Protect your accounts by using a unique password for each service, enabling the strongest multifactor authentication (MFA) the service supports, and verifying unexpected requests through a channel you trust independently. AI can make a fake email, voice, or image more convincing, but it does not change the core defense: do not let a message or caller dictate where you sign in or what code you share.
What AI changes—and what it does not
AI can help scammers produce polished messages or imitate a familiar person’s voice or appearance. The FBI warns that publicly shared audio, videos, and photos can be used to create deepfakes or other AI-generated content (FBI: Stay Safe Online). A familiar voice, correct personal detail, convincing logo, or caller ID is not proof that a request is genuine.
As an Amazon Associate I earn from qualifying purchases.
The attack still needs you to take an action: enter a password on a fraudulent site, disclose a one-time code, or approve a login you did not start. Criminals may pose as financial-institution or support staff to obtain credentials and codes (FBI: Online Scams). You cannot reliably determine whether a message was written by AI just by judging its style, so verify the request rather than trying to detect the writing.
Recommended Free Tools
Protect the accounts that can unlock others
Start with accounts that can reset passwords or expose money and personal information: your primary email, mobile-carrier account, banking and payment accounts, and major social or identity accounts. If someone controls your email, for example, they may be able to initiate resets for other services.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Review recovery email addresses and phone numbers; remove any you no longer control.
- Secure the recovery email account as carefully as the accounts it can restore.
- Check the account’s official security settings and help pages for current recovery and session controls; labels and options vary by provider.
Use unique passwords and turn on MFA
Replace reused passwords
Give every important account its own strong passphrase. Reusing a password lets a credential stolen from one service be tried on another. The FBI recommends unique, strong passphrases and a reputable password manager to create and retain them (FBI: Simple Tips for Adults).
Choose the strongest MFA the service offers
MFA adds a check beyond your password, but the methods are not equally resistant to phishing, code interception, SIM swaps, or repeated approval prompts. Choose a phishing-resistant FIDO method when it is supported, and set up the provider’s recovery options before you lose access to a key or device. The FBI says some websites and apps offer passkeys; support varies by service (FBI: Simple Tips for Adults).
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
| Method | How to use it | Important limitation |
|---|---|---|
| FIDO2 security key or supported passkey | Prefer this when available. A hardware security key can provide strong protection against fake-site credential capture; check that your account supports the standard and plan recovery if a key or device is lost. | Compatibility and recovery options depend on the provider and device. FBI and CISA recommend FIDO2/security keys or passkeys for phishing resistance (CISA: More than a Password; FBI: Improve Cyber Resiliency). |
| Authenticator app with number matching | Use as a fallback when a phishing-resistant option is unavailable. Match the number shown on your login screen and inspect any displayed domain. | It is not phishing-proof; follow the app’s context and never approve an unexpected prompt. FBI organizational guidance recommends number matching and domain display (FBI: Improve Cyber Resiliency). |
| Rotating authenticator code | Use rather than password-only access if stronger methods are unavailable. | A scammer can still trick you into entering a code on a fake sign-in page or disclosing it while impersonating support (CISA: More than a Password; FBI: Online Scams). |
| SMS or email code | Use only if the service does not offer a stronger practical option. Keep codes private. | These are weaker choices and may be exposed to interception or social engineering; never read a code to an unsolicited caller (CISA: More than a Password; FBI: Online Scams). |
| Push approval without context | Approve only a login you initiated and can verify. | Repeated unexpected prompts can be an attempt to wear you down after a password has been obtained. Deny them; do not tap approve simply to stop the alerts (FBI: Improve Cyber Resiliency; CISA: More than a Password). |
CISA’s method comparisons are written for small and medium businesses, and the FBI’s FIDO deployment language is organizational guidance; apply the practical principle to consumer accounts by selecting the strongest option your provider offers. MFA is an important layer, not a guarantee against takeover (CISA: More than a Password).
Free tools Windows power users keep installed
One-click scans. No signup required.
Verify suspicious emails, texts, calls, and account alerts
For an unexpected password reset, fraud alert, delivery notice, shared document, support call, or request to “secure” an account, do not use the link or phone number supplied in the message. Instead:
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Open the provider’s known app, type its familiar address yourself, or use a saved bookmark.
- For a call or payment issue, contact the organization using a number from its official website or your payment card—not a number read to you by a caller.
- Check for the alert or request inside the account and follow the provider’s official security flow.
- Never give a password or one-time MFA code to someone who contacts you, even if they claim to be support or your bank.
The FBI advises using bookmarks or favorites for login sites, avoiding message links, treating unsolicited callers with suspicion, and never giving an employee your username, password, or one-time password (FBI: Online Scams).
What to do about an unexpected MFA prompt
If a login approval appears when you are not signing in, deny it. Do not share a displayed code. The prompt may mean someone already has your password and is seeking the final approval. Go to the service through its official app or a bookmarked site, change the password, and review active sessions and connected devices. If prompts keep arriving, use the provider’s official security or account-recovery process rather than responding to a caller or message about them.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
If you gave away a password or verification code
Act promptly, using the affected service’s official app, known website, or independently verified support channel. If financial details or money may be involved, contact your bank or payment provider as soon as you recognize the fraud and monitor for unauthorized activity; the FBI advises financial customers to contact their institution promptly (FBI: Online Scams).
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →- Change the exposed password, and change it anywhere else you reused it. Use a distinct passphrase for each service.
- Secure recovery email addresses and phone numbers, remove ones you do not control, and review active sessions or connected devices. Sign out sessions you do not recognize where the provider offers that control.
- Turn on the strongest available MFA and review the account’s recovery process. Do not approve further prompts you did not initiate.
- Check financial transactions and other account activity for unauthorized changes. Contact the relevant institution through a verified channel if anything is wrong.
- If money was lost or a crime occurred, report it through the appropriate official channel. The FBI directs victims to the Internet Crime Complaint Center (IC3) (IC3).
Recovery steps and reporting options vary by provider and jurisdiction. Use the provider’s official account-recovery instructions if you can no longer sign in.
Quick Recap
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
