TechLein Security Guides: How to Protect Your Accounts, Phone and Money

Most security advice arrives as an unordered pile: strong passwords, watch for phishing, update your software. Every item is reasonable, and together they are useless, because nothing says what to do first. These TechLein security guides are organised differently: a priority-ordered plan in three tiers, where the first tier stops most real attacks.

Tier 1: The Things That Stop Most Real Attacks

A unique password on your email account

Your email is not one account among many. It is the master key. When you forget a password to your bank, a shopping site or a government portal, the reset link lands in your email — so whoever controls your email controls the reset process for nearly everything else you own. An attacker need not break into your bank if they can ask it for a reset and collect it.

Email security therefore sits above your other accounts, not beside them. Securing it first is the single highest-value action available to you, and takes ten minutes. That password should be used nowhere else, and not be a variation of another.

Two-factor authentication on email and banking

Two-factor authentication means a stolen password alone is not enough: if it leaks in a breach elsewhere, an attacker hits a second wall. Turn it on for email first, then banking and payment apps.

A screen lock on your phone

Your phone holds your email, payment apps and the codes protecting both, so an unlocked phone in the wrong hands is a complete account takeover with no hacking required. A six-digit PIN or biometric lock closes that door; avoid patterns, easily read over a shoulder.

Keeping your phone and browser updated

Updates are boring, which is why they get postponed indefinitely. But many successful attacks exploit flaws fixed months earlier in an update the victim never installed. Turn on automatic updates and forget about it.

Tier 2: Closing the Common Gaps

A password manager

Reused passwords are the root cause of most account takeovers. The mechanism is unglamorous: a site you barely remember gets breached, your address and password end up in a list, and attackers try that pair on hundreds of services automatically. If you reused it, they are in. A password manager makes every password different and removes the need to remember them.

App-based or hardware two-factor rather than SMS

SMS codes beat nothing, and if SMS is your only option, use it. But they carry a weakness worth stating honestly. In a SIM swap, an attacker persuades a mobile operator to move your number to a SIM they control, usually by impersonating you with details gathered elsewhere; once your number is theirs, your codes go to them. An authenticator app generates codes on your device with no phone number involved, so a SIM swap does not reach it. Prefer it, or a hardware key, for email and banking.

Reviewing app permissions and logged-in devices

Over years of installing things, apps accumulate access to your contacts, location, microphone and files they never needed. Work through your privacy settings by category, asking one question of each: does this app need this to do its job? A photo editor needs photos; a flashlight does not need contacts.

Then check the active sessions list most accounts provide: it answers whether anyone else is already inside. Sign out anything you do not recognise.

Tier 3: Recovery, Because Some Problems Cannot Be Prevented

Ransomware and a lost phone have something in common: neither is fully preventable, and both are survivable if you prepared. They are recovery problems, and backups answer recovery problems. That makes a backup a security measure, not a convenience.

Back up your phone and important files on a schedule you do not have to think about, and choose encrypted backups where offered, so a copy falling into someone else’s hands is not itself a breach. Then learn your recovery options before you need them: recovery email, recovery phone, backup codes. Being locked out is the worst moment to find your recovery address is one you abandoned.

How Modern Scams Actually Work

Lists of specific scams age badly: a new variant appears, matches nothing on your list, and fails exactly when you need it. Learn the shape instead, which barely changes.

Nearly every scam aimed at an individual has four parts. Manufactured urgency: something terrible is happening now and you must act immediately — urgency exists to stop you thinking, because thinking breaks the scam. An authority figure: police, a bank’s fraud team, a courier, a government office. A move to another channel, usually a call or messaging app, away from any official system that might warn you. And the ask, which is always a code, a payment, or remote access.

Once you can see that shape, you are protected against scams you have never encountered, including ones that do not exist yet. Real institutions do not work this way, and do not mind if you hang up and call back on a number you looked up.

If a conversation pressures you to act before you can think, that pressure is the attack.

The One Rule That Prevents Most Account Theft

Never share a one-time code with anyone, for any reason. Not with your bank, a delivery agent, technical support, a police officer, or anyone who says they sent it by mistake. No legitimate situation exists in which another person needs a code sent to you. The code proves you are you; handing it over hands over the account.

The First Hour After Being Compromised

Order matters, because the wrong sequence lets an attacker undo your work.

1. Change your email password first, from a device you trust.
2. Sign out all other sessions; a new password does not always eject someone already logged in.
3. Check recovery settings and forwarding rules. Attackers commonly add their own recovery address and a rule that silently copies your mail to them. This is the step people skip, and how they keep access afterwards.
4. If money is involved, contact your bank immediately through its official number or app, and report the matter to your local authorities promptly.
5. Warn your contacts. A compromised account is used next against the people who trust you.

Protecting Less Technical Family Members

The people in your family least comfortable with technology are targeted hardest. Helping is not a lecture about vigilance; it is doing the setup yourself. Do Tier 1 on their behalf, then give them two sentences to keep: never share a code, and when someone creates urgency, hang up and call you. Be the person they can call without embarrassment, since shame stops people asking early.

Risk, Fix, and Time Required

Where to Go Deeper

• Online safety guide — the broad starting point, covering the landscape rather than one threat.
• Secure your WhatsApp account — for anyone whose messaging app is also their family group and a cloning target.
• Secure your Android phone — a setting-by-setting walkthrough for the device holding everything else.
• UPI payment fraud protection — for daily UPI users, on how payment requests are misused.
• The digital arrest scam explained — the urgency-plus-authority pattern dissected in detail.
• Protect your privacy online — for those past the basics who want less data collected.
• Back up your phone data — the companion to Tier 3, for anyone who has never set up a backup.

These sit alongside our wider TechLein tutorials, and everything we publish is on the TechLein technology news, tutorials and reviews homepage. For how we approach this work, read about TechLein.

Frequently Asked Questions

If I can only do one thing today, what should it be?

Put a unique password on your email account and turn on two-factor authentication. Email is where password resets for other accounts arrive, so protecting it protects everything downstream.

Is a password manager safe? It feels risky to put everything in one place.

The comparison is not between a password manager and perfect security, but between a manager and reusing passwords. A reputable manager encrypts your data so only your master password unlocks it, removing the largest cause of takeovers.

Someone claiming to be from my bank asked for the code they just sent. Should I give it?

No. Nobody legitimate needs a one-time code sent to you. If you are unsure whether a call is genuine, end it and call your bank on the number printed on your card or in its official app. A real representative will not mind.

I think I have already been compromised. What should I do first?

Change your email password from a device you trust, sign out all other sessions, then check your recovery email, recovery phone and forwarding rules for entries you did not add. If money is involved, contact your bank through official channels and report to your local authorities promptly.