Locks to Logins

What Are Passkeys? How They Work and Why They Matter (2026)

Michael Kendrick — Sat, 02 May 2026 18:05:58 +0000

This page may contain affiliate links. If you buy through one, I may earn a commission at no extra cost to you. Learn more.

If you’ve logged into Google, Amazon, or your iPhone lately and noticed you didn’t actually type a password, there’s a good chance you used a passkey without realizing it. Passkeys are the biggest change to how we log into things in decades, and they’re already on the devices most people carry in their pocket.

So what exactly is a passkey, how does it work, and should you start using them? This guide breaks it all down in plain English, no technical background required. By the end, you’ll know exactly what a passkey is, why it protects you better than any password can, and how to set one up on your most important accounts today.

What Is a Passkey?

A passkey is a secure digital security key that replaces your password entirely. Your device creates a unique key, stores it locally, and verifies your identity using your fingerprint, face scan, or PIN. Nothing is transmitted that a hacker could steal, because websites only store a useless public key while the private key never leaves your device.

To unlock that key and actually log in, you use something you already do every day, like scanning your fingerprint, using Face ID, or entering your device PIN. That’s it. No password to remember, no password to forget, and nothing a hacker can steal from a website’s database.

Think of it this way. A regular password is like writing your house key code on a sticky note and handing it to every business you visit. If one of them loses that note, anyone can get in. A passkey is more like showing your face at the door. You prove you’re you, nothing gets handed over, and there’s nothing for a thief to walk away with.

Why Are Passwords Getting Replaced?

Passwords have been the standard way to log into things for decades, but they’ve always had a fundamental problem. They’re a shared secret. When you create a password and hand it to a website, that website has to store it somewhere. And when websites get hacked, those stored passwords get stolen.

According to CPO Magazine, a 2022 report by threat intelligence firm Digital Shadows found over 24 billion stolen username and password combinations circulating on the dark web, a 65 percent increase from just two years prior. And that number grows yearly. If you’ve ever reused a password (and most people do), one breach can unlock multiple accounts.

To put that number in perspective: if you have five online accounts and used even slightly similar passwords across them, there’s a meaningful statistical chance at least one of those passwords is already in a criminal’s database right now. Have I Been Pwned lets you check your email address for free in about five seconds. It’s worth a look.

If you want to find out whether your accounts have already been caught in a breach, our guide on how to tell if your email has been hacked walks you through it step by step.

Criminals take those stolen username and password combinations and try them on hundreds of other websites automatically. This is called credential stuffing, and it’s why one breached site can lead to your bank account, email, or streaming service being compromised if you reused the same password. When that happens it is called an account takeover, and it can happen within minutes of a breach hitting the dark web.

Passkeys solve this problem at the root. With passkeys, no shared secret is transmitted between your device and the server. The website only stores a public key, which is useless to anyone who steals it, while the private key that actually authenticates you stays on your device and never leaves it.

Here’s a quick look at how passkeys stack up against the ways most people currently protect their accounts.

Use passkeys wherever a site supports them. For everything else, a strong password plus 2FA is your best fallback.
Feature	Passkey	Strong Password + 2FA	Passphrase	Basic Password
Security
Phishing resistant	Yes, works only on the real site	Partial, you can still be tricked	No, can be entered anywhere	No
Stolen in a data breach	No, private key never leaves your device	Password hash can be cracked	Yes if stored on server	Yes
Brute force / guessing	Not possible	Very difficult with long password	Very difficult	Common attack method
Credential stuffing risk	None, nothing to reuse	Low with unique passwords	Possible if reused	High
Usability
Something to remember	Nothing at all	Yes, complex password	Yes, multiple words	Yes, often forgotten or weak
Login speed	Very fast , one tap or glance	Moderate, password + 2FA code	Moderate, typing required	Fast but insecure
Works across devices	Yes, syncs via iCloud / Google	Yes, with a password manager	Yes, but you still type it	Yes
Setup & Support
Setup difficulty	Very easy	Moderate, needs password manager + 2FA app	Easy	Easy (but not safe)
Website support in 2026	~20–25% of top sites, growing fast	Universal	Universal	Universal
If you lose your device	Restore from iCloud / Google backup	Reset password, use backup codes	Reset password	Reset password (often weak again)
Overall recommendation	Use whenever available	Best fallback option	Better than a basic password	Avoid if possible

How Do Passkeys Actually Work?

The math behind all of this is called public key cryptography, but you don’t need to understand how it works to use it safely. Here’s the basic idea.

When you set up a passkey for a website, your device creates two things: a public key and a private key. These are a mathematically linked pair. The public key goes to the website. The private key stays locked on your device and never goes anywhere.

When you sign in later, the server sends a challenge to your device, essentially asking it to prove it holds the correct private key. Your device uses your biometric or PIN to unlock that private key and respond to the challenge. This type of login is called biometric authentication, meaning it uses something physical about you, like your face or fingerprint, rather than something you memorize. No shared secret is transmitted, and the server never learns what your private key is.

The technology behind all of this is called WebAuthn, which stands for Web Authentication. It’s a standard built and maintained by an industry group called the FIDO Alliance (FIDO stands for Fast IDentity Online). Apple, Google, Microsoft, and hundreds of other companies are all part of this group and have agreed on how passkeys work, which is why a passkey works the same whether you’re on an iPhone, an Android, or a Windows laptop.

Where Are Your Passkeys Stored?

Passkeys can be stored in two places: on your device itself or synced across your devices through a password manager or your device’s operating system.

If you use an iPhone or Mac, your passkeys are stored in iCloud Keychain and automatically sync across all your Apple devices. If you use Android or Chrome, they sync through Google Password Manager. You can also store them in a third-party password manager like NordPass or 1Password if you want more flexibility.

The big takeaway here is that once you set up a passkey on one device, it follows you to your other devices automatically. You don’t have to set it up again from scratch on every phone or laptop you own.

Synced Passkeys vs Device-Bound Passkeys: What Is the Difference?

You may have heard the terms synced passkeys and device-bound passkeys thrown around. Here is the simple version.

A synced passkey is stored in your device’s cloud ecosystem, like iCloud Keychain or Google Password Manager, and automatically copies itself to your other devices. This is the type most everyday users will encounter. Set it up once and it follows you everywhere you are signed in.

A device-bound passkey, sometimes called a hardware passkey, lives only on one specific device or physical security key and never leaves it. This offers slightly higher security because there is nothing to sync or back up, but it also means if you lose the device, you lose the passkey. This option is more common in enterprise and high-security environments.

For home users, synced passkeys are the right choice. They are convenient, recoverable, and still far more secure than any password.

Who Supports Passkeys in 2026?

The largest consumer platforms including Google, Apple, Microsoft, and Amazon all support passkeys. Major financial services, social media platforms, and e-commerce sites have followed, and as of early 2026, roughly 20 to 25 percent of the top 1,000 websites support passkey authentication, with that number growing rapidly.

Some big names you can use passkeys with right now include Google, Amazon, Apple, Best Buy, CVS, PayPal, Coinbase, GitHub, and many more. The FIDO Alliance maintains a live directory at passkeys.directory if you want to see the full list.

The Big Security Win: Passkeys Can’t Be Phished

This is worth its own section because it’s that important.

Passkeys work only on the specific website or app they were created for. If a criminal sends you a fake login page that looks identical to your bank, your passkey simply will not work on it. Your browser and device verify the site’s identity automatically, so you cannot be tricked into handing over your credentials on a fake site.

That’s a problem passwords will always have, no matter how long or complex they are. If you type your password into a fake site, it’s gone. Passkeys make that attack completely impossible.

Now let’s look at how passkeys work visually, step by step.

You Still Need a Password Manager

Passkeys are growing fast, but most of the internet still runs on passwords. A good password manager covers both, storing your passkeys and generating strong unique passwords for every site that hasn’t caught up yet. It handles passkeys and the passwords for any site that does not support passkeys, which is still most of the internet. Popular password managers like 1Password, Bitwarden, and NordPass all support passkeys. Our guide breaks down everything you need to know.

What Happens If You Lose Your Phone?

This is the most common question people ask, and it’s a fair one.

If your passkeys are synced through iCloud Keychain or Google Password Manager, they are backed up in the cloud and will automatically appear when you sign into your account on a new device. You don’t lose access to your accounts just because you dropped your phone.

Apple’s iCloud Keychain recovery is specifically designed to be protected even against brute-force attacks, and Apple itself cannot access your stored keychain data because your credentials are encrypted with your own passcode.

That said, it’s still a smart idea to keep a backup login method available during the transition, like a strong password stored in a password manager. We’ll talk more about that in a moment.

Is a Passkey the Same as Two-Factor Authentication (2FA)?

Not exactly. Two-factor authentication (2FA) is when you log in with a password and then verify yourself a second time, like with a code texted to your phone or generated in an authenticator app.

A passkey actually replaces the password entirely rather than supplementing it. It is technically a single-factor authentication, but one that is cryptographically stronger than a password and traditional 2FA combined. The security comes from the combination of what you have (your device holding the private key) and what you are or know (your biometric or PIN to unlock it), all wrapped into one step.

So yes, passkeys are both simpler and more secure. That’s not a common combination in the security world.

For a full breakdown of how 2FA works and which apps to use, see our Two-Factor Authentication 101 guide.

Are Passkeys the Same as “Sign In with Google”?

Not quite, though it’s an easy thing to mix up. “Sign in with Google” uses Google as a middleman, so you’re trusting Google to verify your identity to another website. A passkey keeps everything between you and the site you’re logging into directly. There’s no third party in the middle, and your login works even if Google is down. Think of it as the difference between showing your ID to a bouncer who calls Google to verify it versus showing it directly to the business that issued it.

How Passkeys Work and How to Set Up

If you want to try it out, Google is a great starting point because most people already have a Google account. Here is all you need to do.

Sign into your Google account, then go to myaccount.google.com, click on Security, and look for the Passkeys option. From there you just follow the prompts. Your device will walk you through it in under a minute. Once your passkey is set up, you can sign in to your Google account with your fingerprint, face scan, or device PIN, and your biometric data stays on your device and is never shared with Google.

Amazon, Apple, PayPal, and many others have similar processes buried in their security settings. Look for the words “passkey” or “passwordless login.”

Ready to Set Up Your First Passkey?

Setting up a passkey takes less than two minutes on most platforms. Use the tab buttons below to select your platform and follow the step-by-step instructions. Keep in mind that software updates regularly, so screens and menu names may look slightly different than described, but the overall process stays the same.

★ Bookmark this page. The setup instructions below cover six major platforms and you may not want to do all of them in one sitting.

Last verified: May 2026

Google Account

Works on any device using the Chrome browser. You will need to be signed in to your Google account before you start.

Go to myaccount.google.com and sign in if prompted.
Click Security and sign in in the left sidebar.
Click Passkeys and security keys.
Click Create a passkey.
Follow the on-screen prompts. Your device will ask you to verify with your fingerprint, Face ID, or PIN.
Once confirmed your passkey is created and ready to use the next time you sign in.

Next time you sign in to Google you will be prompted to use your passkey instead of your password.

What About Passkeys and Password Managers?

Synced passkeys can be stored in a password manager, either one built into your device’s operating system or a standalone manager like NordPass or Dashlane. Synced passkeys have the advantage of being available on any of your devices where the password manager is installed.

If you’re already using a password manager (and if you read our Passwords 101 guide, you know you should be), check whether yours already supports passkeys. Most of the major ones do. This also means you’re not locked into Apple or Google’s ecosystem if you prefer something cross-platform.

Password managers are also still important for the accounts that don’t yet support passkeys. Until every website catches up, you’ll want strong unique passwords for those, and a good manager takes that off your plate.

What If My Device Does Not Support Passkeys?

Most devices from 2019 or later support passkeys. On iPhone, you need iOS 16 or newer. On Android, version 9 or later works with most passkey implementations, though Android 14 or later is recommended for the best experience. On Windows, you need Windows 10 or later with Windows Hello enabled. It’s also worth reviewing what protection is running in the background while you upgrade your login security.

If your device is older than those thresholds, your best move is still a strong password combined with two-factor authentication while you plan your next upgrade. Passkeys are not going anywhere, so whenever you do get a newer device, you will be ready.

Device / Platform	Minimum Required Version
iPhone / iPad	iOS 16 or later
Android	Android 9+ (Android 14 recommended)
Windows PC	Windows 10 with Windows Hello
Mac	macOS Ventura (13) or later
Chrome browser	Version 108 or later
Safari	Version 16 or later
Firefox	Version 119 or later
Edge	Version 108 or later

Still not using two-factor authentication? It is still one of the best fallback tools available. Read our Two-Factor Authentication 101 guide to see how to set it up in minutes.

The Reality Check: Passkeys Aren’t Perfect Yet

No security technology is without its trade-offs, and passkeys are no exception.

The biggest practical limitation right now is support. Around 20 to 25 percent of major websites have passkeys available as of early 2026. That’s a lot, but it also means most sites still rely on passwords. You won’t be going fully passwordless anytime soon, and that’s okay.

Shared accounts can also get complicated. If you and your partner share a streaming login, passkeys don’t handle that the same way a shared password does. Apple’s passkey system, for example, works beautifully for individuals but is not designed for multi-person environments. Some third-party password managers handle this better, so it’s worth looking into if sharing logins is part of your life. Our Password Managers 101 guide covers everything you need to know about choosing and using one.

And finally, if you use an older device that doesn’t support biometrics or a modern PIN system, passkey support may be limited. Most devices from the last three to four years are fine, but it’s worth knowing.

Common Passkey Mistakes (and How to Avoid Them)

The biggest mistake people make is setting up a passkey and then deleting the backup login option right away. Until you’ve used a passkey successfully a few times and know your sync is working, keep your old password stored safely in a password manager as a fallback. Deleting it too soon can leave you locked out if something goes sideways during setup.

The second common mistake is setting up a passkey on just one device and assuming it will automatically appear everywhere. If you use both a phone and a laptop, take five minutes to verify your passkey is showing up on both. For Apple users, that means checking iCloud Keychain on your Mac. For Google users, check Google Password Manager in Chrome on your desktop.

Finally, some people set up a passkey and then get confused when a site still shows a password field first. Many sites show the password field by default and only offer the passkey option as a secondary prompt. Look for a button that says “Use passkey” or “Sign in another way” if you don’t see the passkey prompt automatically.

Is Your Login Security Up to Date?

Quick Security Check

Is Your Login Security Up to Date?

Five questions. Less than a minute. Find out where you stand.

Question 1 of 5

Do you reuse the same password on more than one account?

Question 2 of 5

Does your most important account (email or bank) have two-factor authentication turned on?

Question 3 of 5

Have you ever received a notification that your email or password was found in a data breach?

Question 4 of 5

Do you use a password manager to store and generate your passwords?

Question 5 of 5

Have you set up a passkey on any of your accounts yet?

What About Shared Accounts and Family Logins?

This is one of the most common real-world frustrations with passkeys right now. Because a passkey is tied to your device and your biometric, it does not work the same way as a shared password that two people type.

If you and a family member share a streaming account or a household login, the simplest workaround right now is to use a third-party password manager that supports passkeys in shared vaults, like 1Password. That way the passkey is stored in a vault both people can access, and each person authenticates with their own fingerprint or face on their own device.

Apple’s built-in iCloud Keychain does not currently support shared passkey vaults, so if sharing logins is part of your household routine, a third-party manager is worth considering. This is one area where passkeys still have room to grow, but solutions already exist if you know where to look.

Final Thoughts

Passkeys are not just a new version of the password. They represent a genuinely different approach to logging in, one where you can’t forget your credentials, can’t be phished into giving them away, and don’t have to worry about them showing up in a data breach.

They’re the most significant improvement to everyday login security in a long time, and they’re already here. The rollout will take a few more years to reach every corner of the internet, but the big accounts that matter most, like Google, Amazon, and Apple, are ready right now.

The smart move is to start today. Set up a passkey on your Google account first since almost everyone has one and it takes under two minutes. Then work through Amazon, Apple, and PayPal. Keep your password manager running for everything else and stay consistent with good habits across the board.

Security is always about layers, and adding passkeys to yours is one of the best decisions you can make right now. And if identity theft is a concern beyond just your passwords, pairing passkeys with a credit freeze is one of the most underrated combinations in personal security.

Ready to keep going? Browse all of our Online Security guides for more practical tips, reviews, and tools to protect your digital life.

Passkeys FAQ

What is a passkey in simple terms?

How to Spot AI Scams: Deepfakes, Voice Cloning, and the Red Flags Most People Miss

Michael Kendrick — Wed, 04 Mar 2026 02:37:42 +0000

Artificial intelligence is transforming productivity across nearly every part of our lives, reshaping how we communicate, learn, work, create, and solve complex problems. But like any powerful technology, its benefits are matched by the determination of those who use it for harm.

The era of obvious phishing emails filled with broken English and suspicious links is largely over. AI scams have evolved far beyond that, enabling cybercriminals to craft sophisticated, highly targeted attacks that can fool even cautious and tech-savvy individuals. With just a few seconds of audio pulled from social media, scammers can clone a child’s voice. They can stage convincing video calls where a familiar face appears to speak in real time. They can even sustain months-long fake romantic relationships using AI-generated photos, videos, and messages, operating nonstop without human effort.

These are not distant possibilities. They are happening right now to people across the country, and the financial losses are mind boggling.

What Is an AI Scam?

An AI scam is any fraud that uses artificial intelligence to make deception more convincing, more personalized, and harder to detect. The three most common types are:

Voice cloning: AI replicates a person’s voice from as little as 3 seconds of audio, then makes it say anything a scammer wants.
Deepfake video: AI generates realistic fake video of a real person, used in video calls, fake ads, or romantic video messages.
AI-written phishing: AI generates personalized, grammatically perfect messages at scale, eliminating the spelling errors that once made scams easy to spot.

What sets AI scams apart from traditional fraud is scale and realism. A single scammer can now maintain hundreds of fake relationships simultaneously, impersonate any voice instantly, and generate believable content at zero cost.

The Numbers Behind the Problem

According to the FBI’s 2024 Internet Crime Report, released in April 2025, Americans over the age of 60 lost nearly $4.8 billion to cybercrime in 2024 alone, a staggering 33% jump from the year before, with total reported losses across all age groups hitting a record $16.6 billion. The Federal Trade Commission reports that romance scams alone cost U.S. consumers over $1.14 billion in reported losses in 2023, and the FBI estimates that number is significantly undercounted because many victims are too embarrassed to report what happened. Deepfake fraud in the U.S. surged 1,100% in the first months of 2025 according to fraud detection firm Sumsub.

What is driving this explosion is not just better technology. It is cost. Creating a convincing voice clone now costs a few dollars. Building a fake profile with AI-generated photos takes minutes. Maintaining dozens of fake romantic relationships simultaneously is something an AI chatbot can do without stopping. Scammers have essentially eliminated the labor barrier that once limited how many people they could target at once.

Real People, Real Losses

Statistics tell part of the story. Real cases tell the rest.

Sharon Brightwell, Dover, Florida: $15,000 Lost in a Single Phone Call

Sharon received a phone call late at night that no parent ever wants to get. On the other end was what sounded exactly like her daughter’s voice, crying and saying she had been in a car accident, lost her unborn child, and was now facing criminal charges. A man claiming to be a lawyer then took over the call and told Sharon that $15,000 in cash was needed immediately to keep her daughter out of jail.

Sharon sent the money. Her real daughter had no idea any of this was happening. The voice Sharon heard was an AI-generated clone built from audio scraped from her daughter’s social media. By the time the fraud was uncovered, the cash was gone. Source: FOX 13 Tampa Bay

Abigail Ruvalcaba, Southern California: Lost Her Home and $81,000

Abigail, 66, connected with someone on Facebook who appeared to be Steve Burton, a well-known actor from the TV show General Hospital. Over the following months, she received personalized video messages where the person on screen looked directly at her, used her name, and expressed deep affection. The videos were AI deepfakes built using the actor’s public footage.

When Abigail’s daughter Vivian finally saw one of the videos, she said it was not grainy or obviously fake. To the naked eye, it looked completely real. By the time the scam unraveled, Abigail had sent over $81,000 through gift cards, cash, Zelle, and Bitcoin. Then, even after her accounts were drained, the scammer pushed her to sell her home. She sold her paid-off condo for $350,000, well below market value. The LAPD documented the case but told the family there was little chance of recovering anything. Source: KTLA Los Angeles

A French Woman and a Fake Brad Pitt: $850,000 Gone

A woman in France spent 18 months in what she believed was a real romantic relationship with actor Brad Pitt. Scammers sent her AI-generated photos, including what appeared to be personal selfies taken just for her. She performed a reverse image search and could not find the photos anywhere online, which she took as proof they were real and private. They were AI-generated images that did not exist anywhere else because they had just been created.

She ultimately transferred approximately $850,000 before the fraud came to light. As one security researcher put it, this woman was sophisticated enough to try to verify the photos and still got fooled. That is the point. These tools are now good enough to fool careful people. Source: CBS News

Steve Beauchamp, United States: $690,000 in Retirement Savings

Steve Beauchamp, an 82-year-old retiree, came across a video online that appeared to show Elon Musk personally endorsing an AI-powered investment platform. The video looked legitimate. The face was right. The voice matched. The presentation was professional.

Beauchamp transferred his entire retirement savings, $690,000, into the platform over several weeks. The investment platform was completely fake. The Musk video was a deepfake. There was no investment. The money disappeared. Source: Incode – Top 5 Cases of AI Deepfake Fraud From 2024

How Deepfake and Voice Cloning Scams Actually Work

Understanding the mechanics makes these attacks easier to recognize before they hit.

Voice Cloning — Modern AI can recreate a convincing version of someone’s voice from as little as three seconds of audio. That audio does not need to come from a private source. A voicemail greeting, a TikTok video, a YouTube clip, or an Instagram reel is more than enough. Once the clone exists, the scammer can make it say anything. Research published in 2024 found that these clones can match the original person’s accent, tone, and speech patterns with around 85% accuracy.

Deepfake Video — Creating a convincing fake video used to require expensive equipment and technical skill. That is no longer true. Scammers now use consumer-grade software to generate personalized video messages, fake video calls, and fake romantic video chats. Research suggests that 68% of deepfake videos currently cannot be reliably distinguished from real footage by the average viewer. The face moves naturally. The expressions track. The voice matches.

AI-Written Messages — Old scam messages were easy to spot because they were poorly written. AI writing tools have eliminated that tell. For a deeper look at what to watch for in your inbox, see our guide on how to spot scam emails. Scammers can now produce personalized, emotionally intelligent messages that match your interests, reference things you have shared publicly, and build rapport over time. An AI chatbot can maintain multiple fake romantic relationships simultaneously, never forgetting a detail, never sounding tired or off.

Fake Profiles with AI-Generated Photos — AI can generate realistic photos of people who do not exist. The images show up in reverse image searches as nothing because they were just created. Scammers layer these images with fabricated life stories and AI-powered conversation to build fake identities convincing enough to fool people over months of contact.

AI Job Scams: The New Wave of Employment Fraud

Most people think of AI scams as phone calls from fake grandchildren or fake celebrity investment pitches. But one of the fastest-growing categories is the AI job scam, and it is catching people at a moment when they are already stressed and hopeful.

Here is how it works. A scammer scrapes your LinkedIn profile or resume from a job board. An AI generates a perfectly written job offer that references your actual skills, your real work history, and the exact type of role you are looking for. The email comes from a domain that looks legitimate at a glance. The interview happens over chat, sometimes with a video call using a deepfake of a real company’s HR representative. Once you are ‘hired,’ you are asked to complete onboarding steps that include providing your Social Security number, banking information for direct deposit, or purchasing equipment with a reimbursement promised later.

The equipment reimbursement never comes. The company either does not exist or the real company has no idea their brand is being used. Your financial and identity information is now in the hands of criminals.

Common AI job scam red flags:

The offer comes without you applying
The salary is unusually high for the role
Interview is entirely text-based, uses low-quality video, or feels rushed
Communication avoids official company channels
You are asked for financial or sensitive information before day one
You are told to purchase equipment or send money

Important:
Any request to buy gift cards, wire money, or pay out of pocket is almost certainly a scam. Legitimate employers do not operate this way.

Who Gets Targeted Most Often

While anyone can fall victim to an AI scam, certain groups are targeted more frequently than others. Older adults and seniors are disproportionately targeted, particularly those who may be less familiar with voice cloning or AI-generated video. Widowed or divorced individuals on dating apps or social media are also common targets, since they may be more open to new connections. Anyone who posts regular public video or audio content is at higher risk simply because that material feeds the cloning tools directly. People actively looking for investment opportunities or who have recently come into retirement money are frequently targeted through deepfake celebrity endorsement scams. And it is worth noting that family members of primary victims can become secondary targets as well, since scammers sometimes push victims to sell property or drain joint accounts, pulling others into the fraud in the process.

Why These Scams Work So Well

The technology is only half of the equation. These scams work because they are engineered to shut down your ability to think clearly before you act.

Urgency is the primary weapon. When someone you love appears to be in danger, or when a romantic partner you have grown attached to is in a crisis, the brain shifts into a reactive, emotional mode. Critical thinking takes a back seat. Scammers design every element of the interaction to keep you in that state.

Trust in familiar voices and faces is deeply wired into how humans process the world. When something sounds like your grandson or looks like someone you have been talking to for months, skepticism does not come naturally. That familiarity is the exact vulnerability these tools exploit.

Secrecy is the third pillar. Scammers almost universally insist on keeping the situation between you and them. Do not tell your family. Do not call anyone else. Do not hang up. This isolation cuts off the people who might otherwise talk you out of acting. In the Ruvalcaba case, her daughter noticed her mother had become secretive and defensive before the full scope of the scam became clear. That isolation is not an accident. It is a deliberate strategy.

How to Protect Yourself and Your Family

Create a family code word. Agree on a private word or phrase in advance that only your immediate family knows. If you ever receive an urgent phone call, text message, or video call from someone claiming to be a relative in trouble, needing money, or asking for immediate help, ask for the code word before doing anything else. With AI voice cloning now capable of mimicking loved ones from just a few seconds of online audio, family code words are becoming one of the simplest and most effective defenses against impersonation scams. The FTC highlights creating a family safe word as one of the best protective steps families can take. One important caution: never volunteer the code word yourself. Scammers are increasingly aware that families use safe words and may pretend to have forgotten it in hopes that you will say it first.

Hang up and call back on a number you already have. If you receive any urgent call from a family member, a bank, or anyone requesting money or personal information, hang up and call them back on a number stored in your phone. Do not use a number the caller gives you. Do not rely on caller ID, which can be faked.

Slow down on purpose. Urgency is a manipulation tactic, not a real emergency signal. If someone is pressuring you to act immediately, to not hang up, to not tell anyone, treat that pressure as a warning sign. Legitimate emergencies can wait three minutes while you verify through a separate channel.

Reverse image search any photos from new online contacts. Drag the image into Google Images or visit images.google.com and upload it. AI-generated photos often cannot be found anywhere else on the internet, which may actually be a red flag rather than reassurance, as it was for the Brad Pitt scam victim. A dedicated tool like FaceCheck.ID searches specifically for face matches.

Be careful with what you post publicly. The more public audio and video your family posts, the more raw material scammers have available. A three-second clip of a voice is genuinely enough to build a clone. This is especially worth considering for parents and grandparents who post regularly featuring children or grandchildren.

Never send money based on emotion or pressure. Wire transfers, gift cards, cryptocurrency, and cash sent by courier are all essentially untraceable and unrecoverable. No legitimate emergency requires payment through these methods. No real attorney, bail bondsman, or law enforcement officer will demand cash via courier or gift card.

Talk to elderly family members directly. Many older adults do not know that voice cloning is possible or that AI can generate a realistic video of a person saying something they never said. A clear, calm conversation about how these tools work is one of the most practical things you can do to protect the people you love.

Free Tools That Can Help You Spot AI Fakes

You do not need expensive software to add some protection against AI-generated content. These free or low-cost tools are worth knowing about.

FaceCheck.ID searches for face matches across the internet and is specifically designed for identifying whether a person’s face appears in known scam profiles or elsewhere online. It is more effective than standard reverse image search for romantic scam verification.

Google Reverse Image Search remains useful for finding whether a photo appears elsewhere. Simply drag an image into the search bar and run a search. One limitation is that AI-generated photos often do not exist anywhere else online, which can be a false comfort.

Hive Moderation’s AI Image Detector lets you upload an image and receive a probability score for whether it was AI-generated. It is not perfect and should be used as just one data point among several.

Sensity AI offers a free deepfake detection tool that can analyze video clips for signs of synthetic generation.

None of these tools are foolproof. The technology that creates deepfakes and the technology that detects them are in an arms race, and creation is currently winning. Use these tools to add a layer of scrutiny, not as a final verdict.

AI Scam Red Flags to Watch For

Any caller insisting on secrecy and urging you not to tell anyone or hang up
Requests for payment using gift cards, wire transfers, cryptocurrency, or cash sent by courier
A video or voice call where something feels slightly off but you cannot quite explain why
A new online romantic interest who refuses to do a live, unscripted video call or always has a technical excuse
Investment opportunities promoted through video endorsements from celebrities, especially involving guaranteed returns
A story that keeps evolving under questions or shifts when you push back on specific details
Any request to move a conversation off a dating app to WhatsApp, Telegram, or another encrypted app early in the relationship

Immediate Steps to Take After Realizing It’s a Scam

1. Cut off contact immediately

Hang up
Do not reply or engage in any way, even if they threaten urgency
Block the number or account

2. Secure your accounts right away (do this first if you shared login info)

If you entered login info anywhere, change your email password first
Then change banking, financial, and any reused passwords
Enable two-factor authentication where possible

3. Contact your bank or financial institutions

Report the fraud immediately
Use only official numbers from your card or website.
Ask about reversing or stopping transactions
Wire transfers are hard to recover, but acting quickly gives you a small chance
If gift cards were used, contact the issuer, some can freeze unused balances

4. Preserve evidence before it disappears

Screenshot messages, emails, and transaction records
Save phone numbers, usernames, and URLs
Write down exactly what happened while it is still fresh

5. Report the incident

File a report at ReportFraud.ftc.gov
File with IC3.gov if it involved online fraud
Include as much detail as possible

Prepare Now, Panic Less Later

If identity theft happens, the last thing you want is to be scrambling to figure out who to call. Download the free Identity Theft & Fraud Response Sheet to keep every phone number, website, and recovery step in one printable reference — and if you want to understand how identity theft works before it happens, start with our Identity Theft 101 guide.

A Note on Recovery

One fact from this area of fraud is worth stating clearly because people often do not find it out until it is too late. Once money moves through wire transfer, cryptocurrency, gift cards, or cash, recovery is extremely rare. Law enforcement can document cases and open investigations, but as the Ruvalcaba family learned directly from the LAPD, there is often very little that can be done once the funds are gone.

This is why prevention matters so much more in this space than response. Unlike a fraudulent credit card charge where the bank can reverse the transaction, money you authorize and send yourself is in an entirely different legal category. Scammers know this and count on it.

What Legitimate Requests Will Never Look Like

No real police officer, attorney, bail bondsman, bank, or government agency will call you out of the blue and demand immediate payment in gift cards, wire transfer, or cash. They will never insist that you keep the situation secret from your family. They will never pressure you to act before you have had a chance to verify through your own channels. If someone is doing any of those things, it does not matter how much the voice sounds like your grandchild or how real the face on the video looks. Those behaviors are the scam, not a real emergency.

Where to Report AI Scams

Reporting a scam will not always get your money back, but it matters. Reports help law enforcement identify patterns, build cases, and warn others before they become victims. If you or someone you know has been targeted by an AI scam, here is where to go.

Federal Trade Commission (FTC). The FTC is the primary federal agency handling consumer fraud. File a report at ReportFraud.ftc.gov. Reports are shared with law enforcement agencies across the country and help the FTC track emerging scam trends. The process takes about ten minutes and does not require a police report first.

FBI Internet Crime Complaint Center (IC3). For internet-based fraud including deepfake scams, romance scams, and AI-generated investment fraud, file a complaint with the FBI at IC3.gov. The IC3 accepts complaints from both victims and third parties and forwards actionable reports to federal, state, and local law enforcement. Include as much detail as possible, including dates, dollar amounts, and any usernames, phone numbers, or email addresses involved.

Local Law Enforcement. File a report with your local police department, especially if you lost money or were threatened. Ask for a copy of the report number for your records. While local departments may have limited resources for online fraud, a filed report creates an official record that can support any financial institution disputes or insurance claims.

Your Bank or Financial Institution. If money moved through a bank transfer, contact your bank immediately. While wire transfers are rarely reversed, acting quickly gives you the best chance. If gift cards were used, contact the card issuer directly as some have fraud recovery programs. Report credit card fraud to your card issuer right away, as those disputes have stronger consumer protections.

AI Scam Prevention Checklist

Set up a family code word that only immediate family members know, and never volunteer it if asked
If you receive an urgent call from a family member in trouble, hang up and call them back on a number already saved in your phone
Never send money via wire transfer, gift card, cryptocurrency, or cash courier based on a phone call or message alone
Reverse image search photos from anyone you meet online before trusting them
Tighten privacy settings on social media and limit who can see videos and audio clips of you and your family
Be suspicious of any caller or contact who insists on secrecy or tells you not to hang up or talk to family
Treat extreme urgency as a warning sign, not a reason to act faster
Never click links in unexpected emails or texts, type the website address directly into your browser instead
Talk to elderly parents and grandparents about voice cloning and deepfakes before they encounter them
If you are targeted, report it to the FTC at ReportFraud.ftc.gov and the FBI at IC3.gov

Final Thoughts

AI scams are more personal than anything that came before them. They can use the voices of people you love, the faces of people you trust, and the emotional weight of situations you cannot afford to get wrong.

The most powerful defense is not a piece of software. It is slowing down before you act, verifying through a channel you already control, and building a few simple habits before you ever need them.

Start with one thing today: set up a family code word. Text it to your family members right now. It costs nothing and takes about 60 seconds. That one step breaks the grandparent scam, the emergency voice clone call, and most other impersonation attacks that rely on urgency and trust.

If you want to go further, check out our guides on Password Security, Two-Factor Authentication, and How to Spot Scam Emails, all part of the same practical approach to staying safe without becoming paranoid.

And if this article helped you understand the threat, please share it. Send it to a parent, a grandparent, or anyone you know who might not yet know that a voice on the phone is no longer reliable proof of who you are actually talking to.

Explore more Online Security guides for related tips, tools, and reviews.

AI Scams FAQ

Can scammers really clone someone's voice from a short video or voicemail?

How to Freeze Your Credit and Stop Identity Theft Cold

Michael Kendrick — Thu, 19 Feb 2026 02:13:38 +0000

If your personal information has been exposed in a data breach or your identity has been stolen, one of the most powerful moves you can make is to freeze your credit. It costs nothing, it takes just a few minutes, and it puts a hard block between criminals and your financial life. This guide walks you through exactly what a credit freeze does, when to use one, and how to set it up at all three major bureaus today.

Should you Freeze Your Credit?

The short answer for most people is yes, and sooner than you think. You do not have to be an identity theft victim to benefit from a credit freeze. Even as a purely proactive step it is one of the easiest protections you can put in place.

Many people delay because they assume it will complicate their financial life. It will not. You can lift it temporarily any time you need to apply for credit, and it goes back into place automatically. There is no downside to being cautious.

What is a Credit Freeze?

A credit freeze, also called a security freeze, is a free tool that restricts lenders from accessing your credit report. Since most banks and lenders will not approve new credit without checking your report, this makes it nearly impossible for criminals to open new accounts in your name. Think of it like putting a padlock on your credit file. Nobody can open it without the key, and you control the key.

A few important things to know:

It does not affect your credit score
It does not stop fraud on existing accounts
You can temporarily lift or remove the freeze when needed
It lasts indefinitely until you lift it
Each person in your household needs their own freeze

When you should freeze your credit

You should consider freezing your credit if:

Your identity has been stolen
Your Social Security number was exposed in a breach
Your wallet was lost or stolen
You see unfamiliar accounts or credit checks
A company notifies you of a data breach
You receive notification that someone filed taxes in your name
You get bills for medical services you never received

If you are unsure, it is usually better to freeze first and evaluate later. There is no downside to being cautious.

If you think your email account may have been compromised as part of identity theft, check out our guide on How to Tell If Your Email Has Been Hacked before proceeding.

How to Freeze Your Credit (All Four Bureaus)

How to freeze your credit (step by step):

Go to Equifax.com and create an account or log in. Do this one first since it takes the longest.
Verify your identity using your name, Social Security number, date of birth, and address.
Submit your freeze request and save your PIN or account password somewhere secure like a password manager.
Repeat the same process at Experian.com.
Repeat again at TransUnion.com.
For complete protection, do not forget the fourth bureau, Innovis.com.

The whole process takes about ten minutes and costs nothing at any of the four bureaus.

Equifax

Go to equifax.com. You will create an account or log in if you already have one. Equifax may take up to one business day to apply the freeze, so do this one first.

Experian

Go to experian.com. Experian applies the freeze immediately online. You will receive a PIN to use when you need to lift it later.

TransUnion

Go to transunion.com. TransUnion also applies the freeze immediately and lets you manage everything through their online account.

MOST PEOPLE MISS THIS

Innovis: The Fourth Bureau

Innovis is a fourth credit reporting bureau that most people have never heard of, and most guides never mention. Some lenders do check it, which means leaving it unfrozen is an unnecessary gap in your protection. Freezing it is free and takes about two minutes. Visit innovis.com and add it to your list while you are already in freeze mode.

What information you will need

Before you start, gather the following:

Full name
Social Security number
Date of birth
Current address and previous addresses from the last two years
Email address
Phone number

You may also be asked identity verification questions based on your credit history, like which bank issued your car loan or which street you lived on in a certain year.

Creating your PIN or password

Each bureau will give you a PIN or let you create an online account with a password. This is what you will use to unfreeze your credit later.

Write down or save these credentials in a secure location like a password manager. If you lose them, you will need to verify your identity again to regain access.

What happens after you freeze

Once your credit is frozen:

New creditors cannot pull your credit report
You will not receive pre-approved credit offers
Criminals cannot open accounts in your name
Your existing accounts continue to work normally

You can still use your current credit cards, make payments, and access your bank accounts. The freeze only blocks new credit applications.

Prepare Before You Need To

A credit freeze is a great first line of defense, but it works best as part of a bigger picture. One of the smartest things you can do right now while nothing is wrong is to get your key information organized and ready.

We put together a free two-page resource for exactly this. The Identity Theft and Fraud Response Sheet has space to document your financial institution emergency numbers, credit bureau contacts, government agencies that handle identity theft, insurance information, and more. Fill it out, keep a copy somewhere accessible, and you will be ready if you ever need it.

Credit freeze vs fraud alert

A fraud alert tells lenders to take extra steps to verify your identity. It is easier to set up, but it is also weaker because it does not fully block access. A credit freeze is stronger because it prevents access entirely unless you unlock it.

Here is how they compare:

Feature	Credit Freeze	Fraud Alert
Blocks access to credit report	Yes	No
Lasts	Until you lift it	1 year (or 7 years for identity theft victims)
Requires setup at each bureau	Yes	No, one bureau alerts the others
Best for	Active identity theft	Suspected risk or precaution

Many people choose to start with a freeze after identity theft, then decide later if they want to keep it long term.

How to temporarily unfreeze your credit

If you need to apply for credit, you can temporarily unfreeze your report. You have two options:

Temporary lift

Unfreeze for a set period of time, like one day or one week. This is useful when you know exactly when you will be applying for credit.

Lift for a specific creditor

When you are ready to apply for credit, ask the lender which bureau they will check before you do anything. You may only need to lift the freeze at one or two bureaus instead of all three, which saves you time. Some bureaus also let you unfreeze for a single lender only rather than a set time period, though this option is not available everywhere. Either way, the process is done online or by phone using the PIN or account you created and usually takes just a few minutes. Once the temporary period ends the freeze reactivates automatically. You do not need to do a thing.

What if you lost your PIN or account access?

If you lose your PIN or forget the password you set up, do not worry. Each bureau has an account recovery process. You will need to verify your identity again, which may involve answering security questions, uploading a copy of your ID, or receiving a verification code by mail. It takes longer than a normal unfreeze, so keeping your credentials saved in a password manager from the start is the best way to avoid the headache.

How to Permanently Remove a Credit Freeze

Permanently removing a credit freeze is just as straightforward as placing one. Log in to your account at each bureau or call them by phone, verify your identity using your PIN or account credentials, and request the freeze be lifted permanently.

Once removed, lenders can access your credit report again just as they could before the freeze was in place. There is no waiting period and no impact on your credit score either way.

Before you remove it permanently, ask yourself whether a temporary lift might be the better option. If you are just applying for one loan or one credit card, lifting it temporarily at the bureau the lender uses makes more sense than removing your protection entirely. You can always refreeze, but it means going through the process again at all four bureaus.

Downsides and limitations

A credit freeze is powerful, but it is not perfect.

You must temporarily unfreeze your credit when applying for:

Loans
Credit cards
Some apartment rentals
Certain background checks
Utilities in some states
Cell phone plans with financing

It also does not protect you from:

Phishing attacks
Existing account fraud
Tax or medical identity theft
Someone using your debit card
Account takeovers where criminals change your passwords

This is why freezing your credit should be just one part of your overall identity protection plan. For a full overview of how to protect yourself, read our Identity Theft 101: Identity Protection Starter Guide.

What about your children

If you have children under 18, consider freezing their credit as well. Child identity theft is a growing problem because it often goes unnoticed for years.

Children typically do not have credit reports unless someone has fraudulently opened accounts in their name. You can still freeze their credit to prevent this from happening.

The process is similar but requires proof of identity for both you and your child. Each bureau has slightly different requirements, so check their websites for details.

Other consumer databases to consider freezing

Beyond the three major credit bureaus, there are two other consumer reporting systems that some people freeze after identity theft.

ChexSystems is used by many banks when you open a new checking or savings account. If a criminal tries to open a bank account in your name, ChexSystems may be consulted. You can request a security freeze at chexsystems.com.

NCTUE is the National Consumer Telecom and Utilities Exchange. Some utility companies and cell phone carriers check this when you set up new service. You can freeze it at nctue.com.

Neither of these is required, but if you want the most complete protection possible, they are worth a look.

Additional steps to take after identity theft

Freezing your credit is an important step, but it should not be the only one.

If your identity has been stolen, you should also:

Change passwords on all important accounts, especially email and banking
Enable two-factor authentication everywhere it is available
Monitor your bank and credit card statements for unauthorized charges
File a report with the Federal Trade Commission at IdentityTheft.gov
Consider filing a police report to create an official record
Check your credit reports for unfamiliar accounts
Set up fraud alerts or credit monitoring if you want an extra layer of notification

Scammers often target identity theft victims with follow-up scams, so stay vigilant. If you are unsure whether an email or text is legitimate, review our guide on How to Spot Scam Emails.

Final thoughts

A credit freeze is one of the most effective tools you have after identity theft. It is free, it is fast, and it gives you control over who can access your credit report.

The peace of mind alone makes it worth the few minutes it takes to set up. You do not need to be a security expert to protect yourself. You just need to take action.

Remember that identity theft is not a reflection of something you did wrong. Data breaches happen to major companies all the time. Your information can be exposed through no fault of your own. What matters is how you respond.

If your information has been compromised, do not wait. Go freeze your credit at Experian, Equifax, and TransUnion today. It takes about ten minutes total and costs nothing. Then work through the rest of your identity protection plan one step at a time.

You Froze Your Credit. Is Your Identity Actually Safe?

A credit freeze is just one piece of the puzzle. For a broader look at identity protection, start with our Identity Theft 101 Starter Guide.

Credit Freeze FAQ

Does freezing my credit cost money?

Home Security for Renters: No-Drill Options That Work

Michael Kendrick — Sun, 08 Feb 2026 18:42:40 +0000

Simple Home Security for Renters

Renting does not mean you have to accept weak security. Most leases limit drilling, wiring, or permanent changes, but there are still effective ways to improve safety and security for rentals without landlord approval or risking your deposit.

The perception that renters are stuck with whatever security the landlord provides is simply not accurate. While you cannot usually install deadbolts, hardwire alarm systems, or add exterior lighting, you can still address the most common security gaps using temporary solutions that work just as well.

This guide focuses on practical, renter-friendly security upgrades that are easy to install, easy to remove, and realistic for apartments and rental homes. These are not workarounds or compromises. They are legitimate security improvements that happen to be portable.

The approach here is layered. Physical barriers come first because they are cheap, and they slow down or stop forced entry. Visibility comes next because cameras and lighting make your space less appealing to someone looking for an easy target. Alarms come last because they alert you to a problem, but they do not stop it on their own.

You do not need all of this at once. Start with what makes the most sense for your specific situation and build from there.

A Quick Word About Your Lease

While everything in this guide is designed to be renter-friendly, it is still a good idea to use common sense and check your lease or ask your landlord if you are unsure. Even temporary solutions like adhesive strips or double-sided tape can sometimes pull paint or finishes when removed, which could result in a deposit issue. When in doubt, test in an inconspicuous spot or get clarification before attaching anything permanently.

If you have a reasonable landlord, they may be open to certain upgrades, especially if you offer to restore everything when you move out. Some landlords even appreciate tenants who take security seriously because it protects their property too.

One of my favorite sayings is, “It doesn’t hurt to ask.” If you feel your rental property is missing basic security measures, it’s worth asking your landlord if they’re willing to address them. For example, if a back door only has a basic knob lock, your landlord may be open to having a locksmith install a deadbolt. That kind of upgrade improves security not just for you, but for the property itself. At worst, the answer is simply no.

Simple Security Fixes Under $10

Security for renters doesn’t need to be costly. These are basic physical upgrades that cost very little, require no tools, and can be done in minutes. They focus on stopping easy entry points and creating the appearance that someone is home.

Sliding door and window braces
A wooden dowel, tension rod, or even a cut-down broom handle placed in the track of a sliding door prevents it from being forced open. It just needs to be cut to the correct length so the door cannot slide.

If you want a purpose-built option, adjustable sliding door braces are also available. While many are priced slightly above $10 at full price, they frequently go on sale and can often be found under $10 if you watch deals. You can see current options here: sliding door brace options on Amazon.

The same bracing approach works for sliding windows, especially ground-level windows or windows that are hidden from view.

Adhesive window wedges and locks
Many products sold for child safety also work well as simple window security. A good example is the Toddleroo by North States Window & Door Wedge Locks.

These use a double-sided Velcro-style adhesive strip, which lets you attach and remove the wedge repeatedly without tools or permanent marks. That flexibility allows you to place the wedge exactly where it makes sense for your space.

Mounted low, a wedge can prevent the window or sliding door from opening at all. Mounted a few inches higher, it allows the window to remain partially open for airflow while still limiting how far it can be opened. This makes them especially useful for ground-level windows or rooms where you want ventilation without fully opening the window.

For a more security-conscious setup, you can install a wedge on each side of the window. Doubling them up adds additional resistance and makes the window harder to manipulate or force past the stop.

They remove cleanly when needed and can be repositioned if you want to change how far the window opens.

Light timers for lamps
Simple outlet timers are an easy way to make a space look occupied. A good example is the BN-LINK Mechanical Light Timer 2-Pack.

These timers let you turn lamps on and off automatically at set times each day. Lights coming on in the evening can give the impression that someone is home, which can discourage opportunistic break-ins. They are also useful if you get home after dark, since you can have lights turn on shortly before you arrive instead of walking into a completely dark space.

These three options are some of the easiest and most affordable ways to improve security for rentals, especially if you are starting from scratch.

Door Security Without Drilling

Once the cheapest gaps are closed, the next priority is strengthening entry doors without making permanent changes.

A solid renter-friendly option is the SECURITYMAN 3 in 1 Door Security Bar & Sliding Door Security Bar. It works on standard hinged doors as well as sliding patio doors, which makes it useful in many rental layouts.

The bar props under a door knob or fits into a sliding door track using interchangeable caps. It has an angled rubber base designed to stay in contact with the floor without scratching, and the iron construction is rated to withstand up to 400 pounds of pressure. It adjusts from 18.25 inches to 46.5 inches to fit most doors and sliders.

This type of door bar is especially useful at night when you are home and want an extra layer of security while sleeping. Because it braces against the floor, it needs to be removed before opening the door, so it is not something you would leave in place while coming and going.

If you are renting a house, one of these can make sense on a back or side door that is rarely used. For a main front door, it is best thought of as a nighttime or at-home security upgrade rather than an all-day solution.

Placement still matters. If the bar rests on a loose rug or mat, that surface can slide under pressure and reduce how effective the bar is. Bracing it directly on a solid floor gives it something firm to push against.

Video Doorbells Without Drilling

Video doorbells are one of the most effective security upgrades for renters, especially when they can be installed without drilling or wiring.

No-drill mounting option
The Ring No-Drill Mount allows compatible Ring battery doorbells to be mounted using a strong adhesive backing instead of screws. This makes it possible to install a video doorbell without modifying the exterior of the unit.

The mount is weather-resistant and removable, with adhesive strips designed to pull away cleanly when removed. It works best on smooth, flat surfaces and is not recommended for brick, rough stucco, shingles, or glass.

Battery-powered Ring doorbell
Paired with the mount, the Ring Battery Doorbell is a renter-friendly option. It runs on a built-in battery that charges via USB-C, so no existing doorbell wiring is required.

It provides head-to-toe video coverage, motion alerts, live view, and two-way talk through the Ring app. Because the doorbell detaches easily, recharging it does not require removing the mount itself.

A video doorbell makes the most sense when your main concern is knowing who is at your door and being alerted when someone approaches or rings, especially in apartments where hallways or entryways are shared. A traditional security camera is usually a better fit if you want broader coverage of a room, patio, or parking area, but for front-door awareness and two-way interaction, a doorbell is often the cleaner and more renter-friendly option.

Battery-Powered Security Cameras

Battery-powered cameras give renters visibility and deterrence without drilling holes or running wires. They work well for entry points, patios, balconies, driveways, or anywhere you want awareness without a permanent install.

A solid renter-friendly example is the Tapo 1080p Outdoor Wireless Security Camera (C400).

This camera offers 1080p video with color night vision, making it easier to see details after dark. It runs on a rechargeable battery rated for up to 180 days per charge with typical use, so it does not need to be hardwired. Motion alerts include person detection without requiring a subscription, and recordings can be stored locally on a microSD card if you want to avoid monthly fees.

It also supports two-way audio, custom light alarms, and integration with Alexa and Google Assistant. Because it is wireless, it can be mounted using renter-friendly methods like clamps or removable mounts, depending on your space.

Battery cameras like this are a good fit when you want broader coverage than a doorbell can provide, such as watching a backyard, side yard, or parking area, while still keeping installation temporary and lease-friendly.

Lighting Without Wiring

Lighting is often overlooked, but it plays a meaningful role in home security.

Battery-operated motion-sensing lights are widely available and work well in hallways, near entry doors, stairways, closets, or darker corners of an apartment. Because they do not require wiring, they are easy to add and remove without making permanent changes.

When choosing one, pay close attention to the mounting options. Some lights use adhesive backing, some use removable strips, and others rely on small screws. Make sure the mounting method will work for your specific situation and surface so you do not damage walls or violate lease terms.

Used thoughtfully, motion-activated lighting adds visibility exactly when it is needed and can make a space feel safer without any permanent installation.

Renter-Friendly Alarm Systems

After physical barriers and visibility are in place, wireless alarm systems add alerts and awareness without permanent installation.

Look for systems that are battery powered and use adhesive mounting instead of screws. These usually include door and window sensors, motion detectors, and a loud siren.

Popular renter-friendly options include SimpliSafe and Ring, both of which offer starter kits sized for apartments with no professional installation required.

Putting It All Together

You do not need to install everything at once. The goal is not to turn your rental into a fortress. The goal is to make it harder to get into than the unit next door.

Most break-ins are crimes of opportunity. Someone checks a few doors or windows, sees what opens easily, and moves on if they hit resistance. A sliding door with a brace in the track, window wedges, security lighting, and a camera pointed at the entrance are often enough to send someone looking elsewhere.
A realistic renter-friendly setup might include:

Entry-level setup (under $50):

Sliding door and window braces for ground-level access points
Adhesive window wedges on windows you want to leave cracked
A door security bar for the main entrance at night
Light timers on a couple of lamps

This covers the basics. It closes easy gaps and creates the appearance that someone is paying attention.

Mid-level setup ($100 to $200):

Everything from the entry-level setup
A battery-powered video doorbell or one indoor camera facing the entry area
A motion-sensing light in a hallway, entryway, or darker room
An additional camera for a patio, balcony, or parking area if needed

This adds visibility and awareness. You know when someone approaches your door, and you have a record of what happened if something goes wrong.

Full setup ($250 to $400):

Everything from the mid-level setup
A wireless alarm system with door and window sensors
Motion detectors for interior spaces
Additional cameras for broader coverage

This is the upper end for most renters. It provides multiple layers of protection and real-time alerts, but it is also more to manage and more to pack up when you move.

The right level depends on your situation. If you live on the third floor of a secured building, the entry-level setup might be more than enough. If you rent a house with multiple ground-level entrances and no nearby neighbors, the full setup starts to make more sense.

Focus on what actually concerns you. If package theft is the issue, start with a video doorbell. If you worry about someone forcing a sliding door at night, start with a brace and a door bar. Do not buy everything just because it exists.

Final Thoughts

Home security for renters works best when you start with simple physical barriers and build up from there. Closing easy entry points first makes every other upgrade more effective. A camera does not do much if the door it is watching can be opened with a hard push.

The other advantage of starting small is that it lets you figure out what actually matters in your space. You might assume you need cameras everywhere, then realize after a month that a single doorbell camera and a solid door brace cover most of your concerns. Or you might find that motion lights make you feel more comfortable at night than any other upgrade you tried. Security is not one-size-fits-all, and renting gives you the flexibility to adjust without being locked into permanent installations.

You also do not need to own the space to make it safer. Renters actually have an advantage in some ways because portable security upgrades can move with you. If you invest in a battery-powered camera or a wireless alarm system now, you take it to your next place. That is not true for hardwired systems or installed deadbolts.

One more thing worth mentioning is that visible security often works better than hidden security. A camera in plain view, a doorbell with a glowing ring, or even a door bar leaning near the entrance can be enough to make someone reconsider. The goal is not to outsmart a professional burglar. The goal is to look like more trouble than the alternatives.

If you are renting and feel like your space is not as secure as it should be, you have more options than you think. Start with the basics, add what makes sense, and do not overthink it. Most improvements take less than ten minutes to set up and cost less than a month of streaming subscriptions.

You do not need permission to make your home safer.

Explore more Home Security guides for related tips, tools, and reviews.

Renters are often told they cannot do much to improve security, but small upgrades can make a huge difference. If this guide gave you a few good ideas, share it with someone renting their home or apartment

Michael Kendrick

Director of IT and former Certified Registered Locksmith with 27 years in technology and cybersecurity. Practical, everyday guidance to help you protect everything from the locks on your doors to the logins on your accounts.

Keep Learning: More Security Guides

Identity Theft 101: How to Protect Yourself

05/09/2026

Identity theft affected over 1.1 million Americans in 2024 alone. This plain-English guide explains how identity theft happens, the warning signs to watch for, and the exact steps you can take

Smart Home Device Privacy: What They Collect and How to Stop It (2026)

05/09/2026

Smart home devices are convenient, but they can also be surprisingly chatty. From voice assistants to robot vacuums, here is what your devices actually collect, who sees that data, and practical

Home Wi-Fi Security: 10 Steps to Lock Down Your Network (2026)

05/09/2026

A few small changes can make a big difference in your Wi-Fi security. Learn how to protect your home network, boost performance, and keep cybercriminals out with these practical steps.

5 Easy Ways to Secure Sliding Glass Doors

Michael Kendrick — Sat, 07 Feb 2026 18:26:03 +0000

How to Secure Sliding Glass Doors

I love my sliding glass doors in my dining area. They let in a ton of great natural light and give me easy access to my grill and backyard. They’re also one of the first places someone checks when looking for an easy way into your home.

That factory installed latch? It’s doing the bare minimum. The large glass panel? Vulnerable. The track? In many cases, the door can literally be lifted right out of it.

But here’s the good news: learning how to secure sliding glass doors doesn’t require a complete replacement or a huge budget. A few straightforward upgrades make a massive difference, and most of them take minutes to put in place. These simple upgrades are some of the most effective ways to secure sliding glass doors without major changes.

Why Sliding Glass Doors Get Targeted

Think about where your sliding door is located. For most homes, it’s around back or on the side, tucked away from street view and neighbor sightlines. That privacy and seclusion you enjoy? Someone planning a break-in would enjoy it too.

Add in a flimsy factory lock, a large breakable surface, and the fact that many doors can be physically lifted off their tracks, and you’ve got what burglars call a “soft target.”

The solution isn’t tearing out the door. It’s layering simple, effective security measures that transform your sliding glass door from an open invitation to a reinforced obstacle.

Making two or three of these changes can go a long way toward securing your sliding glass door.

Step 1: Block the Track (The Easiest Win)

Placing an obstruction in the track is the lowest-effort, highest-impact move you can make.

Grab a wooden dowel, a metal security bar, an adjustable tension rod, or even cut down an old broom handle you were going to toss out, and place it in the bottom track on the inside of the door. When the door is closed, the bar prevents it from sliding open, even if someone defeats the factory lock.

One option is to pick up an adjustable sliding door security bar made specifically for this purpose. These bars are sturdier than a dowel and easy to remove when you actually want to use the door.

This step alone stops a huge percentage of sliding door break-ins. It’s cheap, fast, and works immediately.

Step 2: Add Another Lock (Don’t Rely on Factory Locks)

That little latch that came with your door? It’s there to keep the door from rattling in the wind, not to stop a break-in.

Adding a secondary lock creates a physical barrier that’s much harder to bypass quietly. Here are the most common options:

Foot locks mount near the bottom of the door and anchor it to the frame or floor. Once engaged, the door can’t slide, period. Some models let you crack the door a few inches for airflow while still locking it in place, which is handy on nice days.

Keyless multi-position sliding door locks mount on the inside and give you several preset stopping points. You can lock the door fully closed or leave it open just enough for ventilation without worrying someone will force it the rest of the way open. No keys required, and they work great for families with kids or pets.

Pin locks are the simplest option. You drill aligned holes through the sliding door frame and insert a removable pin. When the pin is in, the door physically cannot move. Dirt cheap, dead simple, surprisingly effective.

Pick whichever makes sense for your setup, but don’t skip this step. The factory lock should never be your only line of defense.

Step 3: Stop the Lift-Out Trick

Here’s something most people don’t know: many sliding glass doors can be lifted straight up and out of the track. If you’ve never adjusted or secured the top of your door, there’s a good chance yours is one of them.

The good news, fixing this is easy:

Install anti-lift devices designed specifically for sliding doors
Add small screws into the upper track to limit how much vertical lifting clearance the door has. When I worked as a locksmith, I’d carry a bulk pack of self-tapping screws and washers for exactly this. Just slide the door out of the way, stack 1 to 3 washers on a self-tapping screw depending on how much gap you’ve got, and drill it into the upper track. The idea is when the door is lifted, it bumps into this and keeps it from lifting high enough to drop over the side of the rails. Which is how you take the entire door off the rails. Make sure and eave enough room for the door to slide smoothly.
Adjust the door’s rollers so the door sits higher in the frame. Most sliding doors ride on small wheels at the bottom. Over time these wear down or get misadjusted, which causes the door to sag slightly and creates extra space at the top. Near the bottom edge of the door, usually behind small plastic caps, are adjustment screws. Turning these raises the door on its rollers. You want to raise it just enough that there is very little upward movement, without making the door hard to slide.

This step gets overlooked constantly, but it closes a huge vulnerability. Don’t skip it.

Step 4: Reinforce the Glass (If It Makes Sense)

Glass is glass. Even when it’s tempered, it breaks.

One option is security window film, which holds shattered glass together and makes it harder to create a clean opening. It doesn’t make the glass unbreakable, but it can slow down a break-in, creating noise, resistance, and most importantly, time for you or your neighbors to react to the sounds of glass breaking.

Is it worth it? That depends on your situation. If you want the full breakdown on when security film actually makes sense and when it’s overkill, check out our guide on does security window film work to see if it’s worth the investment.

For most people, the other steps on this list are higher priority. But if you’re in a higher-risk area or just want that extra layer, film is worth considering. Security film can be tricky to install properly without bubbles or gaps, so this is one upgrade where professional installation may be worth the extra cost.

Step 5: Light It Up and Cut Back Cover

A well-lit, visible sliding door is way less appealing than one hidden behind overgrown bushes and total darkness.

Here’s what helps:

Motion-activated lighting near the door
Trimmed landscaping that doesn’t create hiding spots
Strategic use of blinds or curtains, especially at night when interior lights make you visible from outside

The goal isn’t to turn your backyard into a floodlit stadium. It’s to remove easy cover and increase the odds that someone will be seen.

If you want to go deeper on outdoor lighting strategy and which types of lights work best for security, check out our full guide on outdoor lighting basics.

Make It Part of Your Routine

When you’re leaving for work, heading out for the evening, or going on vacation, your sliding door should be part of your mental checklist.

Before you go:

Lock the door (obviously)
Drop the track blocker in place
Position blinds or curtains thoughtfully
Double-check that any secondary locks are engaged

If you’re leaving town, this pairs perfectly with a broader vacation security routine. Check out our full guide on vacation home security basics to make sure your whole home is locked down.

Do You Need to Replace the Door?

In most cases, no. Replacement only makes sense if the frame is damaged, the door can’t be properly adjusted, or the lock mechanism is completely shot. But for the vast majority of sliding glass doors, the upgrades in this guide are more than enough.

A properly secured sliding door with layered protection is not an easy target. And that’s really all you need to be: harder to break into than the next house.

Final Thoughts

So for those wondering how to secure sliding glass doors, the answer isn’t complicated. You don’t need to replace the door or spend a fortune. You just need to layer simple, effective upgrades that address the real vulnerabilities: the weak factory lock, the ability to lift the door out, and the lack of any real barrier in the track. Addressing these three vulnerabilities is the most effective way to secure sliding glass doors using methods that reflect how they are actually broken into.

Start with a track blocker. Add a secondary lock. Prevent lift-out. Those three steps alone put you ahead of most homes.

If you want to go further, you could reinforce the glass or improve lighting and visibility. Every layer makes it harder for someone to get in quickly and quietly, and that’s usually enough to make them move on to an easier target.

Remember, most break-ins are crimes of opportunity. Criminals are looking for the path of least resistance. The harder you make your home to get into, the more likely they’ll decide it’s not worth the effort and move on looking for an easier score.

The goal isn’t perfection. It’s making your sliding glass door enough of a pain that it’s not worth the trouble. And with the steps in this guide, you’ll get there fast.

Explore more Home Security guides for related tips, tools, and reviews.

Sliding glass doors are a common weak spot in home security, but a few simple fixes can make a big difference. If this helped, share it with someone who could use the tips.

Michael Kendrick

Keep Learning: More Security Guides

Home Security for Renters: No-Drill Options That Work

05/09/2026

Home security for renters does not require drilling or permanent changes. Learn no-drill security options that improve safety without breaking lease rules.

Smart Home Device Privacy: What They Collect and How to Stop It (2026)

05/09/2026

Smart home devices are convenient, but they can also be surprisingly chatty. From voice assistants to robot vacuums, here is what your devices actually collect, who sees that data, and practical

Home Wi-Fi Security: 10 Steps to Lock Down Your Network (2026)

05/09/2026

A few small changes can make a big difference in your Wi-Fi security. Learn how to protect your home network, boost performance, and keep cybercriminals out with these practical steps.

How to Tell If Your Email Has Been Hacked

Michael Kendrick — Mon, 02 Feb 2026 02:32:59 +0000

If you believe your email has been hacked, stop and change your password immediately. Not after this article. Not in five minutes. Do it first, then come back. We will still be here. For the recovery checklist, jump to the action steps below.

Email security is something I take seriously because it is the reset key for almost every online account you have. If someone else has access to it, they do not need to rush or make noise. They can quietly watch incoming messages, reset passwords elsewhere, and lock you out later.

In over two decades working in IT, I have helped multiple people recover hacked email accounts. The pattern is almost always the same. Small signs get ignored, one account gets compromised, and then the damage spreads to bank accounts, shopping profiles, and social media. The good news is that catching it early, even minutes after the first warning sign, often stops the attack in its tracks.

In this guide, I will walk through the clear signs to tell if your email has been hacked, how attackers usually get access, exactly how to check whether your email has been exposed, and what to do about it.

How to Confirm a Hacked Email in Under 2 Minutes

Your email may be hacked if you notice key warning signs like being unable to log in, receiving password reset emails you did not request, seeing login alerts from unfamiliar devices or locations, finding messages in your Sent folder that you did not write, or discovering forwarding rules and recovery settings you did not create.

You can quickly confirm this in under two minutes by checking your recent login activity, reviewing your Sent folder, and inspecting your forwarding rules, filters, and recovery options for anything unfamiliar.

If you suspect a compromise, act immediately. Change your password from a trusted device, enable two-factor authentication, sign out of all active sessions, and review connected apps and account settings to remove anything you do not recognize.

10 Warning Signs Your Email Has Been Hacked

Most email compromises are discovered through small clues, not obvious takeovers. Some of these signs are unmistakable on their own. Others are more subtle and matter most when you see them together. Either way, take any warning sign seriously and investigate. Watch for these red flags:

You can’t log in with your normal password
If your usual password suddenly stops working and you did not change it, someone else probably did. This is the most obvious sign of a full account takeover. Attackers often change the password as soon as they get in to lock you out while they work through your inbox.
Password reset emails you did not request
If you are getting password reset emails from sites you did not try to log into, someone is testing your email to see what other accounts you have. This usually means an attacker already has access to your inbox and is using it as a springboard to take over your other accounts.
Login alerts from unfamiliar devices or locations
Security alerts showing logins from a city, country, or device you do not recognize are a strong indicator of compromise. Occasional false positives happen, especially when you travel or use a VPN, but repeated alerts or alerts from far-away locations should never be ignored.
Emails in your Sent folder you did not write
One of the clearest signs of a hacked account is finding messages in your Sent folder that you did not send. Attackers use hijacked accounts to send phishing emails to your contacts because messages from a known address are more trusted. Be aware that careful attackers delete these after sending, so an empty Sent folder is not proof you are safe.
Messages marked as read or deleted that you never opened
If emails you were expecting have disappeared or show as read before you saw them, someone else may be reading and managing your inbox. This is especially concerning if password reset or bank alert emails are the ones going missing.
New forwarding rules, filters, or recovery settings you did not create
This is one of the most common things I personally have seen. Attackers often set rules that automatically move incoming messages to the Deleted folder so you do not start receiving replies from people asking whether a suspicious email you sent is legitimate. They also want to prevent you from seeing a barrage of auto-replies, since those responses can quickly alert you that your account is being used to send bad emails to your contacts. Always check your forwarding rules, filters, and recovery email address for anything you did not set up yourself.
Contacts reporting strange messages from you
If friends, family, or coworkers ask whether you really sent a weird link or an out-of-character message, take it seriously. Attackers commonly use hijacked accounts to phish people in your contact list. Your contacts are often the first to notice a compromise before you do.
Two-factor authentication prompts you did not trigger
If you get a 2FA push notification or code when you are not trying to log in, someone else has your password and is actively trying to get past your second layer of defense. Never approve a 2FA prompt you did not initiate. Repeated prompts can also be a “push fatigue” attack where the attacker hopes you will approve one out of frustration. If you are not already using it, read Two-Factor Authentication 101 to understand how to properly secure your accounts.
Unfamiliar apps or services connected to your account
Most major email providers let you see a list of third-party apps and services that have access to your account. If you see apps or services you did not authorize, an attacker may have given themselves persistent access so they can keep reading your mail even after you change your password. Revoke anything you do not recognize.
Your device is suddenly slow or acting strangely
If your computer or phone has become noticeably sluggish, crashes more often, or your browser redirects you to unexpected sites, malware may be on the device. Keyloggers and info-stealers are common ways credentials get stolen in the first place. If your email was hacked and you are not sure how, your device itself may be the source of the leak.

Even a single warning sign is worth taking seriously. Changing your password takes a few minutes, but using a strong one matters just as much. If you are unsure what a secure password looks like, read Password Security 101. Recovering a fully hijacked account can take days, and the damage to your connected accounts can take weeks to unwind. If something feels off, trust that instinct and move on to the next steps.

Stop a Hack Before It Happens

The best time to secure your email is before anything goes wrong. Two-factor authentication is the single most effective step you can take to keep your account out of an attacker’s hands, even if your password gets stolen. It takes about five minutes to set up and blocks the vast majority of email takeovers.

Is Your Email Actually Hacked, or Just Acting Weird?

When you notice something strange, the biggest thing to remember is not to panic. Over the years, I have lost count of how many times I saw an odd login alert or a strange log entry and thought, “Okay, this is it, this is the big one.” Almost every time, it turned out to be something thankfully pretty boring. A phone that reconnected on a different network. Someone logging into a shared account from a new device. An email client syncing from a backup app I had forgotten about. Panic makes you skip steps and miss obvious explanations, so take a breath before you assume the worst.

Before you dive into recovery mode, run through this quick check.

Ask yourself:

Did I recently log in from a new device, airport, hotel, or new phone?
Did I install a new email app or connect my email to a new service?
Was I traveling when that “unusual login” notification came in?
Have I been sharing my account with a family member who logged in somewhere new?
Did I recently use a VPN, which can make logins appear from a different city or country?

If the answer to any of these is yes, the alert is probably legitimate activity. If none of these fit, or you are seeing multiple warning signs stacking up, take it seriously and move on to the next steps.

One strange email can be a coincidence. But add to that a new forwarding rule or a login from another country, and now you have a pattern. Your job is to tell the two apart calmly.

How Attackers Usually Get Access

Email accounts are rarely hacked through brute force. In most cases, access is handed over without the victim realizing it.

Common ways this happens:

Phishing emails that look like shipping notices, invoices, or security alerts
Fake login pages that closely resemble your email provider
Malware on a device that captures saved credentials
Public Wi-Fi attacks that intercept login credentials, or attacks on an unsecured home Wi-Fi network
Reused passwords exposed in data breaches, fed into credential stuffing attacks

One of the simplest ways to reduce your exposure on unsecured or public networks is to use a VPN to encrypt your connection before logging into sensitive accounts.

Many email compromises start with phishing messages that look completely legitimate. Test your ability to spot bad emails with the 6-question quiz located in the article, How to Spot Scam Emails.

What a Hacker Can Actually Do With Your Email

Understanding what is at stake helps explain why acting fast matters.

Once someone has access to your email, they can:

Reset passwords on your bank, shopping, and social media accounts
Read years of old messages for personal information, account numbers, and answers to security questions
Send phishing emails to your contacts while pretending to be you
Set up hidden forwarding rules so they keep seeing your mail even after you change the password
Lock you out by changing the recovery email and phone number
Sell access to your account on criminal forums so someone else can use it later

The scariest part is how quiet this can be. Many email compromises go undetected for weeks because a careful attacker does not want to tip you off. They just want to read, wait, and strike when the timing is right.

How to Check If Your Email Was Exposed in a Data Breach

One of the easiest ways to assess risk is to check whether your email address has appeared in known data breaches. This does not mean your email has been hacked, but it does indicate your address and possibly a password were exposed somewhere online.

Have I Been Pwned

Have I Been Pwned is a widely trusted breach notification site used by security professionals, companies, and governments.

How to use it:

Go to the site
Enter your email address
Review any breaches listed

Why this matters:

It shows which services were breached and when
It helps identify password reuse risk
It does not require you to enter a password

If your email appears in multiple breaches and you reused passwords, your email account is at higher risk even if nothing looks wrong yet.

Google’s built-in Dark Web Report

If you have a Google email address, you can also use Google’s built-in Dark Web Report to monitor for data breaches.

If you use a non-Google email address, such as Outlook.com, you can still use this feature by adding and verifying that email in your Google account, but the experience is more limited.

This is especially useful if your email is tied to a large number of online accounts.

Why You Should Test Your Email Even If Nothing Seems Wrong

Most compromised accounts show no obvious symptoms at first. Attackers often wait before taking action, especially if the email can be used to reset other accounts.

Checking your email against breach databases helps you:

Understand your exposure history
Decide whether a password change is urgent
Prioritize securing high-risk accounts

Even if no breaches are found, confirming that gives peace of mind.

What To Do If Your Email Has Been Hacked

If you have not already changed your password, do that first. Then work through this checklist:

Immediate actions to secure account:

what to do

Change your email password to something completely new and unique
Enable two-factor authentication if it is not already on
Log out of all active sessions in your email provider’s security settings
Review and remove any third-party apps or services connected to your email account that you do not recognize

Within the next hour:

Review recent login activity if your provider shows it
Check recovery email addresses and phone numbers for unauthorized changes
Look for unfamiliar forwarding rules or filters in your email settings
Review and change passwords on your most important accounts (banking, shopping, social media)
Scan your primary device for malware using Windows Defender, Malwarebytes, or your device’s built-in security tools
If your email provider supports it, enable login and security alerts so you are notified immediately of new sign-ins or account changes
If suspicious emails were sent, let your contacts know your email has been hacked so they do not interact with any recent messages
Contact your email provider through their official support or account recovery process to report the compromise
After changing your password, take a moment to review and update your security questions

Do not skip the recovery options. Attackers often change those first so they can regain access even after you secure your account.

What Not To Do If Your Email Is Hacked

Do not keep using the same password after regaining access
Do not approve two-factor authentication prompts you did not start
Do not click recovery links from emails unless you are sure they came from the provider
Do not assume changing the password is enough without checking forwarding rules, filters, recovery options, and connected apps
Do not delete the email account unless you are sure it is no longer tied to important logins

What If You Are Locked Out Completely

If your email has been hacked and the attacker changed your password so you cannot get back in, you need to quickly follow these steps.

Immediate steps:

Use your email provider’s account recovery process right away
Have your phone ready for verification codes
Prepare backup email addresses or security questions
Contact your email provider’s support directly if automated recovery fails

While locked out:

Change passwords on your most critical accounts, even if they do not use your email address for login, prioritizing banks, credit cards, investment accounts, and other financial services
Enable login alerts on financial accounts
Monitor your bank and credit card statements closely
Consider placing a fraud alert on your credit report if the compromise seems serious

Time matters here. Most providers give you a window to recover your account before permanent changes take effect.

How to Check Your Email for Hacker Activity (Step by Step)

The major email providers all give you the tools to investigate. Here is where to look.

Gmail

Scroll to the bottom of your Gmail inbox on a computer and click “Details” to see recent activity, including IP addresses and device types
Go to myaccount.google.com/security and review “Your devices” and “Recent security activity”
Check Settings > Forwarding and POP/IMAP for unknown forwarding addresses
Check Settings > Filters and Blocked Addresses for rules you did not create

Outlook (formerly Hotmail)

Go to account.microsoft.com and select “Security” then “Sign-in activity”
In Outlook webmail, go to Settings > Mail > Forwarding and Rules to check for unauthorized entries
Review “Recent activity” for unfamiliar locations or devices

Yahoo Mail

Go to login.yahoo.com/account/activity to see recent sign-in activity
In Yahoo Mail settings, check “Filters” and “Vacation response” for unfamiliar rules
Confirm your recovery phone number and email address have not been changed

If you see anything unfamiliar in any of these areas, treat your account as compromised and work through the recovery checklist above.

Lock It Down So It Does Not Happen Again

Once you regain control, focus on preventing a repeat.

Core security steps:

Enable two-factor authentication on your email account
Use a unique password that is not used anywhere else
Store passwords in a reputable password manager
Review and remove unused third-party app connections in your account settings
Set up login alerts so you know immediately if someone else tries to access your account

Build better habits:

Be cautious with urgent or threatening emails
Verify sender addresses before clicking links
Never enter your password on a page you reached by clicking a link in an email
Keep your devices updated and run regular security scans

If you only take one step from this list, make it two-factor authentication. It adds a critical layer of protection even if your password is compromised.

For a full breakdown of how two-factor authentication works and why it matters, read Two-Factor Authentication 101: Your Second Line of Defense.

Using a password manager makes it much easier to use strong, unique passwords without having to remember them all. For a clear explanation of how they work and why they matter, read Password Managers 101: What They Are and How They Work.

Why Email Is the Master Key to Your Online Life

Email controls password resets for:

Banks and credit cards
Social media accounts
Shopping sites and retail accounts
Cloud storage and subscriptions
Work accounts and professional services
Medical portals and insurance accounts

If your email has been hacked successfully, they can quietly expand access elsewhere without touching those accounts directly. They reset passwords, intercept verification codes, and move through your digital life methodically.

This is why email security is not just about protecting your inbox. It is about protecting everything connected to it.

When to Take This Further

You should escalate if you notice:

Financial alerts or unauthorized purchases you did not make
Multiple accounts locked or compromised beyond just email
Continued login attempts after securing your account
Identity theft warning signs like new credit inquiries or accounts in your name, which is when you should freeze your credit at all three major bureaus (plus the 4th everyone forgets)
Threats, blackmail, or harassment using information from your email

For financial issues, contact your bank and credit card companies immediately.

If your email compromise leads to identity theft signs, you may need to take additional protective steps. For a practical starting point, see Identity Theft 101: Identity Protection Starter Guide.

For ongoing harassment or threats, document everything and consider contacting local law enforcement.

Final Thoughts

Discovering your email has been hacked is unsettling, but it is rarely unfixable. In my experience, people who catch it in the first hour usually recover with nothing worse than an inconvenience. People who wait days find themselves unwinding bank fraud and locked social media accounts.

If you are dealing with a compromise right now, the priorities are simple. Change your email password from a device you trust, turn on two-factor authentication, and work through the action steps in this guide to lock out the attacker and check for anything they left behind. Time matters more than perfection here. Get the account secured first, then circle back to clean up recovery options and connected apps. Read Password Security 101 if you need help creating a strong password.

If you are not actively compromised but you landed here because you want to stay ahead of this, focus on prevention. Enable two-factor authentication on your email today if you have not already. Run your address through Have I Been Pwned to see your breach history. Start using a password manager so you are not reusing passwords across accounts. These three steps prevent the vast majority of email takeovers before they ever happen.

Your email is the single most important account you own online. Everything else, from banking to shopping to work to social media, resets through it. Treat it like the master key it is.

If you found this helpful, the best next step is to strengthen the account before something goes wrong. The guide Two-Factor Authentication 101 walks through exactly how to set up the extra layer of protection that stops most email attacks cold.

Explore more Online Security guides for related tips, tools, and reviews.

Hacked Email FAQ

What are the signs that my email has been hacked?

Two-Factor Authentication 101: Your Second Line of Defense

Michael Kendrick — Sun, 25 Jan 2026 02:46:20 +0000

If someone got hold of your password right now, how long would it take them to get into your email, your bank, or your social media accounts? If the answer is ‘instantly,’ you have a problem, but thankfully there is a fix. Two-factor authentication, or 2FA, is one of the most practical security upgrades any regular person can make, and it does not require being a tech expert. This guide covers exactly what it is, why it matters, and how to turn it on today.

What Is Two-Factor Authentication?

Two-factor authentication (2FA) is a login security method that requires two separate forms of identity verification before granting access to an account. The first factor is typically your password. The second is something only you can access in the moment, such as a code from an authenticator app, a text message, or a physical security key. Even if someone steals your password, they cannot log in without that second factor.

A simple way to picture it: imagine your account is a castle with two guards at the gate. The first guard checks your password. The second guard checks your phone for a one-time code. A thief might steal your password, but without your phone, they are stopped cold at that second checkpoint.

2FA vs. MFA: Clearing Up the Confusion

Two terms get thrown around interchangeably here, and it is worth knowing the difference. 2FA stands for Two-Factor Authentication, meaning you use exactly two different kinds of proof to log in. MFA stands for Multi-Factor Authentication, meaning two or more. All 2FA is MFA, but not all MFA is 2FA. In everyday conversation people use them the same way, and for most people the distinction does not matter much.

Those “factors” fall into three basic categories: something you know (like a password), something you have (like your phone or a security key), and something you are (like a fingerprint or face scan). 2FA just means combining any two of them.

A typical login looks like this: you enter your password, then enter a short code from an app or a text message. Without both, the login fails. Two checks are better than one.

How the Code Is Actually Generated

When you use an authenticator app, the code you see every 30 seconds is not sent over the internet. It is generated directly on your phone using a shared secret key and the current time. This is called a TOTP code, which stands for Time-Based One-Time Password. Think of it as a combination lock where both you and the website’s server know the same combination sequence, and the sequence automatically rotates every 30 seconds. Because the code only works for that brief window and only on the real website, a hacker who steals it seconds later cannot use it. This is a big part of why authenticator apps are meaningfully more secure than SMS codes.

Why You Need 2FA

During my years working in IT, I’ve seen this same scam play out dozens of times. Here’s how it usually goes: You get an email from someone you know. A customer, a vendor, a coworker, maybe even a friend. It includes their real signature, and sometimes even a forwarded message that makes it look like you were already in the middle of a conversation. Everything looks completely normal.

The email contains a link. You click it, and what appears to be a perfectly legitimate Microsoft 365 login page pops up asking for your email and password. But the site isn’t real. If you look closely at the URL, you’ll see it’s not actually Microsoft.com. It might be something similar, like microsofft-login.com or office365-verify.net. Close enough to fool you at a glance, but not a real Microsoft domain.

You enter your credentials and hit login. Often it fails, because the page is only there to capture your email and password. It then redirects you to the real site, where your next attempt works, and you assume you just mistyped something. The more sophisticated versions may not fail at all. They can capture your credentials and log you in seamlessly, so nothing seems out of place.

What often happens is that email came from your contact’s real email address because they got hacked first. Now the hacker is using their account to send the same scam to everyone in their contact list, including you. If you want tips on how to spot these kinds of scams, read my article on identifying scam emails or if you are wondering whether your email is already at risk, read our guide on signs your email has been compromised.

If you don’t use two-factor authentication, the hacker can now just log in and gain complete control of your account. They can read your messages, send emails as you, reset passwords to your other accounts, and continue the cycle by scamming everyone you know in your contact list.

But if you use 2FA? Even though you just gave away your password, the hacker still can’t log in. Why? Because they don’t have your phone. They don’t have that second factor. You dodged a bullet.

That’s the power of two-factor authentication. It’s your safety net for when everything else fails.

Passwords get compromised constantly. Data breaches leak millions of passwords every year. People reuse the same password across multiple sites. Phishing emails like the one I just described trick people into handing over their login credentials. Even strong, unique passwords aren’t bulletproof.

Microsoft has reported that accounts with MFA enabled block more than 99.9% of automated credential attacks. That figure comes from their own analysis of account compromise incidents across their platform.

What 2FA Protects You From

Someone who phished your password. Like in our example above, you fell for a fake login page. With 2FA, the hacker gets your password but can’t do anything with it.

Someone who bought your password on the dark web. After a data breach, your information can be used for identity theft or sold online. With 2FA, that stolen password is practically worthless.

A family member, ex, or coworker who knows your password. Maybe you shared it once, or they watched you type it. With 2FA, knowing the password isn’t enough.

Credential stuffing attacks. Hackers use automated tools to try stolen username and password combinations across hundreds of sites. 2FA stops these attacks instantly.

What 2FA Cannot Stop

SIM swapping. If you use SMS text messages for 2FA and someone convinces your phone carrier to transfer your number to their device, they can intercept your codes. This is rare but real, which is why SMS isn’t the best option.

Sophisticated targeted attacks. If a skilled hacker is specifically going after you with custom malware, AI-powered scam, or social engineering, 2FA makes their job much harder but not impossible.

Malware on your device. If your computer or phone is already infected with spyware, that malware might be able to steal your second factor too which is why keeping your devices updated, running basic security software, and securing your home network still matters. This is especially true for smart home devices, which collect and share more data than most people realize. Our smart home device privacy guide covers what they collect and how to lock things down.

Even with its limitations, 2FA remains one of the most effective security upgrades you can make. It isn’t perfect, but it is far more secure than relying on passwords alone and will stop the vast majority of account takeover attempts, even if your password is compromised.

"2FA is one of the single best security upgrades you can make."

- Michael Kendrick

The Different Types of 2FA (From Weakest to Strongest)

Not all 2FA is created equal. Here are the main types, ranked from least secure to most secure.

SMS Text Message Codes

This is the most common type. When you log in, the site sends a six-digit code to your phone via text message. You type that code into the login screen to prove you have access to that phone number.

Pros: It’s simple. It works on any phone, even flip phones. You don’t need to download an app or buy anything. Most people already know how to receive a text.

Cons: SMS codes are vulnerable to SIM swapping, where a hacker convinces your phone carrier to transfer your number to a new SIM card they control. SMS also requires cell signal, which can be a problem in basements, rural areas, or when traveling internationally. Many security agencies (FBI, CISA) now recommend not using SMS for 2FA when possible, because of interception and other weaknesses.

When it’s okay to use: For low-risk accounts like a forum login or a shopping site you rarely use. It’s better than nothing.

When to avoid it: For your email, banking, or anything tied to money or identity. If you have the option for something stronger, take it.

Email Codes

Some sites send a code to your email address instead of your phone. You check your email and type in the code.

Pros: Works anywhere you can access email. No phone required.

Cons: If someone hacks your email, this method fails completely. It’s also slower than other methods since you have to open a separate app or tab.

Best for: As a backup option only, not your primary 2FA method. If your email itself is protected by a stronger form of 2FA, then email codes for other accounts can work in a pinch.

Authenticator Apps

This is the sweet spot for most people. Authenticator apps live on your phone and generate six-digit codes that change every 30 seconds. You don’t need cell service or an internet connection. The codes are generated locally on your device using a time-based algorithm.

Popular options include Google Authenticator, Microsoft Authenticator, and Authy. They’re all free.

How it works: When you set up 2FA on a website, you scan a QR code with the app. From that point on, the app generates codes for that account. When you log in, you open the app, find the account, and type in the current code.

Pros: Not vulnerable to SIM swapping. Works offline. Free. More secure than SMS. Fast once you get used to it.

Cons: If you lose your phone and didn’t back up the app, you’re locked out. Some authenticator apps (like Google Authenticator) don’t sync across devices by default, though newer versions have added cloud backup. Authy does sync automatically, which is convenient but slightly less secure.

Setup basics: Download the app. When a website offers 2FA, choose the authenticator app option. Scan the QR code. Save the backup codes the site gives you (more on this later). Done.

Best for: This is what I recommend for most accounts for most people. It’s secure, free, and not much harder than SMS once you get the hang of it.

Push Notifications

Some services, particularly Google, skip the code entirely and send an “Is this you?” prompt directly to your phone when someone tries to log in. You tap Yes or No. It is slightly easier than typing a six-digit code and is considered roughly as secure as an authenticator app. The downside is that it requires an internet connection on your phone, and some people have accidentally tapped Yes when they should not have. If you see a push notification you did not trigger, tap No immediately and change your password.

Hardware Security Keys

These are small physical devices, usually a USB stick or something that connects via NFC (near-field communication, the same technology that lets you tap your phone to pay). You plug the key into your computer or tap it against your phone to authenticate.

Popular options include YubiKey and Google Titan. They cost anywhere from $25 to $70 depending on the model.

How they work: When you log in, the site asks you to insert or tap your security key. You do that, and you’re in. No codes to type. No apps to open.

Pros: This is the strongest widely available form of 2FA. Security keys are phishing-resistant, meaning even if you enter your password on a fake site, the key won’t work there because it verifies the actual web address. They have no batteries to die. They’re nearly impossible to remotely hack.

Cons: They cost money. You can lose them (though you should register a backup key). Not every website supports them yet, though major sites like Google, Microsoft, Facebook, and most banks do.

Best for: High-value accounts for people who are comfortable with tech. If you’re protecting financial accounts, business email, or anything where a breach would be devastating, a hardware key is worth the investment. Buy two and keep one in a safe place as a backup.

What About Passkeys?

Passkeys are worth a quick mention here because they are quickly gaining in polularity. The short version: a passkey combines your login and your second factor into a single step tied to your device and your fingerprint or face unlock. They are phishing-resistant by design, which puts them in the same security tier as hardware keys.

For most accounts today, an authenticator app is still your go-to. But passkeys are the direction things are heading, and if a site offers you the option to save one, it is worth doing. For a deeper look at how passkeys work and which password managers already support them, see the Password Manager 101 guide.

Biometrics (Fingerprint, Face Recognition)

Most modern phones and laptops can unlock using your fingerprint or face. Some services use this as part of their 2FA process.

How it works: On your phone or laptop, you verify your identity with your fingerprint or face, and that unlocks access to stored credentials or generates an authentication token.

Pros: Super convenient. Hard to fake (though not impossible). Fast.

Cons: Not always considered true 2FA depending on how it’s implemented. Some systems store your biometric data locally (good), while others send it to a server (less good). If your fingerprint or face scan is compromised, you can’t change it like you can change a password.

Best for: Unlocking your own devices. Pairing with other 2FA methods for an extra layer. Biometrics work well as the first step before your phone generates an authenticator code or uses a security key.

Quick Comparison: 2FA Methods at a Glance

Not sure which method is right for your account? Here is a simple breakdown:

Method	Security Level	Requires Internet?	Cost
SMS text code	Low	Yes (cell signal)	Free
Email code	Low-Medium	Yes	Free
Authenticator app	High	No	Free
Hardware security key	Highest	No	$25-70
Passkey	Highest	Yes	Free
Biometric (device unlock)	Medium-High	Depends	Free

For most people protecting their email and bank accounts, an authenticator app hits the sweet spot of strong security and zero cost.

How to Set Up 2FA on Your Most Important Accounts

You don’t need to enable 2FA on every single account you own. That would be overkill and exhausting. Instead, focus on the accounts that matter most.

Prioritize These First

Email. This is the master key to everything else. If someone controls your email, they can reset passwords to nearly every other account you have. Protect your email first. Gmail, Outlook, Yahoo, whatever you use. Do it today.
Banking and financial accounts. Your bank, credit union, investment accounts, PayPal, Venmo. Anywhere money lives.
Password manager. If you use one (and you should), it holds the keys to everything. Protect it with 2FA.
Social media accounts. Facebook, Instagram, Twitter, LinkedIn. These get hacked constantly and used to scam your friends and family.
Shopping accounts. Amazon, eBay, anywhere that stores your credit card or shipping address.

General Setup Steps (exact steps vary by website, but the process is usually similar)

Log into your account and go to Settings. Look for sections labeled Security, Privacy, Account Settings, or Login & Security.
Find the option for Two-Factor Authentication, Two-Step Verification, or Multi-Factor Authentication. It might also be under Login Verification or Account Protection.
Choose your preferred method. If the site offers authenticator app as an option, pick that over SMS.
Follow the prompts. For an authenticator app, this usually means opening the app and scanning a QR code displayed on the screen.
The site will ask you to enter a code to verify everything is working. Open your authenticator app, find the six-digit code for that account, and type it in.
Save your backup codes. This is critical. More on this below.
Test it. Log out and log back in to make sure 2FA is working correctly.

Quick Platform Notes

Here is where to find the setting on the most common platforms:

Gmail / Google Account: Go to myaccount.google.com, click Security in the left menu, then find 2-Step Verification. Google also supports passkeys if you want to go that route.

Apple ID: Go to Settings on your iPhone, tap your name at the top, then Password and Security, then Two-Factor Authentication.

Facebook / Instagram: In Facebook, go to Settings, then Security and Login, then Two-Factor Authentication. Instagram uses the same path under Settings, then Accounts Center.

Microsoft / Outlook: Go to account.microsoft.com, click Security, then Advanced security options, then Two-step verification.

Banks and financial accounts: Look for Security or Privacy in your account settings. Not every bank supports authenticator apps yet, but all of them offer at least SMS codes, which is better than nothing.

Backup Codes Are Critical

When you enable 2FA, the website usually gives you a set of backup codes. These are one-time-use codes that let you log in if you lose access to your second factor.

For example, if your phone dies, gets stolen, or you drop it in a lake, you won’t be able to generate authenticator codes. Backup codes are your emergency access.

Where to save them: The best place is your password manager. Most password managers have a notes section for each login where you can paste the backup codes. If you don’t have a password manager, get one and store it in there. My Password Manager 101 article is a good next step if you want to learn more about those. If you must print them out, store them somewhere safe like a file cabinet or home safe. Do not leave them in a file on your desktop labeled “backup codes.”

When you’ll need them: New phone. Lost or broken device. Traveling without your usual phone. Factory reset. Switching authenticator apps.

Treat backup codes like a spare house key. You hope you never need them, but you’ll be glad you have them when you do.

Switching Phones? Here Is How to Transfer Your 2FA Setup

One of the most common situations where people accidentally lock themselves out of accounts is getting a new phone without thinking about 2FA first. Here is how to handle it the right way.

Before you switch: First, make sure you have your backup codes saved for every account that uses 2FA. Your password manager is the ideal place for these. If you use Authy, it backs up your codes to the cloud automatically, which makes switching phones much simpler.

If you use Google Authenticator, open the app and look for the option to export your accounts before wiping your old phone. Newer versions of Google Authenticator allow you to transfer accounts to a new device by generating a QR code on your old phone.

After you have your new phone: Download your authenticator app on the new device. If you have your backup codes, you can log into each account, go to the security settings, and set up 2FA again from scratch. It takes about five minutes per account.

If you use Authy, simply install it on your new phone and sign in. Your accounts will sync automatically.

The one rule that prevents all problems: Do not wipe or sell your old phone until you have confirmed 2FA is working on your new phone for your primary email and every other account that matters.

2FA Mistakes to Avoid

Using SMS for your most important accounts. If you have the option for an authenticator app or hardware key, use it. SMS is better than nothing, but it’s the weakest link.

Not saving backup codes. This is how people lock themselves out. Save them. Test them. Make sure you know where they are.

Enabling 2FA but never testing it. Set it up, log out, and log back in to make sure it works. Don’t wait until you’re traveling or using a different device to discover it’s not configured correctly.

Using the same phone number across all accounts. If you rely on SMS codes and someone SIM swaps your number, they get access to everything at once. Diversify when possible.

Forgetting to update 2FA when you change phones. If you switch phones, make sure you transfer your authenticator app or re-register your accounts. Don’t wipe your old phone until you’ve confirmed 2FA works on the new one.

Quick Start: Set Up 2FA Today

Here’s a simple plan to get started right now:

Your email is the best place to start since it controls access to everything else.
Download an authenticator app. Google Authenticator for Android, Google Authenticator for iOS, Microsoft Authenticator, or Authy are all solid free options. Pick one and install it on your phone.
Log into your email account and go to security settings. Look for Two-Factor Authentication or Two-Step Verification.
Choose the authenticator app option and scan the QR code with the app you just downloaded.
The website will show you a set of backup codes. Copy them and save them in a safe place. Your password manager is ideal. If you don’t have one, write them down and put them somewhere secure.
Test it. Log out of your email and log back in. You should be prompted for a code. Open your authenticator app, find the six-digit code for that account, and type it in.
Repeat this process for your bank, social media accounts, and any other important logins.

Start with one account today. Add another one tomorrow. Within a week, you can have your most critical accounts protected. And if you want to take your identity protection a step further, consider freezing your credit at the major bureaus.

Complete Your Security Setup

Done setting up 2FA? The next step is a password manager. It helps you create and store strong, unique passwords for every account, closing the gaps that 2FA alone can’t cover. Read our Password Manager 101 guide to see why they work best together.

Final Thoughts

Two-factor authentication is not a perfect shield, but it is one of the most effective ones available to regular people. The phishing scenario described earlier in this article is not hypothetical. It happens every day in homes, offices, and inboxes across the country. The people who had 2FA in place were protected. The ones who relied on a password alone were not. Protecting your email and other sensitive accounts like banking with 2FA is one of the most important security steps you can take.

While 2FA protects your accounts from being broken into, it does not protect your identity if your personal data is already out there from a previous breach. Once your most important accounts are locked down, consider freezing your credit at the major bureaus. It takes about fifteen minutes and stops anyone from opening new accounts in your name.

If you want to build on this foundation, read the Password Manager 101 guide next. A password manager and 2FA working together will handle the two most common ways people get hacked. Your future self will be glad you did both.

Explore more Online Security guides for related tips, tools, and reviews.

Frequently Asked Questions

What if I lose my phone?

Password Managers 101: What They Are and How They Work

Michael Kendrick — Fri, 16 Jan 2026 04:01:56 +0000

The average person manages somewhere between 70 and 150 online accounts, with some estimates reaching even higher. Email, banking, shopping, social media, streaming services, work logins, and everything in between. Each one needs a password. And if you’re doing it right, each one needs a different, strong password.

That’s impossible to remember. So most people don’t even try. They reuse the same handful of passwords everywhere, maybe adding a number or exclamation point to feel better about it. The problem is, when one site gets hacked and your password leaks, hackers try that same password on every other site they can think of. One breach becomes ten breaches.

This is where password managers come in. They solve the impossible problem of creating strong, unique passwords for everything without having to remember any of them. If you’ve ever wondered what password managers actually are, how they work, or whether you need one, this guide breaks it down in plain language.

What Is a Password Manager?

A password manager is a secure app that stores all your login credentials in an encrypted digital vault. You create one master password to unlock the vault, and the app automatically generates, saves, and fills in your username and password whenever you log into a website or app. You only need to remember one password. The manager handles everything else.

Key things a password manager does:

Stores all your passwords in an encrypted vault
Generates strong, unique passwords for every account
Automatically fills in your login information on websites
Syncs your credentials across all your devices
Alerts you if a stored password appears in a data breach

Why You Need One (The Problem It Solves)

Password reuse is the number one way people get hacked. You might have a strong password, but if you use it on ten different sites and just one of those sites gets breached, that password is now out in the world. Hackers use automated tools to try stolen passwords on thousands of other websites. It’s called credential stuffing, and it works because people reuse passwords.

Your brain simply isn’t designed to remember dozens of complex, unique passwords. Studies show that people can realistically remember maybe seven pieces of random information. Expecting yourself to remember “Kj#9mP2$qL” for your bank, “vN8!rT4@wQ” for email, and 98 other variations is setting yourself up to fail.

This is where password managers become essential. They let you use truly strong, completely unique passwords for every single account without the burden of remembering them. For a deeper look at why password security matters in the first place, check out our guide on Password Security 101: The Keys to Your Kingdom.

The reality is that data breaches happen constantly. Major companies, small websites, and everything in between get hacked. It’s not a matter of if your credentials will be exposed somewhere, it’s a matter of when. A password manager limits the damage to just that one site instead of cascading across your entire digital life.

Your First Step to Better Security

If you want a quick win for your online security, start with a password manager. Our top recommendation is NordPass, and our full review shows you how to get set up step by step.

How Password Managers Work

At the core, a password manager works through one master password. This is the single password you need to remember. When you create your master password, the password manager uses it to encrypt (scramble) all your other passwords into an unreadable format. Only your master password can decrypt (unscramble) them back into usable form.

Here’s what happens step by step when you use a password manager:

First time setup: You install the password manager app on your phone and computer, and add a browser extension. You create your master password. This is the one password you’ll need to remember, so make it strong but memorable.

Adding passwords: When you log into a website, the password manager notices and asks if you want to save that login. Click yes, and it stores the username and password in your encrypted vault. Or, you can manually add accounts.

Logging in later: Next time you visit that website, the password manager recognizes the login page and automatically fills in your username and password. On most sites, you just click the login button and you’re in. On others, you might click a small icon in the password field that fills everything for you.

Creating new accounts: When you sign up for something new, the password manager offers to generate a password for you. These generated passwords are long, random strings like “X9$mK2#pQv8&nL4@rT” that are impossible to guess or crack. You’ll never need to remember them, so you want them to be as complex as possible.

Syncing across devices: Your encrypted password vault syncs to the cloud and across all your devices. Log into your password manager on your phone, and you have access to all the same passwords you use on your computer. Everything stays in sync automatically.

Using on mobile devices: Password managers work seamlessly on phones and tablets. Many support biometric unlock, meaning you can use Face ID, fingerprint, or other biometric authentication instead of typing your master password every time. This makes mobile access fast and convenient while keeping everything secure.

Your Data Is Encrypted

When you store passwords in a password manager, they’re encrypted. Think of encryption like a super-secure lock that scrambles your data into unreadable code. Even if someone got access to the password manager’s servers, all they’d see is gibberish.

Most password managers use something called 256-bit AES encryption. This is the same level of security that banks and governments use. It’s incredibly strong and would take billions of years to crack with today’s technology.

Some password managers go even further. For example, NordPass uses XChaCha20 encryption, which is a newer, even more secure standard that’s particularly good at protecting your data. We dive into the technical details in our full NordPass review.

The important takeaway is that your passwords are scrambled so thoroughly that even the password manager company can’t read them. This is called zero-knowledge encryption, which means only you, with your master password, can unlock and see your stored passwords.

Key Features to Understand

Modern password managers do a lot more than just store passwords. Here are the features you’ll actually use:

Password Generator: Creates random, strong passwords instantly. When signing up for a new account, click the generate button and you get something like “mK9$pL2@vN8#qT.” You’ll never see or type that password again, the manager handles it. Most generators let you adjust the length and choose whether to include symbols.

Auto-Fill: Recognizes login pages and automatically fills in your credentials. On most sites, this happens instantly. On others, you click a small icon in the password field. Either way, you’re not typing passwords manually anymore.

Secure Notes: Stores other sensitive information beyond passwords. You can save credit card numbers, bank account details, passport information, software license keys, or any other text you need to keep secure. All of it gets the same encryption as your passwords.

Password Sharing: Lets you securely share logins with family members or coworkers. Instead of texting someone a password (which is wildly insecure), you share it through the password manager. They get access to the login, but the password itself stays encrypted. You can revoke access anytime.

Emergency Access: Sets up a trusted contact who can access your vault if something happens to you. This is critical for situations like sudden death or medical emergencies. Without this feature enabled, your family can be locked out of important financial accounts, business information, and even personal photos forever. There’s usually a waiting period (you set the number of days) so if you’re just unavailable temporarily, you can cancel the request. But if you’re truly unable to access your accounts, your designated person can get in. This solves the problem of spouses being locked out of deceased partners’ phones and accounts with no way to recover critical information.

Security Audit: Scans your saved passwords and flags problems. It tells you which passwords are weak, which ones you’re reusing across multiple sites, which ones have been compromised in known data breaches, and which accounts don’t have two-factor authentication enabled. Think of it as a checkup for your password health.

Two-Factor Authentication: Adds extra security to the password manager itself. Even if someone somehow got your master password, they still can’t access your vault without the second factor (usually a code from your phone). Definitely turn this on.

Dark Web Monitoring and Breach Alerts: Many paid password managers include a feature that continuously scans known data breach databases and alerts you if any of your stored email addresses or passwords have shown up in a breach. Think of it as a smoke detector for your credentials. Instead of finding out your banking password was leaked when someone drains your account, you get a notification the moment that password appears in stolen data that is circulating online. You can then change just that one password before any damage is done. This feature alone is worth the cost of a paid subscription for many users.

Are Password Managers Safe?

This is the biggest question people have, and it makes sense. You’re putting all your passwords in one place. What if that one place gets hacked?

Here’s the reality: password managers are safe when used correctly, and they’re far more secure than reusing passwords, writing them down, or relying on weak passwords you can remember.

In fact, they’re significantly safer than the habits many people fall back on, like reusing the same password everywhere or choosing passwords that are easy to remember but easy to crack.

The encryption used by reputable password managers means that even if the company’s servers were breached, the attackers would only get encrypted data. Without your master password, that data is useless. It’s like stealing a safe but not having the combination. Companies that make password managers use zero-knowledge encryption, meaning they themselves cannot decrypt your vault even if they wanted to.

Your master password never leaves your device in an unencrypted form. When you type it in, it’s used locally on your computer or phone to decrypt your vault. The password manager company never sees it, never stores it, and can’t recover it if you forget it.

The weak point in a password manager setup is almost always the master password itself. If you make it weak or reuse a password you’ve used elsewhere, that’s a problem. If you write it down on a sticky note and stick it to your monitor, that’s a problem. If you need to write down your master password while you’re learning it, keep it somewhere secure like your wallet, purse, or better yet, a safe. Never leave it visible or in an obvious spot. If you fall for a phishing scam and type your master password into a fake login page, that’s a problem.

But the password manager itself, when used properly, is extremely secure. The math behind modern encryption is solid. There hasn’t been a case of a major password manager being hacked and user vaults being decrypted. Breaches have happened at password manager companies, but the encrypted vaults remained secure.

The realistic threat model is this: you’re far more likely to get hacked through password reuse, weak passwords, or phishing than you are through a properly configured password manager. It’s not perfect, but it’s dramatically better than the alternative.

Free vs. Paid: What’s the Difference?

Most password managers offer both free and paid versions. The free versions are genuinely useful and cover the basics. The paid versions add convenience and advanced features.

Free versions typically include:

- Unlimited password storage
- Password generator
- Auto-fill on one type of device (either mobile or desktop, not both)
- Basic security features

The biggest limitation with free versions is that you’re often restricted to one device type. If you use both your phone and your computer, you’ll need to log out on one and log back in on the other every time you switch. This gets inconvenient fast if you move between devices regularly throughout the day.

Paid versions typically add:

- Sync across all your devices (phone, tablet, computer)
- Secure password sharing with others
- Emergency access features
- Priority customer support
- Advanced security reports and monitoring
- More secure note storage
- Encrypted file attachments

For a single person who mostly uses one device, the free version may be OK. If you want your passwords available everywhere, or if you need to share accounts with family members, paid versions make sense. Most plans are relatively inexpensive, running between $3 and $5 per month for individuals, and family plans that cover multiple people are usually $5 to $8 per month. And with a little searching, it’s about a guarantee you can find an awesome deal for the first year of service, often 50 to 75% off.

There’s no wrong choice here. Starting with a free version and upgrading later if you need more features is a perfectly reasonable approach. I started with NordPass’s free version for a while, but I move around on devices often, so after a while I upgraded to a paid version and I was glad I did as it made everything work much smoother.

The Concerns Worth Taking Seriously

Most worries people have about password managers dissolve quickly once they understand how the technology works. But a few concerns are legitimate and deserve understanding, not just reassurance.

Your Master Password Is the One Thing You Cannot Lose: This is the genuine weak point in the whole system, and it is worth being direct about it. Because of zero-knowledge encryption, there is no password reset option. The company cannot help you. If you forget your master password and have no recovery codes and no emergency access contact configured, you lose access to your vault. Full stop.

I learned about this pain firsthand while testing a password manager. Thankfully it was only a test account with a handful of logins, so the damage was minimal. But resetting that account made it immediately clear how painful that would be with a real personal account holding hundreds of logins. This is not something you want to find out the hard way.

The solution is straightforward. Create a master password that is long, memorable, and completely unique. A passphrase made of random words (like “correct horse battery staple” but personalized to you) works better than a string of characters you will forget. This approach aligns with NIST password guidelines which emphasize length over complexity. Write it down. Store that piece of paper somewhere physically secure like a home safe or a locked drawer, not on a sticky note near your computer. Once you are confident you have memorized it, you can shred it. Also generate your emergency recovery codes during setup and store those in the same secure place.

Finally, set up the emergency access feature. Enter a trusted family member who can access your vault if needed. This not only helps if you forget your password, but also ensures your family is not locked out of critical accounts if something happens to you.

Do these things and the risk drops to nearly zero.

Putting Everything in One Place: The “all your eggs in one basket” concern is the one skeptics raise most often, and it is a fair thing to think about. If someone got into your password manager vault, they would have access to everything.

The reason this concern does not hold up in practice is that the basket is extraordinarily secure. Breaking into a properly encrypted vault protected by a strong master password and two-factor authentication is not a realistic attack vector for anyone targeting a regular consumer. The far more common real-world attack is credential stuffing, where hackers take a password leaked from one site and automatically try it on hundreds of others. Reusing passwords across sites is the actual vulnerable basket. A password manager eliminates that risk entirely.

The math here is not close. The risk of having your vault compromised is much lower than the near certainty of eventually having a reused password exposed in a breach somewhere. The vault you are already using, whether that is your memory, your browser, or a sticky note, is far less secure than what a dedicated password manager provides.

Getting Started: The Basics

If you’re ready to start using a password manager, here’s the simple path forward:

Choose a password manager. Research a few options and pick one that fits your needs. Browser-based options like the ones built into Chrome or Safari are easy to start with. Dedicated apps like NordPass, Bitwarden, 1Password, or Keeper offer more features and security. Our NordPass review walks through one popular option I personally recommend in detail.

Create a strong master password. This is the one password you need to get right. Make it long (12 characters minimum, but I recommend 14 to 16), unique (never used anywhere else), and memorable (you may need to type it often). A passphrase made of random words works well, like “stapler gravity penguin flannel” with some capitalization and numbers mixed in. Read our Password Security 101 Guide for more details on passwords.

Install the apps and browser extension. Download the password manager app on your phone and computer, and add the browser extension to whatever browser you use. Log in with your master password on each device. Most password managers make setup painless and walk you through all the steps.

Start saving passwords gradually. As you log into sites over the next few days, let the password manager save those credentials. Don’t try to add everything at once. Let it happen naturally.

Import existing passwords. Most password managers can import passwords you already have saved in your browser (Chrome, Safari, Edge, Firefox) or from another password manager. This makes the transition much easier. You can usually find the import option in the settings menu. It takes just a few minutes and saves you from manually entering dozens of passwords.

Use the password generator going forward. When you create new accounts or change existing passwords, use the built-in password generator. Let it create long, random passwords that you’ll never need to remember.

Enable two-factor authentication on the password manager itself. This adds an extra layer of security to your password vault. Even if someone got your master password, they couldn’t access your vault without the second factor.

The hardest part is just getting started. Once the password manager is set up and you’ve saved a few passwords, it becomes automatic. You’ll wonder how you ever managed without it.

What Are Passkeys and How Do They Fit In?

Passkeys are a newer type of login credential designed to replace traditional passwords entirely. Instead of typing a password, your device verifies your identity using biometrics like Face ID or your fingerprint, or a PIN stored on your device. The website then confirms the login without a password ever being transmitted over the internet.

This matters for password manager users because you’ll want one that supports passkeys. Most reputable options already do, including NordPass and 1Password. Think of passkeys as the next evolution of passwords. You don’t need to change anything right now, but as more sites adopt them, your password manager will handle the transition automatically. The same vault that stores your passwords today will manage your passkeys tomorrow.

Browser-Based vs. Dedicated Password Managers

Most people already use a type of browser-based password manager without realizing it. When Chrome or Safari asks “Would you like to save this password?”, that is their built-in password manager at work. These built-in tools are convenient and better than nothing, but they have real limitations.

Browser-based managers are tied to one browser. If you use Chrome on your laptop but Safari on your phone, your passwords do not always follow you. They also typically offer weaker encryption, no secure sharing, no emergency access features, and no dark web breach monitoring. If someone gains access to your unlocked browser, they can usually see all your saved passwords in plain text through the browser settings.

A dedicated password manager work across every browser, every device, and every operating system. Your vault follows you everywhere, and the security features are significantly more robust. For most people who use more than one device or browser, the dedicated app is worth the small monthly cost.

What Password Managers Don’t Do

Password managers are powerful tools, but they’re not magic security solutions. They don’t protect you from phishing. To sharpen your ability to spot bad emails, see our How to Spot Scam Emails article. If you’re tricked into entering your credentials on a fake website that looks like your bank, the password manager might not catch it. However, password managers are based on the URL, so if you’re not at the correct URL, it won’t auto-populate your password. For example, if a phishing site uses “bank0famerica.com” (with a zero instead of the letter O) instead of the real “bankofamerica.com,” your password manager won’t fill in anything. This does offer a small amount of additional security against spoofed websites. Get in the habit of always looking at a URL before logging in to a site. This simple habit will help you catch fake sites before you hand over your credentials.

They don’t replace common sense. If someone calls claiming to be from tech support and asks you to share your screen or read out a code, a password manager won’t stop you from making that mistake. You still need to stay skeptical of unsolicited requests.

They’re not antivirus software. Password managers handle credentials, but they don’t scan for malware, block malicious websites, or protect you from viruses. You still need basic security practices like keeping your operating system updated and not downloading suspicious files.

Security is about layers. A password manager is but one important layer that solves the password problem. It works best alongside other security practices like two-factor authentication, antivirus software, VPNs for public Wi-Fi, being cautious about phishing attempts, keeping your operating system and software updated, securing your home Wi-Fi network, and thinking twice before clicking on links or downloading attachments.

Passkeys are also worth knowing about. They go a step further than passwords by eliminating them entirely on sites that support them, and your password manager will handle them the same way it handles your passwords today. Our passkeys guide explains how they work and how to set them up.

Final Thoughts

Password managers solve one of the most common and costly security mistakes people make: reusing passwords across multiple accounts. By storing all your credentials in an encrypted vault and filling them in automatically, they remove the impossible burden of memorizing strong unique passwords for every site you use.

As someone who has spent more than two decades working across both physical security and IT, I can tell you that password managers are a must have for anyone who values their financial accounts, personal data, or digital identity. The tools are affordable, beginner-friendly, and far more secure than anything most people are currently doing.

You do not need to switch everything over in one afternoon. Start with your most important accounts, your email, your bank, and your primary shopping account. Let the password manager save credentials as you naturally log in over the next few weeks. Within a month, most of your accounts will be covered without any heroic effort.

And if you ever suspect your accounts or identity have been compromised, lock things down quickly. Change your passwords, enable two-factor authentication, and consider placing a credit freeze to prevent new fraud.

If you want a strong place to start, our NordPass review walks through one of the most user-friendly options available. And when you are ready to understand the broader picture of how passwords fit into your overall security, the Password Security 101 guide covers everything from creating strong passwords to enabling two-factor authentication.

The only bad move is doing nothing. Pick a password manager, get it set up, and you will have solved one of the biggest vulnerabilities in your digital life.

Explore more Online Security guides for related tips, tools, and reviews.

Password Managers FAQ

Can I share passwords with family?

Is Windows Defender Enough in 2026?

Michael Kendrick — Sun, 11 Jan 2026 23:39:43 +0000

This page may contain affiliate links. If you buy through one, I may earn a commission at no extra cost to you. Learn more.

Short answer: For a cautious solo user who sticks to trusted websites, avoids risky downloads, and keeps good backups, Windows Defender is enough for many people in 2026. But for a shared family PC, a work-from-home setup, or anyone who regularly shops, banks, or manages sensitive accounts online, it often is not enough on its own.

As someone who has worked in IT for years and supported both business and home users, I have seen Windows Defender improve dramatically compared to older versions. In many real-world situations, it now does a solid job stopping common malware and suspicious downloads before they can cause damage.

It is free, built into Windows, and quietly blocks most everyday threats. But the gap between “basic antivirus protection” and “keeping a real household safe” is wider than most people realize, especially in 2026. Modern attacks now focus far more on phishing emails, scam websites, fake login pages, and social engineering than traditional viruses. At the same time, many people are still using Windows 10 systems that no longer receive mainstream support, putting even more pressure on users to rely on safe habits and layered security.

Here is the honest breakdown of when Windows Defender is enough, when it is not, and what actually helps fill the gaps.

A Brief History of Windows Defender

Windows Defender was first released as an anti-spyware tool in Windows XP back in 2006. Since then it’s had many improvements. In Windows 8 (2012) it added full antivirus protection and replaced Microsoft Security Essentials. The version that comes with Windows 11 offers many security enhancements including a focus on AI-powered protection and stronger hardware integration.

The official name is now Microsoft Defender Antivirus, though most people still call it Windows Defender out of habit. For simplicity, we’ll use Windows Defender throughout this article since that’s what most people know it as.

Windows Defender is enabled by default on Windows systems. If you’re considering third-party antivirus, it’s worth knowing that running more than one antivirus at the same time can slow down your PC significantly. The good news is that most modern antivirus software will automatically disable Windows Defender when you install it, so you don’t have to worry about conflicts.

How to Check If Windows Defender Is Active

Before you can decide whether Defender is enough for you, it helps to confirm it’s actually running. Here’s how to check in a few seconds.

On Windows 10 or 11, click the Start menu and search for “Windows Security.” Open the app and look at the main dashboard. If you see green checkmarks next to Virus and threat protection, Firewall and network protection, and Account protection, you’re in good shape. If anything shows a yellow warning or red X, click into it to find out what needs attention.

If you have third-party antivirus installed, it will automatically disable Windows Defender and take over protection. That’s normal and expected. The dashboard will still show a green checkmark under Virus and threat protection, but if you click into that section you’ll see your third-party tool listed as active, with Defender shown as turned off underneath it. The green checkmark just means something is covering that area, not necessarily that Defender is the one doing it.

The situation to watch out for is if you previously installed a third-party antivirus and then uninstalled it. Defender doesn’t always re-enable itself right away when that happens. Windows will usually alert you if nothing is protecting your system, and a Windows update will often kick Defender back on automatically, but neither of those things is guaranteed to happen immediately. A messy uninstall can also leave behind registry entries that make Windows think the old product is still active when it isn’t. It takes about 30 seconds to open Windows Security and confirm Defender is running, and that’s a better bet than assuming everything sorted itself out.

Windows Defender vs. Bitdefender: Which Is Better?

If you’re weighing whether to stick with Defender or pay for something better, Bitdefender is the most common upgrade people consider, and for good reason. It’s consistently one of the top performers in independent lab tests, it’s reasonably priced for home use, and it doesn’t slow your machine down in any noticeable way. Here’s how the two actually stack up on the things that matter most for everyday home use.

Feature	Windows Defender	Bitdefender
Cost	Free	~$59.99 per year (intro price)
Malware detection	Strong	Excellent, top lab scores
Phishing protection	Edge only	All browsers
Web filtering	Basic, Edge dependent	Advanced, browser agnostic
Ransomware recovery	Limited	Included with rollback
Real-time threat blocking	Yes	Yes, more aggressive
Zero-day threat detection	Adequate	Consistently top rated
Browser extension	No	Yes, flags risky links
Alerts and guidance	Minimal	Clear, plain-language
Performance impact	Very light	Light, minimal slowdown
Multi-device license	Windows only, per device	Up to 3 or more devices

The biggest practical differences come down to web protection and ransomware recovery. Bitdefender’s web filtering works across every browser, not just Edge, and its ransomware remediation tools give you a real path to recovery if something does get through. Defender handles the basics well, but those two areas are where the gap shows up in real use. That said, Bitdefender isn’t free. If your setup is low risk and you’re comfortable with the limitations outlined above, Defender may be all you need. If you’re on a shared machine, do regular online banking, or use Chrome or Firefox as your main browser, the price difference is easy to justify.

What Windows Defender Does Well

Windows Defender has come a long way from its early days. It’s no longer the bare minimum tool it once was.

Some of its strengths include:

Built in and always on
Automatic updates through Windows Update
Solid protection against common malware
No additional cost or subscription

For basic use like email, light web browsing, and document work, Windows Defender provides a reasonable level of protection. If you’re careful about what you click and avoid questionable downloads, it can be enough.

For more technical users, it often stays out of the way and does its job quietly.

Is Windows Defender Enough for You?

Answer 4 quick questions and get a recommendation.

Question 1 of 4 0%

Which version of Windows are you on?

Where Windows Defender Falls Short

Where Windows Defender tends to struggle isn’t malware detection itself, but everything surrounding it.

Common gaps include:

Limited protection against phishing websites
Minimal safeguards against fake downloads and scam links
Basic ransomware protection without simple recovery options
Fewer alerts and explanations for non technical users

Windows Defender does provide real-time protection, but third-party tools often use more aggressive web filtering and behavioral analysis to catch threats earlier in the chain. Most third-party antivirus products also install a browser extension that flags risky links directly in your search results before you even click them. Defender doesn’t offer this. Also, if something does slip through, Windows Defender’s alerts can be less helpful for people who aren’t comfortable digging through security settings or logs.

In homes where multiple people share the same computer, mistakes are inevitable. One distracted click can undo a lot of baseline protection very quickly, and when that click leads to a leaked password or stolen personal information, the consequences can stretch well beyond your PC. Knowing how identity theft happens and how to spot the warning signs helps you recover faster if something does slip through.

What About Windows 10 Users in 2026?

Windows 10 officially reached end of mainstream support on October 14, 2025. Since then, it no longer receives regular feature updates, only limited security patches through Microsoft’s Extended Security Updates (ESU) program, which runs through October 2026.

If you’re still on Windows 10 in 2026, you should be enrolled in ESU at minimum. Without it, your system isn’t getting the security fixes that block newly discovered threats, and no antivirus can fully make up for an unpatched operating system.

Even with ESU enrolled, Windows 10 is in a weaker position than Windows 11. Windows 11 gets more frequent updates, stronger built-in protections like Smart App Control, and hardware-level security through TPM 2.0 that Windows 10 simply can’t match. If you’re staying on Windows 10 for now, running Defender on its own is a harder sell. Third-party antivirus becomes more important, not less, because it has to cover gaps the operating system is no longer closing on its own. It’s also a good time to make sure the rest of your setup is solid, starting with locking down your home network.

So for Windows 10 holdouts, the answer to “is Windows Defender enough” shifts from “maybe” to “almost certainly not.”

My recommendation: upgrade to Windows 11 as soon as possible. ESU buys you time, but it’s not a long-term plan. Every month you stay on Windows 10, the gap between your protection and the threats you’re facing gets a little wider.

Feature	Windows 10 (2026)	Windows 11
Security updates	ESU only (through Oct 2026)	Full ongoing support
Smart App Control	Not available	Included
TPM 2.0 hardware security	Not required	Required and active
Windows Hello (biometric login)	Available (hardware dependent)	Strongly integrated
Defender strength with stock setup	Adequate, declining over time	Stronger baseline
Third-party antivirus recommendation	Strongly recommended	Situational

How Windows Defender Compares in Independent Tests

Independent testing labs like AV-TEST and AV-Comparatives consistently rate Microsoft Defender as solid and reliable, but not quite top-tier. It scores well in the basics like malware detection and system impact, usually landing in the “good” range. Where it tends to fall behind is in zero-day threat detection (brand-new attacks that don’t match any known malware signature yet) and overall consistency from one test cycle to the next. Leading paid solutions like Bitdefender and Norton typically edge ahead in those areas.

The bigger gap shows up in web protection. Defender’s phishing and malicious site blocking works best inside Microsoft Edge, but it gets noticeably less reliable once you switch to Chrome, Firefox, or any other browser. That matters a lot in 2026, because most modern threats don’t come from classic viruses anymore. They come from scam sites, fake login pages, and phishing links. If you’re browsing mostly outside of Edge, a third-party antivirus with strong browser-agnostic protection fills a gap Defender leaves wide open.

What Happens When Windows Defender Finds Something?

If Defender detects a threat, it will usually quarantine it automatically, which means it moves the file somewhere it can’t do any damage while you decide what to do next. You’ll typically see a notification pop up in the bottom right corner of your screen.

From the Windows Security app, you can review anything that’s been quarantined under Virus and threat protection > Protection history. From there you can choose to remove the threat permanently or, if you believe it’s a false positive (a file Defender flagged by mistake), you can restore it.

The limitation here is that the alerts and options are fairly minimal. If you’re comfortable navigating these settings, that’s fine. If the idea of making that call makes you nervous, a third-party antivirus like Bitdefender typically offers clearer guidance and more hand-holding through the process.

What Third-Party Antivirus Adds

Third-party antivirus software focuses more heavily on prevention. Third-party tools are essentially consumer-grade endpoint protection, which is a term the business world uses for software that defends individual devices from network and web-based threats. This typically includes:

Stronger real time web protection
Blocking malicious websites before they fully load
Better phishing and scam detection
Additional ransomware defenses and rollback features
Clearer alerts and easier to understand guidance

Instead of reacting once a threat appears, tools like Bitdefender and other third-party antivirus programs are designed to reduce the chances of that threat reaching your system at all. That said, no antivirus catches everything, and phishing attacks are specifically designed to trick the person, not the software. Learning how to spot scam emails on your own is one of the most valuable security skills you can build, and it works alongside any antivirus you choose.

For families, remote workers, and anyone handling sensitive information like online banking or personal documents, those extra layers can make a meaningful difference.

Who Actually Needs Third-Party Antivirus

In real-world home environments, most households fall into at least one higher risk category.

You’re more likely to benefit from third-party antivirus if:

Multiple people share the same computer
Online shopping and banking are routine
Links get clicked from email, text messages, or social media
Work files or personal documents live on the same device
Not everyone using the computer is particularly tech savvy

Windows Defender assumes a level of caution that isn’t always realistic. Modern threats are designed to blend in and catch people during normal, everyday use.

Because of that, I personally lean toward recommending additional antivirus protection for most people. I tend to err on the side of caution. I’d rather have more security than I strictly need than find out the hard way that I didn’t have enough.

Free Third-Party Antivirus: Worth It or Not?

There are free versions of third-party antivirus tools available, and some of them are decent. Avast Free and Malwarebytes Free are two that show up often.

The honest take: free third-party antivirus is better than nothing if you’re on a tight budget, but it typically doesn’t include the web protection and phishing detection features that make a paid subscription genuinely worthwhile. You often end up with malware scanning without the browser-level filtering that catches threats before they fully load.

For most households, a solid option like Bitdefender Total Security costs about $59.99 per year for a 5-device license. That works out to roughly $5 a month overall, or about $1 per device each month when covering all five devices. It runs on Windows, macOS, Android, and iOS. For what it adds, that’s a reasonable spend.

Common Mistakes That Antivirus Can’t Save You From

No antivirus, free or paid, can protect you from every mistake. There are a few habits that regularly undo solid security setups.

In my experience, the biggest security problems today are usually not traditional viruses. Most incidents I see involve phishing emails, fake login pages, scam websites, malicious browser notifications, or people being tricked into downloading something unsafe.

Reusing passwords is another big one. If one site you use gets breached and the password you used there is the same one protecting your bank or your email, attackers will try it everywhere. That’s an automated process and it happens fast. No antivirus touches this problem because it’s not a malware issue, it’s a credential issue. A password manager is the fix, and if you’re not sure where to start, our Password Security 101 guide walks through the basics.

Pro Tip: If you want to go a step further, passkeys are beginning to replace passwords entirely on many major sites and are worth understanding.

Clicking links in emails without checking where they actually go is another one. Even a well-configured system can’t stop you from typing your credentials into a fake login page if you land there willingly. Slow down before clicking, and if something feels off, go directly to the website instead. AI-generated phishing messages are getting harder to spot. If you haven’t looked at how AI scams work, it’s worth a few minutes.

Skipping Windows updates is the third one worth calling out. Antivirus patches the surface. Updates patch the foundation. Both matter.

When Windows Defender Really Is Enough

That said, Windows Defender can be sufficient in some situations.

It may be enough if:

You’re comfortable managing security settings
You rarely download new software
You use strong passwords, a password manager, and two-factor authentication (2FA), which adds a second verification step beyond your password
You’re cautious with links and attachments
You keep regular backups of your data

On Windows 11, there’s also Smart App Control to consider. It’s a built-in feature that blocks apps that aren’t verified by Microsoft or a trusted publisher. It won’t stop phishing, but it adds a real layer of protection against untrusted software installs, which is one of the more common ways malware gets on a PC.

My Personal Experience

I run several PCs and often try out new security software on each to test them in real-world conditions. One tool I’ve kept renewing is Bitdefender Total Security, which runs on my PC that doubles as a media center. I’ve been consistently happy with its performance, and it handles everyday protection without getting in the way.

If you want to see exactly what I use, Bitdefender Total Security Individual is where I’d point you. It’s been consistently solid on my machines for everyday protection without slowing anything down. Worth a look if you’re on the fence.

Network Privacy Matters Too

Antivirus is only one part of staying secure online. Network privacy matters too, especially on shared or public connections. For more on securing your home network, check out my guide on Home Wi-Fi Security.

If you want to see how Bitdefender approaches VPN protection, you can read my Bitdefender VPN Review 2025: Speed, Privacy & Value, where I break down how it performs for everyday home use and explain where it falls short compared to other VPNs.

Windows Defender by User Type: Quick Reference

Not everyone uses their computer the same way, and whether Defender is enough really comes down to your specific situation. Use this as a quick gut-check based on how you actually use your PC.

User Type	Recommendation
Careful solo Windows 11 user	Windows Defender is usually enough if you keep backups and practice safe browsing habits
Shared family computer	Add stronger web filtering and scam protection with a third-party security suite
Kids' computer	Use a full security suite plus parental controls and web filtering
Online banking / shopping heavy user	Consider stronger phishing and scam site protection
Windows 10 user	Defender alone is less ideal due to reduced long-term platform security
Work-from-home user	Additional protection can help reduce phishing and credential theft risks
Tech-savvy power user	Defender may be enough when paired with hardened browser settings and strong security habits

Final Thoughts

There is no single answer that fits everyone, and anyone who tells you otherwise is probably trying to sell you something.

Windows Defender provides a genuinely solid baseline. It is free, built into Windows, and for a cautious solo user on Windows 11 who keeps backups, avoids risky downloads, and thinks before clicking, it may be all you need.

Personally, I am comfortable relying on Windows Defender on some systems. For example, I have a PC that is basically just used as a media center. No online banking, no shopping, and very limited web browsing. Defender is perfectly fine there.

But most households are not that simple. Shared family computers, kids downloading games or clicking random links, and systems used for banking or shopping carry a much higher risk. My kids’ shared PC is far more locked down and runs a full security suite with stronger web filtering and scam protection because that extra margin of safety is worth it.

The real takeaway is this: match your antivirus protection to how your computer actually gets used, not how you wish it got used. If that points to sticking with Windows Defender, great. If it points to adding something like Bitdefender on top, that can be money well spent.

No antivirus catches everything. Real security still comes down to good habits: keeping your system updated, using strong passwords and two-factor authentication, avoiding suspicious links, and backing up what matters. Antivirus software is important, but it is only one part of the picture.

The same principle applies beyond your PC. If you have smart devices on your home network, our smart home privacy risks article might be a good next read.

Explore more Online Security guides for related tips, tools, and reviews.

Windows Defender Frequently Asked Questions

Is Windows Defender good enough for most people?

Package Theft Prevention: Protecting Your Deliveries

Michael Kendrick — Fri, 09 Jan 2026 03:12:35 +0000

Package Theft Prevention Starts Here

Most of us have been there. You get the delivery notification while you’re out, and suddenly you’re racing home hoping your package is still sitting on the porch. Most of the time it is, and that relief is real. But package theft is becoming more common as online shopping continues to grow, and that worry shouldn’t be part of every delivery.

Package theft isn’t about sophisticated criminals targeting your home. It’s usually a crime of opportunity. Someone sees an easy target and takes it. The good news? Most package theft can be prevented with some simple strategies that don’t require a security overhaul.

Why Package Theft Happens

Package thieves, often called “porch pirates,” are looking for easy wins. They’re not casing your neighborhood for weeks. They’re driving through, spotting boxes on doorsteps, and grabbing what they can before anyone notices.

Here’s what makes a package an easy target:

Visibility from the street. If a delivery driver can see it, so can a thief.

Predictable delivery times. Mid-morning to early afternoon when most people are at work.

No visible security. No cameras, no doorbell, no signs that anyone’s paying attention.

High traffic areas. Busy neighborhoods where someone walking up to a porch doesn’t look suspicious.

The typical porch pirate isn’t a professional thief. They’re opportunistic, often teens or people looking for quick resale items. That’s why simple deterrents work surprisingly well.

Delivery Tactics That Work

Before you buy any equipment, start with smarter delivery choices. These cost nothing and can dramatically reduce your risk.

Delivery Instructions

Most delivery services let you add special instructions. Use them. Be specific:

“Leave packages behind the planter on the left side of the porch.”

“Deliver to side door, not front door.”

“Place packages inside the screen door.”

Drivers appreciate clear directions, and it gets your packages out of plain sight.

Require Signatures

For valuable items, require a signature. Yes, it’s less convenient. You might need to pick it up at a facility or wait until you’re home. But for electronics, jewelry, or anything over a certain dollar amount, the inconvenience is worth it.

Most carriers let you set signature requirements when you order, or you can set standing delivery preferences with your carrier account.

Use Alternate Delivery Locations

Many retailers and carriers now offer alternatives to home delivery:

In-store or locker pickup. Amazon Lockers, FedEx locations, UPS Stores, and many retailers let you pick up at their location instead of home delivery.

Workplace delivery. If your employer allows it, having packages sent to work eliminates porch exposure entirely.

Neighbor or trusted location. If you have a trusted neighbor who’s home during the day, ask if they’d accept deliveries for you.

These options take planning, but they’re foolproof against porch theft.

Delivery Time Windows

Some services let you choose or narrow delivery windows. If you can be home during a specific window, schedule your deliveries then. You can bring packages inside immediately.

Amazon, for example, offers evening delivery in some areas. UPS My Choice and FedEx Delivery Manager both let you reroute or reschedule deliveries.

Physical Solutions for Your Porch

If you receive regular deliveries and can’t always control timing, consider some physical protection.

Delivery Boxes and Lockboxes

A package lockbox is exactly what it sounds like. It’s a secure container on your porch where drivers can place packages. You unlock it when you get home.

How they work: Most use combination locks or smart locks. The driver places the package inside and closes the lid. The box locks automatically. You unlock it with your code or app.

What to look for:

Weather resistance (rain, snow, heat)
Size that fits your typical deliveries
Anchor points to secure it to your porch or wall
Easy access for delivery drivers

Limitations: Drivers aren’t required to use them. Some will, some won’t. It helps to add delivery instructions mentioning the box. Also, oversized packages won’t fit.

Options range from basic weather-resistant lockboxes with drop-box features where packages drop down into a compartment only you can access with a key (around $180), to simpler large capacity delivery boxes that keep packages out of view even without a lock (around $65). Even a non-locking box significantly reduces theft risk because thieves are far less likely to walk onto your porch and open a container on the chance something might be inside, compared to grabbing an obvious package sitting in plain sight. You can browse more delivery box options to find what fits your porch size and budget. Prices typically range from around $65 to $400 depending on features and size.

Strategic Placement and Camouflage

Sometimes the simplest solution is the best. If you have porch furniture, large planters, or a bench, ask drivers to place packages behind them.

You’re not trying to hide packages from drivers. You’re trying to hide them from the street. A package tucked behind a planter isn’t visible from the curb, and that removes the opportunistic temptation.

If your porch design allows it, a small privacy screen or lattice panel can create a hidden delivery zone that’s still accessible.

Package Decoys

Some people swear by decoy packages. These are fake boxes filled with something heavy (or something unpleasant, if you’re feeling creative). The idea is to waste a thief’s time and make your porch less appealing.

Does it work? It’s not one of my recommendations but some people swear by it.

I can however personally attest to the effectiveness of an unintentional decoy. Years ago, when I had three kids in diapers, I left a particularly nasty bag of biohazard on my front porch late one night, planning to take it to the trash in the morning. That night, before heading upstairs, I glanced out the small octagon window at the bottom of my stairs facing the front yard. Five teens were standing in my driveway, and one was slowly creeping toward my porch, squinting in the darkness to figure out what was on my porch.

I knew exactly what it was. I stood there grinning, watching him sneak up and grab the bag. As they started walking away, I couldn’t contain myself and burst out laughing. They must have heard me because they all sprinted off into the night. The bag was dropped when they ran, and I couldn’t help myself, I flung open the door and shouted “Wait, come back, you dropped it!” still laughing. I never did see those kids again.

If you want to see decoy packages taken to the extreme, check out Mark Rober’s Glitterbomb 3.0 vs. Porch Pirates video. It’s entertaining and oddly satisfying, even if most of us aren’t building NASA-level revenge devices.

The downside of intentional decoys is maintenance. You need to keep the decoy out there, and if a thief takes it, you need to replace it. But when it works, it definitely sends a message.

Cameras and Doorbells

We’ve covered video doorbells and security cameras in other guides, but they’re worth mentioning here because they’re one of the most effective deterrents for package theft.

Video Doorbells

A visible video doorbell sends a clear message: someone’s watching. Even if you’re not actively monitoring every delivery, thieves don’t know that.

Video doorbells also give you real-time alerts when someone approaches your door. You can see the delivery happen, and if someone else shows up after, you’ve got video evidence.

Most doorbell cameras have two-way audio. If you see someone suspicious on your porch, you can speak through the doorbell. A simple “Can I help you?” is often enough to send someone walking.

For more on choosing and using video doorbells, check out our Video Doorbells 101 guide.

Outdoor Security Cameras

If your porch isn’t covered by a doorbell camera, or if you want broader coverage, an outdoor camera aimed at your delivery area adds another layer of protection.

Position the camera so it clearly captures faces and any activity near your packages. Wide-angle lenses are helpful, but make sure the important area (your porch or delivery spot) is in focus.

Like doorbells, the visible presence of a camera is often enough to deter casual theft. For more detailed camera guidance, see our Home Security Camera Tips article.

Signage

A small sign indicating video surveillance can reinforce the deterrent. You don’t need anything dramatic. A simple “Video Surveillance in Use” or “Smile, You’re on Camera” is enough.

Some people worry that signs make them look paranoid. They don’t. They make you look prepared.

Smart Home Integration

If you’ve already invested in smart home devices, you can use them to monitor and protect deliveries.

Delivery Notifications

Most carriers offer delivery notifications via text or app. Turn them on. The moment a package is marked delivered, you’ll know about it.

Pair this with a smart doorbell or camera, and you can visually confirm the delivery and bring it inside quickly.

Smart Lighting

Motion-activated lights on your porch do double duty. They help delivery drivers see where they’re going, and they light up anyone approaching your door.

Thieves prefer working unnoticed. A porch that lights up when someone walks up is less appealing than a dark one.

For more on outdoor lighting, check out our Outdoor Lighting 101 guide.

Smart Locks with Delivery Access

Some smart locks, like those from Yale or August, integrate with delivery services like Amazon Key. With this setup, delivery drivers can unlock your door, place the package inside, and lock it behind them.

This isn’t for everyone. It requires trust in the system and the driver, and it only works with participating services. But if you’re comfortable with it, it’s the most theft-proof option available.

For more on smart locks, see our article Are Smart Locks a Smart Purchase?

What to Do If Your Package Is Stolen

Even with precautions, theft can still happen. Here’s what to do:

1. Confirm It Was Actually Delivered

Check your delivery notifications and tracking info. Sometimes packages are marked delivered but arrive later in the day, or they were delivered to a neighbor by mistake.

Walk around your property. Drivers sometimes leave packages in less obvious spots to keep them out of sight.

2. Contact the Seller First

Most online retailers have policies for stolen packages. Amazon, for example, will often refund or replace stolen items quickly.

Contact the seller, explain what happened, and ask about their policy. Many will resolve it immediately.

3. File a Police Report

Even if the police can’t recover your package, filing a report creates a record. This can help with insurance claims or disputes with the seller.

If you have video footage of the theft, provide it to the police. In some cases, serial package thieves are caught because of video evidence from multiple homes.

4. Contact Your Credit Card Company

If the seller won’t help and the charge was significant, your credit card company might. Many credit cards offer purchase protection or fraud coverage that can apply to stolen deliveries.

5. Check Your Homeowner’s or Renter’s Insurance

Stolen packages are considered theft, and they may be covered under your homeowner’s or renter’s insurance policy. Check your policy and consider filing a claim if the value is high enough to justify it after your deductible.

Long-Term Prevention

Package theft prevention isn’t about one perfect solution. It’s about layers. The more obstacles you create, the less appealing your porch becomes to opportunistic thieves.

Start simple:

Add delivery instructions to keep packages out of sight
Turn on delivery notifications so you can act quickly
Consider a video doorbell if you don’t have one

If theft is a recurring problem in your area, add more layers:

Install a package lockbox
Add or improve outdoor lighting
Set up camera coverage aimed at your delivery area

You don’t need every solution. Pick the ones that fit your situation, your budget, and your level of risk.

The goal isn’t to become a fortress. It’s to stop being the easy target.

Final Thoughts

Package theft is frustrating, but it’s also predictable. Most porch pirates are not targeting you specifically. They are looking for the easiest opportunity. That works in your favor because you don’t need to eliminate risk completely. You just need to make your home harder to access and less appealing, so thieves move on looking for easier targets.

Start with the simple, no-cost steps. Use delivery instructions, enable notifications, and avoid leaving packages in plain sight. For many homes, that alone is enough to stop casual theft.

If you deal with repeated issues, add stronger layers. A visible camera, better lighting, or a secure lockbox can quickly make your home much harder to target.

The goal is not perfection. It’s making your home harder to steal from. Most package theft happens because it’s easy. Take that away, and you significantly reduce your risk.

Explore more Home Security guides for related tips, tools, and reviews.

Passkeys are one of the most important security upgrades most people haven’t made yet. If this guide helped it click, share it with someone who still types their password every day.

Locks to Logins

What Are Passkeys? How They Work and Why They Matter (2026)

Table of Contents

What Is a Passkey?

Why Are Passwords Getting Replaced?

How Do Passkeys Actually Work?

Where Are Your Passkeys Stored?

Synced Passkeys vs Device-Bound Passkeys: What Is the Difference?

Who Supports Passkeys in 2026?

The Big Security Win: Passkeys Can’t Be Phished

What Happens If You Lose Your Phone?

Is a Passkey the Same as Two-Factor Authentication (2FA)?

Are Passkeys the Same as “Sign In with Google”?

How Passkeys Work and How to Set Up

Ready to Set Up Your First Passkey?

What About Passkeys and Password Managers?

What If My Device Does Not Support Passkeys?

The Reality Check: Passkeys Aren’t Perfect Yet

Common Passkey Mistakes (and How to Avoid Them)

Is Your Login Security Up to Date?

What About Shared Accounts and Family Logins?

Final Thoughts

Passkeys FAQ

What is a passkey in simple terms?

How to Spot AI Scams: Deepfakes, Voice Cloning, and the Red Flags Most People Miss

Table of Contents

What Is an AI Scam?

The Numbers Behind the Problem

Real People, Real Losses

How Deepfake and Voice Cloning Scams Actually Work

AI Job Scams: The New Wave of Employment Fraud

Who Gets Targeted Most Often

Why These Scams Work So Well

How to Protect Yourself and Your Family

Free Tools That Can Help You Spot AI Fakes

AI Scam Red Flags to Watch For

Immediate Steps to Take After Realizing It’s a Scam

1. Cut off contact immediately

2. Secure your accounts right away (do this first if you shared login info)

3. Contact your bank or financial institutions

4. Preserve evidence before it disappears

5. Report the incident

Prepare Now, Panic Less Later

A Note on Recovery

What Legitimate Requests Will Never Look Like

Where to Report AI Scams

AI Scam Prevention Checklist

Final Thoughts

AI Scams FAQ

Can scammers really clone someone's voice from a short video or voicemail?

How to Freeze Your Credit and Stop Identity Theft Cold

Table of Contents

Should you Freeze Your Credit?

What is a Credit Freeze?

When you should freeze your credit

How to Freeze Your Credit (All Four Bureaus)

Equifax

Experian

TransUnion

Innovis: The Fourth Bureau

What information you will need

Creating your PIN or password

What happens after you freeze

Prepare Before You Need To

Credit freeze vs fraud alert

How to temporarily unfreeze your credit

Temporary lift

Lift for a specific creditor

What if you lost your PIN or account access?

How to Permanently Remove a Credit Freeze

Downsides and limitations

What about your children

Other consumer databases to consider freezing

Additional steps to take after identity theft

Final thoughts

Credit Freeze FAQ

Does freezing my credit cost money?

Home Security for Renters: No-Drill Options That Work

Table of Contents

Simple Home Security for Renters