DEWA89: Account Security and Phishing Awareness

How to Use This Site

There are two ways in, depending on how much time you have.

If you want the fastest meaningful improvement, start with multi-factor authentication and passkeys and put a passkey on your primary email today. That single change defeats the two attacks that empty accounts at scale: password reuse and real-time phishing. It takes about fifteen minutes.

If you want to understand what is happening and why the usual advice fails, read the four guides in order. Each one stands alone, but they build on each other, and together they cover the whole of a realistic account takeover.

Two support pages sit alongside the guides: the FAQ, which answers the questions readers send most often in a few sentences each, and support and corrections, which explains how to report a factual error and, just as importantly, what we cannot do for you.

If your login has already been taken over, skip to account recovery and work the steps in order. Speed and sequence matter more than understanding the theory at that point.

What Account Takeover Looks Like From the Inside

Account takeover means somebody else can act as you inside a service: read your mail, reset passwords elsewhere, move money, message your contacts as you. It does not require them to know your password at the moment of the attack, and it rarely announces itself with a lock-out.

A careful attacker avoids anything that would alert you. Rather than changing your password, they add a recovery address or phone number of their own, register their own authenticator or passkey, create an app-specific password that survives a reset, and add a mail rule that deletes security notifications. So the audit that matters is not the password screen. It is the lists:

• Sign-in methods and registered authenticators.
• Recovery email address and recovery phone number.
• Active sessions and signed-in devices.
• Connected third-party apps and their permissions.
• App-specific passwords.
• Mail filters, forwarding rules and delegated access.

Do not count on being told. A session resumed from a stolen cookie frequently triggers no alert at all, because from the service's point of view the login was legitimate - it was, it was just not yours. The password screen is the one place you will look; the lists are the place that matters.

Why a strong password alone does not protect you

A long, complex password defeats exactly one attack: guessing or cracking. A twenty-character password that you reuse is stuffed as easily as a short one. Typed into a proxy page, it is captured in full. Sitting in your browser's password store, it is read by infostealer malware in milliseconds. Uniqueness and storage matter at least as much as strength, which is why the second guide on this site is about managers rather than about character counts.

The Five Routes That Cause Most Takeovers

Nearly every account takeover traces back to one of five mechanisms. They are worth knowing separately, because each one defeats a different defence - which is the entire argument for defence in depth.

1. Credential stuffing

Username and password pairs leaked from one breach are replayed automatically against many other services. The attacker is not targeting you; they are testing a list. It works for one reason only: reuse. Check your address at Have I Been Pwned to see whether you appear in known datasets.

2. Phishing and adversary-in-the-middle pages

Classic phishing captures what you type. Adversary-in-the-middle goes further: the page is a proxy, passing your input to the real site and relaying its responses back, so the flow you see is the genuine one. The attacker takes the password, relays your one-time code inside its validity window, and keeps the session cookie. Codes by SMS or from an authenticator app do not stop this. Passkeys and hardware security keys do, because the credential is bound to the real domain and will not produce anything for a lookalike. This is covered in detail in the phishing guide.

3. SIM swap and port-out fraud

The target here is your phone account rather than your online accounts. Carrier staff are tricked or bribed into moving your number to a SIM the attacker controls, or a port-out request is filed with another carrier. Every service that resets by SMS then works for them. Ask your carrier for a port-freeze or an account PIN, and move your important accounts off SMS. The honest limit: some banks still offer no alternative, so there the carrier lock is your only lever.

4. Information-stealing malware

Infostealers exist to harvest credentials. They arrive as cracked software, a fake browser update, a trojanised installer from a paid search result, or an attachment in a plausible work message. Then they read your browser's saved passwords, cookies and autofill data and upload the lot. Changing one password afterwards achieves very little, because everything saved in that browser has already gone.

5. Session token theft

A session token - usually a cookie - is what keeps you logged in after you authenticate. Stolen by a proxy page or an infostealer, it lets an attacker resume your session with no password and no second factor at all. This is why "change your password" is incomplete advice after a compromise, and why revoking active sessions is a separate step.

Defence in Depth, in Practical Terms

Defence in depth means arranging controls so that the failure of any one of them is survivable. Not stacking measures that all cover the same failure, but covering different failure modes - because each route above defeats a different control.

1. Unique credentials remove credential stuffing outright. A leak at one service stops being usable anywhere else. See passwords and password managers.
2. A phishing-resistant sign-in - a passkey or hardware key - removes the attack that unique passwords cannot touch. See MFA and passkeys.
3. Device integrity protects secrets at rest: a vault that locks itself, prompt updates, and no software from search advertisements, download aggregators or piracy sites.
4. A hardened recovery path closes the back door. Recovery email, recovery phone number and security questions are all authentication - usually its weakest copy, and the one nobody reviews.
5. Detection and response is the layer people skip: sign-in alerts switched on, and recovery codes you can reach once access is gone.

Name what does not help, too. Ninety-day password changes do not. Security questions are not security, because the answers are often public; store random answers in your manager instead. SMS beats nothing but loses to both SIM swap and proxy phishing. Antivirus does not undo a cookie theft that already happened. And nothing you do protects data that the service itself leaks.

Protect the Accounts That Unlock the Others

You will not harden sixty accounts; nobody does. The gain from modest effort comes from noticing that accounts are not independent - a handful of them can reset the rest. Those get your best controls. Everything else gets a unique password and whatever second factor is convenient.

Four accounts usually form that tier:

• Your primary email. It is the master key to anything offering a reset by email, so it is first in line for a passkey.
• Your password manager. It holds the plaintext of everything else.
• Your mobile phone account. It controls the number used for codes and resets, so a carrier PIN belongs here.
• Your financial logins. These are where losses are immediate and sometimes irreversible.

Add cloud storage if it holds scans of identity documents - that is the raw material for impersonating you elsewhere. The UK NCSC's top tips for staying secure online is a short checklist worth running against this tier.

One ordering note, because it causes real lock-outs: test a new sign-in method before you remove the old one, and save the recovery codes first.

What to Do in the Next Hour

1. Install a password manager, give it a long passphrase used nowhere else, and store its printed recovery kit away from your desk.
2. Change your primary email password to a long generated one, then add a passkey. On a Google Account this is Security > How you sign in to Google; on an Apple Account, Sign-In and Security; on a Microsoft account, Security > Advanced security options.
3. In those same screens, open active sessions and devices, sign out of anything unfamiliar, and delete recovery numbers or addresses that are no longer yours.
4. Run your manager's reuse and breach report - in Chrome, Settings > Autofill and passwords > Google Password Manager > Checkup; on Apple devices, Settings > Passwords > Security Recommendations. Fix the top-tier accounts first.
5. Ask your mobile carrier for a port-freeze or account PIN on the line that receives your codes.
6. Revoke connected third-party apps on your email and social accounts that you do not actively use.

That is most of the benefit available in one sitting. The rest needs judgement rather than a settings change, which is what the four guides are for.

DEWA89: quick answers

Back to top ↑