How to harden a high-value online account without locking yourself out

What to take away

Pick one account whose loss would hurt: primary email, password manager, bank, cloud storage, or the account you publish from. Then follow the provider's own instructions. Banks, employers and government services set their own rules, so use their official support channel when a step is unclear.

Start from a path you chose

Type the provider's address yourself, or open the app you already have installed. Never start from an alert, a search ad, a QR code or a link in a message, because those are the usual delivery routes for a fake sign-in page.

Update the device and browser first. Note the time and which device you are on. If the account already shows changes you did not make, stop hardening and treat it as a compromise instead.

Confirm recovery control first

Open the recovery settings and read what is listed there: backup email, phone number, trusted contacts, printed codes, identity details. Delete anything you do not recognize, but photograph the screen first if you think someone else has been inside.

Then check that you can actually get into the recovery email on its own. A recovery inbox protected by a weak password is the weakest link in the whole chain.

Call your mobile carrier and set its account PIN or port-protection option. Without it, someone who moves your number to their SIM can receive your codes. Never let one inbox be the only way back into everything else.

Decide where the credentials live

Choose the password manager or platform keychain that will hold this account, and protect that with its own strong credential and current recovery details.

If the service still uses a password, generate a long random one and let the manager fill it at the exact domain. Do not paste it into notes, an email draft or a chat window, even your own.

Add the strongest method the account offers

If the provider supports passkeys or a hardware security key, read what happens when you lose the device or switch phones, then enroll from the real settings page. Otherwise add an authenticator app, or whichever second factor the provider ranks highest.

CISA's consumer guide to turning on multifactor authentication walks through the common settings paths and the differences between text codes, authenticator apps and biometrics. It explains how to enable a second factor. It does not rank implementations or prove that any one account is safe from phishing.

Name each authenticator so you can tell them apart later. Write down which device holds which one, never the secret itself.

Add a backup, then test both

Enroll a second authenticator that does not share a failure with the first. A spare security key kept somewhere else, a second trusted device, or printed recovery codes all work. Two keys in the same bag fail together.

Then test. Open a private browser window or pick up the other device and sign in with the backup alone. Confirm the code or prompt reaches the right account. Only after that works should you delete an old authenticator.

Change the password last

Replace a reused or exposed password with a generated one. Save it in the manager before you submit the form, because the old value stops working the moment you do. Then confirm autofill fills it at the exact domain.

Do not rotate a unique password on a calendar. Change it when you have reason to think it is exposed or reused, or when your employer's policy requires it.

Clear sessions and connected apps

Open the security page and read the list of signed-in devices, sessions and app passwords. Sign out anything you do not recognize and anything you no longer use. If you suspect a compromise, use the provider's sign-out-everywhere option and sign back in on your own devices.

Do not judge a session by its city. Mobile networks, VPNs and provider geolocation routinely make a legitimate login look foreign.

Cut third-party access

Review connected apps, delegated users, forwarding rules, and mail filters. Also review API tokens, calendars, and payment permissions. Revoke anything unexplained, unused, or broader than the job needs.

On email, check the sent, deleted, forwarding and filter settings, since a hidden forwarding rule is a common way to keep reading mail after a password change. On publishing accounts, check scheduled posts, administrator roles, integrations and ad or payment access.

Set alerts you will actually read

Turn on notifications for sign-ins, recovery changes, new authenticators, data exports, payments and administrator changes where the provider offers them. Send them somewhere separate from the account itself.

Test one alert by opening the app or typing the address yourself. Never read a one-time code to anyone, and never approve a push prompt that you did not trigger.

Write the recovery card

Without deleting your primary method, confirm you know four things: the provider's official recovery page, its support route, where the backup key or codes are kept, and your carrier's contact number. Put those on a card, leave off anything reusable, and store it somewhere you would look in a bad week.

Rebuild the whole setup after a new phone, a lost device, a staff departure, a long trip, a security alert or a change in what the provider supports.

Common questions

Should I remove the old authenticator right away?

No. Keep it until the new primary and the backup both sign in successfully. Once they do, remove it the same day, because a forgotten method is one more thing an attacker can use.

Can one phone hold both the passkey and the authenticator app?

It can, and that is fine for a low-value account. For a high-value one it creates a single point of loss, so keep a separately stored key or printed codes as well.

Should I trust the location in a login alert?

Treat it as a hint, not proof. Carriers, VPNs and provider geolocation can all place a real sign-in in the wrong city, and a careful attacker can look local.

What belongs on the recovery card?

Official recovery addresses, provider and carrier phone numbers, where each backup method is stored, and the order to try them. No passwords, no codes, no answers to security questions.