Legacy Mapped → Guides → Essentials → Account safety

How to keep your online accounts safe: a plain-English guide

Most account break-ins don't need clever hacking. They rely on a reused password, a missing second step at login, or a convincing fake message. Seven habits close most of those gaps. The last step makes sure that keeping your accounts safe doesn't also lock out the people who may one day need to help.

Think you've been scammed? Go straight to what to do now.

Last changed: 2 November 2026

1. Start with your email account

Your email is the master key to everything else. Almost every "forgot password" link goes to your inbox, so someone who gets into your email can reset the passwords on your other accounts. If you only have time to secure one account today, make it your main email.

Source: Australian Cyber Security Centre (ACSC), multi-factor authentication guide (PDF)

Want this done for you? See the Guided Inventory ↓

2. Use a different passphrase for every account

A passphrase is a password made of several random words, such as purple-kettle-harbour-violin. In this guide, "passphrase" just means a long password. It's easier to remember and harder to guess than a short jumble of characters. Strong passphrases have four or more random words and 15 or more characters, and they're different for every account.

Using a different passphrase everywhere matters most. When one website is breached, criminals try the same email and password on banks, email and shopping sites. If every account has its own passphrase, a leak from one site stays at that site.

Nobody can remember dozens of passphrases, and you don't need to. The Australian Government suggests a password manager to store them. We recommend Bitwarden: you remember one strong passphrase, and it remembers the rest. See how it compares with other password managers.

Sources: NT Government Cyber Security, passphrases; Act Now. Stay Secure. fact sheet (PDF)

3. Turn on multi-factor authentication

Multi-factor authentication (MFA), sometimes called two-step verification or two-factor authentication, asks for a second proof at login, usually a code or a tap on your phone. Even if a criminal learns your passphrase, they still can't get in without that second step. To turn it on, look in the account's Settings, usually under Security or Sign-in.

The ACSC suggests switching it on in this order:

1. Email accounts
2. Online banking and other financial services
3. Accounts that store your payment details, such as shopping sites and PayPal
4. Social media
5. Other accounts holding personal information, such as myGov

When an account offers a choice, the ACSC ranks the options like this: a physical security key (a small USB key you plug in or tap) is the most secure, and an authenticator app (a free app such as Microsoft Authenticator or Google Authenticator that shows a new 6-digit code every 30 seconds) is more secure than receiving a code by text message (SMS).

When you turn on MFA, most services show you a set of backup codes. Save them. They're how you get back in if you lose your phone. And if you change phones, move your authenticator app to the new phone before you reset the old one.

Source: ACSC, multi-factor authentication guide (PDF)

4. Keep your phone and computer updated

Updates fix security holes that criminals already know about. Install them when they're offered, and turn on automatic updates where you can. That applies to your phone, computer, tablet and the apps on them.

Source: Act Now. Stay Secure. fact sheet (PDF)

5. Learn the signs of a scam

Many break-ins start with a message that looks real: a text from "myGov", an email from "your bank", a call about a parcel. Scamwatch's three-word rule is a good habit:

• Stop. Always take a moment before giving your money or personal information to anyone.
• Check. Make sure the person or organisation you're dealing with is real. Go to their official website or app yourself, rather than using the link or number in the message.
• Protect. Act quickly if something feels wrong.

Three rules that catch a lot of scams:

• Services Australia (myGov, Centrelink and Medicare) won't send you a link in a text message or email. Sign in by typing my.gov.au yourself.
• Never share a login code or a crypto recovery phrase with anyone who contacts you, however official they seem. A real organisation won't contact you out of the blue and ask for them. Legacy Mapped will never ask for your passwords, your passphrase or a sign-in code.
• Never let a caller connect to or take control of your computer or phone. Australian Government agencies will never contact you asking for remote access to your computer. If a call seems suspicious, hang up and report it to Scamwatch.

Sources: Scamwatch, Stop. Check. Protect.; Services Australia, avoid and report scams; ACSC, protect yourself against remote access scams

6. Be careful on public Wi-Fi

Free Wi-Fi in cafés, airports and hotels is convenient, but avoid using it for your most sensitive accounts, such as banking. If you need to check your bank while you're out, use your phone's mobile data instead.

Source: Act Now. Stay Secure. fact sheet (PDF)

7. Don't lock out the people who'll need to help

Here's the part most security guides leave out. Every step above makes your accounts harder to get into, which is the point. But if you're ever seriously ill or you die, the same protections can leave your family and executor completely stuck: the passphrases are in your head, the codes go to a locked phone, and the backup codes are lost.

You can be secure and prepared:

• Keep your passphrases in a password manager with emergency access, so a trusted person can ask for access after a waiting period you control. How emergency access works.
• Store your other accounts' MFA backup codes in that password manager, not in your email or on a sticky note.
• Keep the password manager's own recovery code somewhere safe outside it, such as a sealed envelope with your important papers. Bitwarden says you must save this code somewhere you can find it outside your vault, and that it can't retrieve the code for you. (Bitwarden help)
• Write down which accounts exist and what you want done with each, but never the passwords themselves.
• Remember that your executor shouldn't log in as you to banks, super funds or government services. Those organisations have their own deceased-estate processes. What happens to online accounts when you die.

If something goes wrong

If you think an account has been broken into, or you've given details to a scammer, act quickly:

1. Call your bank immediately if money may have been taken, you've shared financial details, or you let someone onto your computer. (Scamwatch; ACSC)
2. Change the passphrase on the affected account, and on any other account that used the same one. Start with your email.
3. Report a cybercrime through ReportCyber, or call the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371), available 24/7. (cyber.gov.au)
4. Get free identity-theft support from IDCARE on 1800 595 160 (weekdays, 8am to 5pm AEST). (ATO)
5. Report scam messages to Scamwatch, and forward fake myGov messages to reportascam@servicesaustralia.gov.au. (Services Australia)

Your quick checklist

• Main email has a strong, unique passphrase and MFA turned on
• Banking, PayPal, shopping, social media and myGov have MFA turned on
• No passphrase is used on more than one account
• A password manager holds every passphrase (we recommend Bitwarden)
• MFA backup codes are saved in the password manager
• The password manager's own recovery code is stored safely outside it
• Phone, computer and apps update automatically
• A trusted person has emergency access, and you've recorded which accounts exist

This guide is general information only, not legal, financial or technical advice for your situation. Services change their security settings and contact details, so always confirm the current steps on the linked official page. Sources checked on 30 October and 2 November 2026.