Cyber Safety Checklist

A practical starting point for protecting everyday accounts and devices. Choose one step at a time and use the official recovery options for each service.

Secure your accounts

1. Use a password manager to create a long, unique password for every important account. Never reuse your email password elsewhere.
2. Turn on multifactor authentication (MFA) or a passkey wherever available. Prefer phishing-resistant options when the service supports them.
3. Review recovery email addresses, phone numbers, signed-in devices, and active sessions. Remove anything you no longer recognize.
4. Store recovery codes somewhere private and separate from the device you use to sign in. Never share a one-time code with someone who contacts you.

Spot suspicious messages

• Pause before opening unexpected links, attachments, QR codes, or payment requests—even if the message appears to come from someone you know.
• Check the complete website address and confirm requests through a separate, trusted channel. Do not use contact details supplied in a suspicious message.
• Legitimate support staff should not ask you to reveal your password or one-time verification code.

Protect devices and files

• Install operating-system, browser, and app updates from their official update mechanism; enable automatic updates when practical.
• Use a screen lock, device encryption where available, and only install software from sources you trust.
• Keep another copy of important files on a separate or offline backup. Test that you can restore a file.
• Review app permissions and remove access an app no longer needs.

If you think an account was compromised

1. Use a device you trust and open the service by typing its known address or using its official app.
2. Change the affected password to a new, unique one. Secure the email account used for recovery too.
3. Sign out other sessions, remove unfamiliar recovery methods or connected apps, and enable MFA.
4. Contact the service using its official support process. If money or identity documents may be affected, contact the relevant provider or authority using a verified channel.
5. Save relevant evidence safely, but do not forward harmful content or publish private information.

Privacy note: Never put passwords, recovery codes, private keys, identity documents, or sensitive incident details into a public form or an untrusted website.

Trusted starting points

• CISA Secure Our World — practical guidance on strong passwords, MFA, updates, and phishing.
• Have I Been Pwned — checks an email address against known breach records. Never enter a password there; a result is not proof that an account is currently compromised.

This checklist is general educational information, not legal advice or emergency assistance. For immediate danger, contact local emergency services.