A handful of specific habits do most of the work. Here is what they are, and why each one earns its place.
The short answer. Put a unique password on your primary email account, ideally through a password manager. Use an authentication app rather than text message codes. Judge a suspicious message by what it asks for rather than how it looks. Freeze your credit at all three bureaus. And name a trusted contact on your investment accounts.
Most of the Benefit Comes From One Account
Here is the useful thing about online security: you do not have to harden everything at once.
Your primary email account is where password resets for nearly everything else arrive. That makes it the single highest-value place to spend your effort, and it means one change covers more ground than any other change available to you.
That change is a unique password on that account, used nowhere else. If you do nothing else this month, do that.
A Password Manager Solves a Problem Willpower Cannot
The advice to use a different password everywhere is sound and impossible to follow unaided. A password manager makes it straightforward. It generates and stores them, and you remember one.
That one remaining password should be long. Length matters far more than punctuation and substituted characters, so a string of unrelated words is both stronger and easier to recall than something short and full of symbols.
If a manager feels like more than you want to take on, start with the accounts that matter most. Email first, then your financial institutions.
Choosing the Stronger Form of Two-Factor
Two-factor authentication is a real improvement over a password alone, and most people already have some version of it switched on. The upgrade worth making is in which form you use.
Codes sent by text can be redirected if someone persuades a mobile carrier to move your phone number to a different device. An authentication app, or a small physical security key, is not exposed to that. Where your institutions offer it, it is a better choice for email and financial accounts.
One phone call to your mobile carrier to add a PIN or port freeze closes the same door from the other side.
A Simpler Rule for Suspicious Messages
The familiar advice was to watch for bad grammar and odd formatting. There is a newer rule that is both simpler and more reliable: judge a message by what it asks for, not by how it looks.
Anything asking you to move money, change payment instructions, or share a code gets verified by voice, using a number you already had from a prior statement or your own contacts rather than the number in the message.
The appeal of that rule is how much it covers at once. It works for email, for text messages, and for phone calls, including the case where the voice on the line sounds like someone you know. Agreeing on a simple verification question with close family takes about a minute and settles it permanently.
Two Things That Cost Nothing
A credit freeze blocks new accounts from being opened in your name. It is available at Equifax, Experian, and TransUnion, handled separately at each, and it does not affect your credit score or your existing accounts. You can lift it temporarily whenever you apply for credit.
The second is housekeeping. Data broker sites publish addresses, relatives, and phone numbers, and most will remove your record on request. It is tedious and it works, and it is worth repeating every so often because the records come back. The same thinking applies to what you share publicly, since birthdays, schools, pets, and street names are the standard fare of security questions.
Worth Doing as a Household
Security tends to be treated as an individual task. In practice it works better as a household conversation, because the accounts, devices, and documents are shared even when the passwords are not.
Naming a trusted contact on your investment accounts is the piece most people have not done. It gives your advisor and your custodian someone to reach if they cannot reach you. It confers no authority over the account at all, it takes a few minutes, and it is one of the most useful protections available.
The same conversation is a natural place to cover where your documents live, who holds power of attorney, and how your family will handle a request that arrives sounding urgent. Families who have talked it through once tend to handle it calmly when it comes up.
Common Questions
Is a password manager actually safe?
For nearly everyone, yes, and considerably safer than the alternative. The practical risk is not that a reputable manager is compromised. It is that one password reused across dozens of sites means a single breach anywhere reaches your accounts everywhere.
Does freezing my credit hurt my credit score?
No. A freeze restricts access to your credit file so new accounts cannot be opened in your name. It does not affect your score or your existing accounts, and it can be lifted temporarily whenever you need to apply for credit.
How do I know whether a message is legitimate?
Judge it by what it asks for rather than how it looks. Any request to move money, change payment instructions, or share a code is worth verifying with a phone call to a number you already had.
Want to learn more about private wealth planning?
This content is provided by Windward Private Wealth Management Inc. (“Windward” or the “Firm”) for informational purposes only. Investing involves the risk of loss and investors should be prepared to bear potential losses. No portion of this blog is to be construed as a solicitation to buy or sell a security or the provision of personalized investment, tax or legal advice. Certain information contained in the individual blog posts will be derived from sources that Windward believes to be reliable; however, the Firm does not guarantee the accuracy or timeliness of such information and assumes no liability for any resulting damages.
Windward is an SEC registered investment adviser. The Firm may only provide services in those states in which it is notice filed or qualifies for a corresponding exemption from such requirements. For information about Windward’s registration status and business operations, please consult the Firm’s Form ADV disclosure documents, the most recent versions of which are available on the SEC’s Investment Adviser Public Disclosure website at www.adviserinfo.sec.gov.