The most effective steps to protect yourself online are the same ones US and UK security agencies keep repeating: a long, unique password for every account, a second sign-in check on the accounts that matter, caution with unexpected messages, and prompt software updates. This guide pulls those steps together from CISA in the US, the NCSC in the UK and the FTC, and says where each source’s advice differs.
How long should a password be?
CISA recommends at least 16 characters, either a random mix or a passphrase of four to seven unrelated words, with a different password for every account. The UK’s NCSC takes a similar line in its top tips: combine three random words, and give your email account a strong password you use nowhere else, because email can unlock many other accounts.
US federal technical guidance is moving the same way. NIST’s SP 800-63B says services should require at least 15 characters when a password is the only sign-in factor (at least 8 when it is used only alongside another factor), should not impose rules about mixing character types, and should not force periodic changes unless a password is known or suspected to be compromised. It also says services should check new passwords against a blocklist of common and breached passwords. In short: length beats complexity, and changing a good password on a schedule does not help.
CISA says a password manager can generate, store and fill in passwords and flag weak or reused ones, so you only need to remember one strong master password. Options range from free built-in browser tools to paid products. CISA’s password pages are marked as archived and warn that archived material may be outdated, so treat the numbers as a baseline and compare them with NIST and NCSC, as above.
Is multifactor authentication worth turning on?
Yes. Multifactor authentication (MFA, called 2-step verification or 2SV by the NCSC) adds a second check at sign-in, so a stolen password alone does not open the account. CISA lists three common types: a numeric code sent by text or email, an authenticator app that generates a new code every 30 seconds, and biometrics such as a fingerprint or face scan. It does not rank them. The FTC also lists MFA among its core protections. CISA says to begin with email, bank and healthcare accounts, checking that they offer MFA and enabling it, then to turn it on for every other account or app that supports it. Its example shows why email comes first: a person whose email was hacked lost control of linked social, bank and retail accounts, because the attackers could reset passwords through the inbox. CISA’s MFA page is also marked as archived.
- Open the account’s settings and look for Security or Password and Security.
- Find the option called two-factor or two-step authentication and turn it on.
- Choose from the methods the service offers.
How do you spot a phishing message?
CISA lists these warning signs: urgent or threatening language, requests for personal or financial information, untrusted shortened links, and addresses or links that are slightly wrong. CISA also notes that good grammar no longer rules out phishing, since AI can produce polished messages. The FTC adds common pretexts: a claimed account problem, an unrecognised invoice, a refund you are owed or a free coupon, and it says legitimate companies will not email or text a link to update your payment information.
- Do not click links or open attachments, and do not reply.
- Check independently: go to the company’s website by typing the address yourself, or call a number you already have.
- Report the message, then delete it.
Where to report differs by country:
- US: the FTC says to forward phishing texts to 7726 (SPAM), forward phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org, and report any attempt at ReportFraud.ftc.gov.
- UK: the NCSC’s reporting page asks you to forward suspicious emails to the address it shows (including ones you are only unsure about) and not to click links. The NCSC does not take crime reports: if you have lost money or been hacked, report to Report Fraud at reportfraud.police.uk or on 0300 123 2040 in England, Wales and Northern Ireland, or call Police Scotland on 101.
Why do software updates matter?
The NCSC puts installing updates in its top tips because they contain security fixes that help keep criminals out of your devices. CISA’s update guidance says patches only help once installed, advises installing every update with web browsers and antivirus software first, and recommends switching on automatic updates. The FTC similarly says to set security software and your phone’s software to update automatically. If a product has no automatic update option, CISA suggests asking the provider why. That page is also marked as archived, so check the vendor’s own advice too.
Do you need backups?
Yes. The NCSC lists backing up important items, such as photos and key documents, to an external hard drive or a cloud storage service. The FTC gives the same advice for computers and phones. A backup is what lets you recover from ransomware, a lost phone or a failed drive without paying anyone.
What should you do if something goes wrong?
- Change the passwords on the affected accounts and on any account that shares the password.
- Contact your bank straight away if money may be involved.
- If you clicked a link or opened an attachment that may have installed harmful software, the FTC says to update your security software, run a scan and remove anything it flags. Our guide to scanning a Windows PC for malware covers the steps.
- If a Social Security, card or bank account number may be exposed, the FTC points US readers to IdentityTheft.gov for steps based on what was exposed.
- Check whether your email address appears in a known breach. Our guide to checking if your password was leaked walks through it.
Where should you start if you do nothing yet?
The agencies do not publish a ranked plan, so this order is ours, built on their advice. First, secure your email account: a strong password used nowhere else, with MFA on, since the NCSC and CISA both single it out as the key to your other accounts. Second, install a password manager and let it replace reused passwords one account at a time, starting with banking and healthcare. Third, switch on automatic updates for your phone, computer and browser. Fourth, set up a backup of photos and key documents. Each step takes minutes, and none needs paid software, because CISA notes free built-in browser password managers exist and automatic updates are a setting you switch on.
Which habits do the agencies warn against?
- Simple passwords such as “12345” and easy-to-guess details such as birthdays or pet names (CISA).
- Writing passwords down or saving them in a file on your computer (CISA).
- Reusing one password across accounts, which is how a single company breach can spread to other accounts (CISA, NCSC).
- Replying to or clicking anything in a message that creates urgency, including “unsubscribe” links in suspicious emails (CISA).
- Using the contact details in a suspicious message instead of a phone number or website you already know (FTC).
Quick checklist
| Step | What the agencies say |
|---|---|
| Passwords | 16+ characters (CISA) or three random words (NCSC); unique for every account |
| Second check | Turn on MFA/2SV, starting with email |
| Messages | Do not click; verify through a channel you already trust; report |
| Updates | Install them, with automatic updates on |
| Backups | External drive or cloud storage for photos and documents |
FAQ
Is a passphrase better than a random password? CISA accepts either, provided it is at least 16 characters and unique. The NCSC recommends three random words.
Should I change my passwords every few months? NIST’s SP 800-63B says services should not require periodic changes, but should force one if a password is compromised.
Where do I report a scam text in the US? Forward it to 7726 and report it at ReportFraud.ftc.gov, per the FTC.
Does the NCSC take reports of lost money? No. It points UK readers to Report Fraud or, in Scotland, Police Scotland on 101.
Sources
- CISA: Use strong passwords (archived)
- CISA: Turn on MFA
- CISA: Recognize and report phishing (archived)
- CISA: Update software
- NCSC: Top tips for staying secure online
- NCSC: Report a suspicious email
- FTC: How to recognize and avoid phishing scams
- NIST SP 800-63B-4: Authentication and Authenticator Management
Like our coverage? Add stepphase.com as a preferred source on Google to see more of our stories in Top Stories.
