What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The safest setup combines strong, phishing-resistant sign-in with controls that limit what an account can do after login. Turn on multi-factor authentication (MFA) for your bank, cards, email, tax account and payment apps; use a passkey or FIDO2/WebAuthn security key when offered, otherwise an authenticator app; keep a unique password in a password manager; install updates promptly; and enable instant alerts, transfer limits and recipient or device restrictions. No single setting guarantees that fraud cannot occur, so review activity and contact your institution through an official channel when anything looks wrong.
Bank and payment features differ by institution, country, account type and device. The labels below are therefore a map to look for, not a promise that every app offers every control.
Start with an account-security inventory
Protect the accounts that can move money or reset access before less-sensitive accounts. A criminal who takes over your email can often reset a bank login, while a compromised payment app can be used immediately.
- List each bank, credit-card issuer, brokerage, tax portal, payment app and email account connected to money.
- For every account, record whether MFA, passkeys, security keys, transaction alerts, transfer limits, recipient controls and device-management options are available.
- Remove old phone numbers, email addresses, trusted devices and third-party connections that you no longer control.
- Store recovery codes offline or in a reputable password manager, and keep a backup factor so a lost phone or key does not lock you out.
Use the strongest practical MFA method
MFA requires an additional verification step after the password. CISA recommends enabling it in account settings for sensitive accounts. The methods are not equally resistant to phishing, SIM-swap attacks or recovery abuse.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
| Method | Phishing resistance | SIM-swap exposure | Recovery and portability | Setup and support |
|---|---|---|---|---|
| Passkey (FIDO2/WebAuthn) | Very high when implemented by the service; the credential is bound to the legitimate site or app. | Not dependent on a phone number. | Recovery depends on the platform’s synced passkey or a separately enrolled backup device; verify the bank’s recovery process. | Usually quick on a compatible phone or computer, but support varies by bank. |
| FIDO2 security key | Very high. The Federal Trade Commission calls security keys “the strongest method of two-factor authentication.” | Not dependent on a phone number. | Highly portable, but a lost key can strand you unless a second key or another backup factor is enrolled. | Requires buying, registering and carrying the key; the bank or payment app must support it. |
| Authenticator app code | Better than SMS, but a real-time phishing site can relay a one-time code. | Not directly tied to the mobile carrier. | Moving the authenticator to a new phone requires a supported transfer or recovery code. | Widely supported; setup involves scanning a QR code or entering a secret. |
| SMS or voice code | Low compared with the methods above; codes can be captured by phishing or diverted during a SIM swap. | High relative exposure. | Convenient on a replacement phone, but dependent on carrier service and the correct number. | Commonly available. Use it when it is the only option rather than disabling MFA. |
Enroll a passkey or security key
- Sign in through the bank’s official app or a bookmark you created yourself.
- Open the account-security area, often labeled Security, Sign-in and security or Two-step verification.
- Choose Passkey, Security key or FIDO2/WebAuthn, then follow the on-screen biometric, PIN or hardware-key prompt.
- Register a second passkey or key, or retain an authenticator-app or recovery-code backup. Test the backup before relying on it.
- Give each credential a recognizable name, such as “personal phone” or “spare key,” so you can revoke one that is lost.
When SMS is the only choice
SMS is safer than having no second factor. Add it, then ask the carrier whether it supports an account PIN, port-out lock or number-transfer alert. Do not treat those carrier controls as a substitute for a passkey or security key, and never read a one-time code to an unexpected caller or texter.
Create a password system that survives breaches
Use a different, long password for every bank, card, email and payment account. Attackers buy credentials exposed in one breach and try the same combinations on other services. A password manager can generate and fill unique passwords; NIST lists password managers as a supporting control, and FTC guidance warns against reuse.
Set up the manager safely
- Protect the manager itself with a unique master passphrase and the strongest MFA it supports.
- Generate a random password for each financial account instead of modifying an old password.
- Keep recovery codes in an offline copy or a secure vault that is available if your primary phone is lost.
- Do not save a bank password in a browser profile or shared computer that other people can access.
- Change a password immediately after a breach notice, suspicious login or accidental disclosure, and revoke active sessions where the service allows it.
Password hygiene remains uncommon: the National Cybersecurity Alliance’s 2023 survey, reproduced in CISA’s 2024 toolkit, found that 38% of people used unique passwords for all their accounts. That figure is a warning about reuse risk, not a safety threshold.
Recommended Free Tools
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Keep the device and software patched
Enable automatic updates for the operating system, browser, banking app, password manager and security software. The FTC notes that software updates often contain critical patches and protections against security threats; the Consumer Financial Protection Bureau likewise emphasizes timely updates. If an update requires a restart, complete it before using the device for financial activity.
Device settings to check
- Use a screen lock with a strong PIN or passcode, plus device biometrics where supported.
- Set the shortest practical auto-lock period and require the passcode after restart.
- Turn on the device’s built-in theft or location protection so you can remotely lock or erase it.
- Install apps only from the platform’s official store, and remove banking apps from rooted, jailbroken or otherwise modified devices.
- Review app permissions. A banking app generally should not need access to unrelated contacts, microphones or photos.
- Encrypt the device and keep backups protected by a separate account and MFA.
Only 36% of people in the same 2023 National Cybersecurity Alliance survey said they always installed software updates when available, as reported in CISA’s 2024 toolkit. Delaying patches leaves known weaknesses exposed.
Use a safer network for banking
The FBI advises avoiding public Wi-Fi for sensitive financial activity. Prefer a trusted home network with current router firmware and a strong, unique Wi-Fi password, or use your mobile connection. Disable automatic connection to open networks so the phone does not join a look-alike hotspot.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
If you must connect away from home
- Use cellular data or a personal hotspot rather than airport, hotel or café Wi-Fi.
- Confirm that the bank’s address is the one you entered or bookmarked; a padlock alone does not prove that a page is legitimate.
- Do not install a certificate, “security update” or remote-access app at the request of a hotspot or caller.
- Log out, close the app or browser, and forget the network when finished.
A VPN can encrypt traffic between your device and the VPN provider, but it does not make a phishing site trustworthy or replace MFA, updates and transaction controls.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsTurn on transaction-level defenses
Login protection stops some account takeovers; transaction controls reduce the damage if someone gets in. Look under Alerts, Payments, Transfers, Limits, Recipients or Device management.
| Control | Recommended setting | What it limits | Typical availability |
|---|---|---|---|
| Instant alerts | Push notifications plus email or text for every login, new payee, password change, card-not-present purchase, transfer and profile change. | Shortens the time between unauthorized activity and your response. | Common for consumer and business accounts, but event choices differ. |
| Transfer and payment limits | Set daily and per-transaction ceilings to the lowest amount that still supports your normal use; raise them temporarily only when needed. | Caps the amount a thief can send in one operation or day. | Often flexible for online transfers; exact limits and change delays vary. |
| Recipient or payee controls | Require a waiting period, confirmation or separate approval before a new recipient can receive funds. | Blocks immediate diversion to a newly added account. | More common in business banking; some consumer services offer payee verification or locks. |
| Device and session controls | Require approval for a new device, review active sessions and remove devices you no longer own. | Reduces persistence after credential theft. | Availability varies widely by bank and payment app. |
| Dual approval | Require two authorized people to approve outgoing payments. | Prevents one compromised user from completing a high-value transfer. | Primarily a business-account feature. |
Choose useful alert thresholds
Do not enable only a monthly statement alert. Select real-time events, including successful and failed sign-ins, password or MFA changes, new beneficiaries, address or phone changes, card additions to a wallet, wire or ACH requests, and declined transactions. Use a channel you monitor; an alert sent to a compromised email account is not an independent warning.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Make limits match your routine
Estimate the largest legitimate payment you make and set the limit close to it, leaving room for ordinary variation. A low limit can block your own rent or payroll, while an unlimited limit gives an intruder more opportunity. If your institution supports a temporary limit increase, lower it again immediately after the planned transfer.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Recognize and stop phishing
Unexpected messages create urgency: a “fraud department” caller asks for a code, a text claims your account is locked, or an email demands that you “verify” a recipient. The FTC says not to share verification codes when you did not initiate the contact.
- Stop the conversation. Do not click the message link, call the number in the message or install software.
- Open the bank’s official app or type a known address yourself.
- Check the alert and recent activity inside the account, not through the message.
- Use the phone number printed on your card or an official statement if you need help.
- Decline remote-access requests and never disclose a one-time code, passkey approval or security-key touch to someone who contacted you unexpectedly.
Legitimate staff may ask you to verify identity through an official channel, but they should not need the secret code that proves you control the account.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Respond quickly to suspicious activity
Speed matters because transfers, card purchases and account changes can become harder to reverse. If an alert or statement shows something you did not authorize:
- Use the institution’s official app or the number on your card to report the event and ask whether the account, card or transfer can be frozen.
- Change the affected password from a trusted, updated device and sign out other sessions.
- Revoke unknown devices, passkeys, security keys, connected apps and payment-wallet tokens.
- Contact your mobile carrier if you suspect a SIM swap, and secure the email account that can reset the bank login.
- Preserve messages, dates, transaction IDs and screenshots for the bank, card issuer or law-enforcement report.
- Monitor linked accounts and credit activity for follow-on attempts.
Do not use a phone number or link supplied by the suspicious message. If you lost a phone or key, use your pre-enrolled backup factor, revoke the missing credential and register a replacement.
Build a practical setup in one session
Use this order when hardening a new or existing account:
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute- Update the device, browser and banking app, then enable a screen lock and biometrics.
- Replace any reused banking, email or payment password with a manager-generated unique password.
- Enroll a passkey or FIDO2 security key; if unsupported, enroll an authenticator app, and use SMS only as a fallback.
- Save recovery codes offline, register a backup factor and test account recovery without removing the primary factor.
- Enable instant alerts for sign-ins, profile changes, card activity, recipients and transfers.
- Set transfer and payment limits, recipient confirmation and new-device approval to match your normal activity.
- Review authorized devices, payees, beneficiaries, linked apps and wallet tokens; remove anything unfamiliar.
- Turn off automatic public-Wi-Fi joining and use cellular data or a trusted network for financial sessions.
- Bookmark the official sign-in page and add the institution’s card number to your contacts for urgent, legitimate calls.
What the numbers say about the gap
People recognize the issue but do not consistently apply the basics. In the National Cybersecurity Alliance’s 2023 survey, 84% considered online safety a priority, yet only 38% reported unique passwords for all accounts and 36% always installed updates. CISA reproduced these figures in its 2024 toolkit. The practical lesson is to automate the controls you can—updates, password generation, alerts and screen locking—and make the remaining checks part of each account review.
Limits and trade-offs to keep in mind
- Passkeys and keys: strongest against phishing, but a service may not support them and you need a recovery plan for loss.
- Authenticator apps: broadly available and less exposed to SIM swaps than SMS, but codes can still be phished and phone migration can be difficult.
- SMS: worthwhile when it is the only MFA option, yet vulnerable to number takeover and social engineering.
- Strict limits: reduce potential loss but can delay legitimate payments; use temporary increases where offered.
- Alerts: help only when monitored and sent to an account or device that an attacker cannot also control.
- Public Wi-Fi avoidance: lowers exposure, but a trusted network does not excuse weak passwords, missing updates or skipped MFA.
Review these settings after changing phones, email addresses, carriers, trusted devices or business roles. Feature names and availability can change, so confirm the current options in your institution’s security and payment menus.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
