iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Turn on multi-factor authentication (MFA), use a different 15-character-or-longer password for every account, secure your password manager, strengthen recovery options, and enable available lockout or throttling controls. Use a FIDO security key when offered; otherwise choose an authenticator app, and treat SMS as a fallback. Then review active sessions and recovery devices so an attacker cannot keep access after you change settings.
Why identity settings matter in automated takeovers
Automated account-takeover campaigns test stolen username-and-password pairs against many services, try common passwords, and reuse credentials exposed in unrelated breaches. The attack may be entirely automated, but the defenses are settings you can change yourself. A password alone cannot distinguish you from a bot using a valid leaked password. MFA, unique credentials, protected recovery channels, and rate limits add separate barriers.
Start with the account that controls your other accounts: your primary email. If an attacker controls that mailbox, they can often reset social, shopping, financial, work, and gaming accounts. Next secure banking, payment, tax, cloud-storage, social, shopping, and other accounts that contain money, identity data, or private conversations.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Security labels vary. CISA notes that MFA may be located under Account Settings, Profile, Preferences, or Privacy. Look for entries named Security, Login, Two-step verification, Multi-factor authentication, Passkeys, Devices, or Recovery.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
The settings to change first
- Enable MFA on email, then high-value accounts. Do not wait for a suspicious login. Enroll the strongest method the service supports and save its recovery codes offline.
- Replace reused passwords. Create a unique passphrase of at least 15 characters for each account. A password manager can generate and remember random credentials.
- Secure the password manager itself. Use a long master passphrase, enable MFA, and understand exactly how account recovery works.
- Harden recovery. Keep more than one authenticator where supported, maintain current recovery contacts, and remove old phone numbers, email addresses, and devices.
- Turn on anti-brute-force controls. Use offered failed-login lockouts, sign-in alerts, and suspicious-login monitoring.
- Review sessions after every change. Sign out unknown browsers and revoke unfamiliar devices, tokens, and authenticator registrations.
Choose the strongest MFA method available
MFA requires a second proof in addition to a password. CISA’s current ordering places physical security keys first, followed by number-matching or one-time-code authenticator apps, biometrics, and text or email codes. The Federal Trade Commission (FTC) likewise describes authenticator apps and security keys as more secure than SMS.
| Method | Phishing resistance | Phone-number dependence | Recovery and portability | What to choose |
|---|---|---|---|---|
| FIDO2/WebAuthn security key | Strongest option listed by CISA; the cryptographic challenge is tied to the legitimate site | None | Carry the key; enroll a spare and store it safely to reduce lockout risk | Choose first when the account supports security keys. CISA names a YubiKey as an example of this category. |
| Authenticator app with number matching or one-time codes | Stronger than SMS, but codes can still be phished; number matching helps against push fatigue | Usually none after enrollment | Requires a phone or compatible device; keep a second enrolled authenticator or offline recovery codes | Best practical choice when a security key is unavailable |
| Biometric unlock | Depends on the device and the service’s implementation; generally stronger than a password alone | None directly | Convenient on enrolled devices; recovery depends on the provider’s backup methods | Use when offered, while retaining a secure recovery method |
| SMS code | Weakest common option because the number can be hijacked | Yes | Easy to move to a new phone, but vulnerable during a SIM-swap attack | Use only when stronger MFA is not available |
| Email code | Security is limited by the security of the email account | Indirectly, if email recovery uses a phone | Convenient but creates a single point of failure | Prefer an app or key for the account and especially for email itself |
Security keys and passkeys
A FIDO security key uses public-key cryptography. The service stores a public key while the physical key protects the private key; a fake website cannot normally obtain a valid response for the real service. Enrollment is usually under Security or Passkeys and security keys. Register two keys if the service permits it: keep one with you and one in a secure location.
Authenticator apps
Authenticator applications generate time-based one-time passwords or receive number-matching prompts. During setup, scan the service’s QR code only from the legitimate account page, verify the displayed code, and save the emergency recovery codes. Never approve an unexpected prompt or enter a code into a link supplied by an unsolicited message.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsRank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Why SMS should be a fallback
The FTC warns that a criminal can perform a SIM-swap attack, persuade a mobile carrier to move your number to a new SIM, and receive texted verification codes. If SMS is the only choice, add a carrier account PIN or port-out lock where your carrier offers one, but still move to a security key or authenticator app as soon as the service supports it.
Build passwords that automated attacks cannot reuse
The FTC’s guidance recommends at least 15 characters. Length matters, but uniqueness is the decisive protection against credential stuffing: a password used nowhere else cannot be replayed from another breach. A passphrase made from several unrelated words is easier to type and can meet the length target; a password manager can instead generate a long random string.
- Use a different password for every account, including accounts you consider unimportant.
- Do not add predictable variations such as a new year or an exclamation mark to an old password.
- Change a password immediately if the service reports a breach, you entered it into a suspicious page, or an unknown session appears.
- Never send passwords or one-time codes through email, chat, or support messages.
Secure the password manager
NIST explains that password managers improve security principally by generating unique, long, complex passwords and storing them in an encrypted local or cloud vault. Set a long master passphrase that you do not use elsewhere, then protect the manager with MFA. Review its recovery design before storing your entire credential set: a recovery process that can reset the master secret may also create a path to the vault.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
| Password-manager capability | Why it matters for takeover resistance |
|---|---|
| Unique-password generation | Stops one breach from unlocking other services |
| Encrypted vault storage | Protects saved credentials at rest on the device or provider’s servers |
| MFA for the manager | Adds a barrier to the account that unlocks your other passwords |
| Cross-device support | Makes it practical to use unique passwords everywhere without insecure copying |
| Transparent recovery design | Lets you understand whether a reset can expose or replace the master secret |
Replace predictable security-question answers
Security questions are often treated as a second factor, but answers such as a ZIP code, birthplace, pet’s name, or mother’s maiden name may be discoverable through public records or social media. The FTC advises avoiding facts someone could find online.
If a service still requires questions and permits arbitrary answers, generate random answers and save them as secure notes in your password manager. Do not reuse the same invented answer across sites. If the service does not allow random text, choose the least predictable option and rely on MFA and recovery codes rather than treating the question as strong protection.
Protect account recovery before you need it
Recovery is where a locked-out legitimate user and an attacker may follow the same process. NIST identifies recovery codes, remaining authenticators, and prearranged contacts as recovery mechanisms. Configure them while you still control the account.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Generate the service’s recovery codes and print or write them down. Store them offline in a secure place; do not leave the only copy in the account you are protecting.
- Enroll a second security key or authenticator where the provider allows it. Keep the backup separate from your everyday device.
- Review recovery email addresses and phone numbers. Remove old addresses and numbers, and secure the replacement accounts with MFA.
- Check trusted contacts or recovery contacts. Remove anyone who should no longer have a role and confirm current contacts can be reached.
- After changing recovery data, review active sessions and sign out devices you do not recognize.
Recovery codes are effectively passwords for recovery. Anyone who obtains them may bypass your usual factor, so do not photograph them to an automatically backed-up photo service or paste them into an unencrypted note.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Turn on throttling, lockout, and sign-in alerts
Rate limits prevent a bot from trying unlimited guesses. NIST Special Publication 800-63B-4 (2025) says verifiers generally must limit consecutive failed attempts for an authenticator to no more than 100 and disable that authenticator; a service may impose a lower limit. That upper bound is a standards requirement, not a recommendation to wait for 100 failures.
When a service exposes these controls, enable or accept:
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- Temporary lockout or increasing delays after failed attempts.
- Alerts for new devices, unusual locations, password changes, and recovery changes.
- Sign-in history showing IP addresses, browsers, and approximate locations.
- Automatic session expiration or a “sign out everywhere” command.
CISA also recommends lockout after failed attempts and monitoring for brute-force and password-spraying activity. A lockout can create denial-of-service problems if set too aggressively, so keep a tested recovery route and avoid disabling your only authenticator without first enrolling another.
Step-by-step: audit one account
- Open the official account page directly. Type the service’s known address or use its trusted application; do not follow an unsolicited login link.
- Open Security, Login, Privacy, or Account Settings. Search for MFA, passkeys, security keys, devices, sessions, recovery, and password controls.
- Change the password. Generate a unique password of at least 15 characters and save it in your manager.
- Enroll the strongest factor. Add a FIDO security key if supported. Otherwise enroll an authenticator app; use SMS or email only if no stronger method exists.
- Save recovery material. Store recovery codes offline and add a second authenticator or backup key where available.
- Remove stale access. Revoke unknown sessions, old devices, obsolete app passwords, and unfamiliar third-party connections.
- Review alerts and limits. Turn on new-login notifications and confirm failed-attempt controls are active.
- Repeat for the email account first, then other high-value accounts.
What to do if you see takeover signs
- Unexpected MFA prompts: deny every prompt, change the password from a trusted device, and inspect sessions and recovery settings.
- Password-reset emails you did not request: do not use their links. Open the service directly, change the password, and check whether an attacker added a recovery address or device.
- Unknown sessions or messages sent from your account: revoke all sessions, remove unfamiliar app access, and notify contacts that messages may be fraudulent.
- Loss of mobile service: contact your carrier immediately about a possible SIM swap, place a number-transfer lock, and move account MFA away from SMS.
- Locked out: use an offline recovery code or your backup authenticator. Do not give a recovery code to anyone claiming to be support.
Common mistakes that leave the door open
- Enabling MFA only on social media while leaving email and the password manager unprotected.
- Using the same password with a different spelling or year on multiple sites.
- Keeping SMS as the primary factor after an authenticator app or security key becomes available.
- Saving the only recovery code inside the account that may be inaccessible.
- Ignoring old sessions after a password change; existing tokens may remain valid.
- Approving repeated push prompts because they are annoying rather than investigating the sign-in.
A practical priority order
If you can change only a few settings today, secure your primary email with a unique 15-character-or-longer password and the strongest available MFA, then protect your password manager, banking and payment accounts, and cloud storage. Add offline recovery codes and a backup authenticator before removing old methods. Finally, review sessions and alerts across the accounts so automated attempts become visible and stolen credentials alone no longer grant access.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →
