Please Read This

This is happening right now

In the 30 days I spent writing this guide, every one of these hacks hit the news.

• Oracle's health business got hacked. Nearly 20 million people had their Social Security numbers, addresses, and medical records stolen.
• California's state testing company got hacked, and hackers stole data on millions of kids.
• Florida's DMV got hacked.
• A video game company got hacked, exposing 11.7 million accounts. Hackers locked some people out of their own accounts.

This is what it costs when thieves get to your money.

• A thief took $751,430 out of one person's 401(k). They called the retirement plan, passed the security check with stolen personal info, changed the contact details, and asked for a full payout. Unlike a stolen credit card, you may never get that money back.
• The FBI says people 60 and older lost $7.7 billion to online scams in 2025, up almost 60% in one year.

We've seen hundreds of hacks like these over the years, but it used to take skilled people and a lot of time to find a way in. AI makes it faster and easier. It's finding security holes that sat in software for decades without anyone noticing.

Read this, then actually do the stuff. It's a few hours of work, and it could save everything you've built.

It's getting worse, fast

This year is on track to find about 100,000 new security holes, a quarter of everything found since the late '90s, in a single year.

AI is driving this. It helps when the good guys find a hole first, but companies can't patch holes as fast as they're being found, and criminals have the same AI.

In October 2026, researchers using AI found critical holes in PHP, the behind-the-scenes software that runs about 70% of all websites. That includes WordPress, which alone runs about 40% of all websites, from small businesses to churches to schools.

Every version of PHP from the last decade was affected. The flaws let an attacker take over a website without logging in. A fix came out October 21, but every website owner has to install it, and plenty of small sites are slow to update.

The systems running your bank, email, and phone could have holes that are decades old, and nobody knows about them yet. AI is finding holes like that all the time now. If your accounts aren't locked down, you're an easy target, and that can mean losing money or an expensive legal fight after someone steals your identity.

Which accounts matter most

You don't have to fix everything at once. Start at the top and work down.

Tier 1: Critical. Do these ASAP.

• Email. This is the master key. Whoever controls your email can reset the password on almost every other account you have.
• Bank accounts. Checking, savings, and any bank apps.
• Retirement and investment accounts. 401(k), IRA, pension, Fidelity, Vanguard, Schwab, and similar.
• Your Apple or Google account. This controls your phone, photos, and saved passwords.
• Your phone carrier. Verizon, AT&T, T-Mobile, and others. Thieves can move your phone number to their phone and receive your security codes.

Tier 2: Important. Do these this month.

• Credit cards.
• PayPal, Venmo, Cash App, and Zelle.
• Amazon and any store with a saved card.
• Health portals, like MyChart and your insurance.
• Government accounts, like the IRS and Social Security.

Tier 3: Everything else. Do these when you can.

• Facebook, Instagram, TikTok, and X.
• Shopping, streaming, and other accounts.

Step 1 Turn on passkeys or two-step login

Passwords alone don't cut it anymore. They leak in breaches, and thieves try them everywhere.

What's a passkey? A passkey replaces your password with your face, fingerprint, or phone PIN. There's nothing to steal or guess, and it won't work on a fake website.

What's two-step login? After your password, the site asks for a second proof, like a code from your phone. Even if a thief has your password, they can't get in without your phone.

Strongest to weakest:

1. Passkey with Face ID, Touch ID, or your phone PIN. Strongest. Use it anywhere it's offered.
2. Authenticator app. Google Authenticator works, and Apple Passwords and NordPass can store these codes too. The code lives on your phone, not your phone number.
3. Text message code. Weak, because a thief can move your number to their phone and get your codes. Still far better than nothing, and the carrier PIN in Step 4 closes most of that gap.
4. Password only. Not enough for anything that matters.

Use the strongest option each account offers. Many retirement plans only offer text codes. Use them anyway, add the carrier PIN, and turn on the account-change alerts in Step 5.

Where do you find it? In each account, look under Security, Login, or Sign-in settings for Passkeys or Two-Step Verification.

Setup links:

• Google passkeys
• Apple passkeys

Start with your email, then work through the rest of Tier 1.

↑Back to the list

Step 2 Freeze your credit at all three bureaus

A credit freeze stops anyone from opening a new credit card or loan in your name. It protects you even if your Social Security number has already leaked.

It's free by law. It takes about 20 minutes by phone, or about 40 minutes online. It doesn't hurt your credit score, and you can still check your own credit report.

The rules:

• Freeze all three. Equifax, Experian, and TransUnion. A freeze only blocks lenders who check that one bureau.
• Choose freeze, not lock. A lock can cost money and isn't protected by law. A freeze is free and is.
• Don't click the wrong option. These sites make it easy to accidentally pick a lock or a fraud alert instead.
• Never pay. If a site asks for a credit card, you're in the wrong place.
• Use the official pages below. Fake lookalike sites exist, so don't click random search results.
• Write down any PIN or login and keep it somewhere safe. You'll need it to unfreeze.

Official freeze pages:

• Equifax
• Experian
• TransUnion

If you prefer to call, use the phone number listed on each official page.

Need a loan later? When you apply for a car loan, mortgage, or new card, temporarily lift the freeze for a few days. It's quick, and you can set it to refreeze on its own.

One more freeze. Phone and utility companies check a separate report called NCTUE, which the big three don't cover. Freeze it by calling 866-349-5355.

What about kids? Parents can freeze a minor child's credit too. Kids' identities are attractive to thieves because nobody checks them for years.

↑Back to the list

Step 3 Use a password manager

If you use the same password on more than one site, one breach unlocks all of them. Thieves take leaked passwords and try them on banks, email, and retirement accounts automatically.

Is one of these yours?

• 123456 or password. Two of the most common passwords in America, year after year. A thief's computer gets in before your coffee finishes brewing.
• Password1! A capital letter, a 1, and an exclamation point don't make it clever. The guessing software tries every one of those tweaks on its own.
• Your pet's name and a year, like Buddy2015. You posted Buddy's birthday on Facebook. There was a cake.
• Your grandkid's name and birthday. Same problem. Every proud post is a clue.
• Summer2025! The password of someone who was forced to change it and gave up. Thieves know that move.
• One great password you use everywhere. It doesn't matter how strong it is. The day one site leaks it, it's the password to every account you have.

A password manager creates a different, random password for every account and fills it in for you. You don't have to remember any of them.

Which one to use:

• Apple Passwords if you use an iPhone, iPad, or Mac. It's already built in and free.
• NordPass if you use Android or Windows, or a mix of devices.

Once it's set up, change your Tier 1 passwords first so each one is unique.

Do you know your passwords by heart? If you can type any of your Tier 1 or Tier 2 passwords from memory, they're not good enough. Let the password manager make them up and remember them for you. The only ones you should know by heart are your phone passcode and the password that unlocks your password manager, which is your Apple account password or your NordPass master password.

Your password manager now holds the keys to everything. It needs to be just as secure as your bank account, or more. The next step covers how to lock it down.

↑Back to the list

Step 4 Lock down your phone and password manager

Your phone and your password manager are now the front door to your whole financial life. Treat them that way.

Your phone:

• Use a strong passcode. At least 6 digits, and never a birthday, address, or 1234.
• iPhone users: Turn on Stolen Device Protection. Go to Settings, then Face ID & Passcode. It stops a thief who learns your passcode from changing your Apple account or seeing your passwords.
• Add a carrier PIN. Call your phone carrier or check their app, and set a PIN that's required to move or transfer your number.

If you use Apple Passwords:

• Your phone passcode is effectively the key to your vault. That's why a strong passcode matters so much.
• Keep two-step login turned on for your Apple account. Apple calls it two-factor authentication.

If you use NordPass:

• Create a long master password you've never used anywhere else. A short, silly sentence works well, something you can picture but nobody could guess.

  • Grandpa juggles waffles in the bathtub!
  • My canoe smells like 47 lemons.
  • Purple tractors eat cold pancakes at noon.

  Don't use these exact ones, since they're on the internet now. And keep your life out of it. No pet names, grandkids, birthdays, or favorite teams, because thieves read Facebook too.

• Turn on two-step login in NordPass settings.

• Write down your recovery code and keep it on paper somewhere safe at home, not on your phone.

↑Back to the list

Step 5 Turn on alerts and keep things updated

Alerts catch theft early, while you can still stop it.

• Bank alerts. Turn on text or app alerts for logins, withdrawals, transfers, and new payees.
• Retirement account alerts. Turn on alerts for any change to your address, phone, email, or bank account on file, and for any withdrawal.
• Create your online retirement login. If you've never logged into your 401(k) or pension online, set it up now. Otherwise a thief can create that login in your name first.
• Automatic updates. Turn on automatic updates for your phone, computer, and apps. Updates fix the holes AI keeps finding.

↑Back to the list

Step 6 Don't get talked into it

Many thefts don't involve hacking at all. Someone simply convinces you to hand over money or a code.

• Set a family code word. Pick a word only your family knows. Scammers can use AI to copy someone's voice from a short video online. If someone calls claiming to be family in an emergency, ask for the word. A copied voice won't know it.
• Hang up and call back. If your bank, the IRS, Medicare, or a relative calls asking for money or information, hang up. Then call back, but NOT THE NUMBER THAT CALLED YOU. For a company, get the official number from the back of your credit or debit card, a statement, or the company's own website, typed in yourself instead of searched for. For a relative, use the number you already have for them.
• Never share a code. If a code is texted to you, never read it to anyone who calls. No real company will ever ask for it.
• Pressure is the red flag. Real banks, police, and family don't demand gift cards, crypto, wire transfers, or secrecy. If someone is rushing you, stop.
• Don't click links in surprise texts or emails. Go to the website or app directly instead.

↑Back to the list

Bonus Use a VPN on public Wi-Fi

A VPN scrambles your internet traffic so nobody on the same network can see or tamper with it. Use it on Wi-Fi you don't control, like coffee shops, airports, hotels, and hospitals.

On your own password-protected home Wi-Fi or your phone's cellular data, it matters less.

What won't a VPN do? It won't stop scam texts and emails, phone scams, fake websites, or someone logging in with your stolen password. Steps 1 through 6 handle those. A VPN is an extra layer, not a replacement.

Easy options:

• NordVPN. Top-rated and easy to use. Same company as NordPass.
• Proton VPN. Has a solid free version with no data cap.
• Surfshark. One subscription covers unlimited devices, good for a whole household.

Install the app on your phone and laptop, and turn on auto-connect so it's on whenever you're on Wi-Fi. Skip random free VPN apps, since many make money selling your data.

↑Back to the list

If something happens

Speed matters more than anything. Don't wait to see if it fixes itself, and don't be embarrassed. This happens to smart people every day.