How to Keep Your Data Safe (Without Becoming Obsessive)

Reusing one strong password across everything is the actual problem. A single site breach exposes every other account, and attackers absolutely try the leaked email and password everywhere else first. This is not theoretical — automated credential stuffing is one of the most common attacks there is.

• Use a password manager. It generates and remembers unique strong passwords, and it is the only approach that scales past a handful of accounts.
• Make sure your email password is unique and strong. Your email is the reset mechanism for everything else.
• Long beats complex. A multi-word passphrase is easier to remember and far harder to crack than P@ssw0rd!.
• Never store passwords in a note file, a spreadsheet, or a chat with yourself.
• Change a password immediately if a service reports a breach, and change it everywhere else if you had reused it.

• Check the actual domain, not the display name. 'PayPal' in the sender name proves nothing.
• Urgency and threats are the tell. 'Your account will be closed in 24 hours' exists to stop you thinking.
• Hover before you click and read where the link actually goes.
• Attachments from anyone, including people you know — accounts get compromised. This is the most common real-world infection route.
• If it is unexpected, verify through a channel you chose: type the site address yourself, or phone the number on your card.
• Never be asked for your password, PIN or OTP by anyone. No legitimate organisation ever asks.

• Update your phone and browser. Most exploited vulnerabilities are patched in the very next release.
• Lock your screen. A logged-in session is the most common consequence of a stolen device.
• Review what apps have camera and microphone access, and revoke anything you do not use.
• Check login activity on your main accounts once a quarter, and revoke sessions you do not recognise.
• Minimise what you share publicly. Every detail is a password-recovery answer to someone patient.