supported, evaluate passkeys or additional verification and keep recovery information protected.
A password manager can help maintain distinct passwords, but its own account and recovery route also deserve attention. Avoid a circular setup where the only recovery method depends on the account you have lost.
Maintain the devices and access you already have
- Apply supported updates. Include browsers, operating systems and applications, with an appropriate process for work-managed devices.
- Review installed tools and permissions. Remove software and extensions that no longer have a role, and investigate unexpected requests for additional access.
- Keep recoverable copies of important information. Verify that a backup can be opened and restored rather than relying only on a successful sync indicator.
- Report uncertainty early. Know the organisation’s reporting route and the official support channel for a personal account or payment provider.
Keep the promise realistic
These habits reduce common opportunities for error; they do not make a person immune to compromise. If an account may already be affected, use the provider’s documented recovery process and preserve useful evidence.
The most sustainable habit is a repeatable pause: identify the request, verify its source and understand the consequence before acting. It is easier to follow when the verification route has been prepared in advance.