Free tools Windows power users keep installed
One-click scans. No signup required.
To reduce the risk of phishing and account takeover, verify unexpected requests through a known-good app, website, or phone number; use a different password for every account; and enable multi-factor authentication (MFA), preferably a passkey or security key where supported. If you already shared information, act through the genuine service and use the recovery steps below.
How to tell when a message may be phishing
Phishing messages impersonate companies or people you recognize and try to rush you into clicking a link, opening an attachment, replying, or sharing information. A scammer might claim there is a suspicious login, payment problem, invoice, refund, or account hold. A familiar logo or display name does not prove the sender is genuine.
As an Amazon Associate I earn from qualifying purchases.
Warning signs include an unexpected request to update payment details, a generic greeting, or a link urging you to “fix” an account issue. The Federal Trade Commission (FTC) recommends treating these messages cautiously. Don’t use the message’s link or phone number to investigate. Instead, open the service’s app or type its known web address yourself, or call a number from a trusted source. FTC guidance on recognizing and avoiding phishing
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsProtect the accounts an attacker could use to reach others
Use a unique password for every account
If attackers obtain a password from one service, they may try it on other services. Use a different password for each account, and change it promptly through the genuine service if you learn it may have been exposed. Change it anywhere else you reused it, too. A password manager can help generate and retain distinct passwords; it does not prevent every phishing attack. CISA guidance on protecting against phishing
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Turn on multi-factor authentication
MFA, also called two-factor authentication, asks for an additional proof of identity beyond your password. The FTC says MFA makes it harder for someone to log in even if they have your username and password. Start with your primary email account, because access to it may help someone reset other passwords, then enable MFA on financial, payment, social-media, and tax accounts. Find the option in each service’s security or sign-in settings; labels and available methods vary.
Choose the strongest method the service supports and that you can use reliably. CISA encourages phishing-resistant FIDO authentication, including passkeys and hardware security keys, when available. The FTC describes physical security keys as the strongest method among the two-factor options it discusses. A key must work with both your account and device; check the provider’s compatibility and recovery instructions before relying on one. CISA guidance on phishing-resistant MFA FTC guidance on two-factor authentication
Rank #2
- Requires 3 "AAA" batteries (included)
- Unit auto-locks for 30 minutes after 5 consecutive incorrect PINs
| Method | What to consider |
|---|---|
| Passkey or FIDO security key | Phishing-resistant options emphasized in CISA guidance. Availability depends on the account and device; check compatibility and recovery options. |
| Authenticator app | Avoids the specific phone-number takeover weakness of SMS codes, though ordinary one-time codes can still be phished. |
| Text-message code (SMS) | Depends on your phone number and is exposed to SIM-swap risk. If it is the only method offered, the FTC says it is better than no second factor. |
Never give a verification code to someone who contacts you unexpectedly. A caller or message sender may pretend to be a service or support agent, but you should not share a code for an interaction you did not initiate.
Make devices and data more resilient
- Set phones and computers to install software updates automatically where practical, including security software.
- Back up data on your computer and phone.
- If you use a password manager, pay attention to where it fills credentials. CISA notes that filling credentials only on valid websites can help signal an anomaly; this is a useful cue, not a guarantee against phishing.
These steps help with device resilience, but they do not make an unexpected message trustworthy. FTC phishing guidance
Quick Recap
Rank #4
- FIDO-ONLY FUNCTIONALITY: Supports FIDO2 (passkeys) and FIDO U2F protocols for passwordless and second-factor authentication. Does not support OTP, TOTP, Smart Card (PIV), or other advanced features - upgrade to YubiKey 5 Series for extended functionality
- SECURE AND CONVENIENT: Passwordless MFA login with the YubiKey Bio authenticator and biometric information using a fingerprint, with a PIN as a fallback. Simply plug in via USB and use your fingerprint to authenticate
- DEVICE & OS COMPATIBILITY: Compatible with Windows, macOS, ChromeOS, and Linux. Works seamlessly with supported services like Google and Microsoft accounts, and major password managers. See the full compatibility list at "Works With YubiKey"
- DURABLE & RELIABLE: Resistant to tampering, water, and crushing. No batteries or network connectivity required, offering dependable authentication without any downtime. Securely manufactured in USA & Sweden
- Yubico Authenticator App - Fingerprint enrollment, passkey management and PIN configuration available via the app app - Upgrade to YubiKey 5 Series to generate one-time-passwords (OTP) via Yubico Authenticator and for advanced compatibility (OATH, PIV)
What to do if you clicked a phishing link or shared information
- If you only clicked: Stop interacting with the message. Contact the organization through its known app, website, or a trusted phone number rather than continuing from the link.
- If you entered a password: Go directly to the genuine service and change it. If you reused that password, change it on every account where it was used. Turn on MFA and review the account’s security options.
- If you shared personal, bank, or card details: Go to IdentityTheft.gov for steps tailored to the information lost.
- If a file may have downloaded: Update your security software, run a scan, and remove anything it identifies as a problem.
- Report the attempt: Forward phishing email to [email protected], forward phishing texts to SPAM (7726), and report the attempt at ReportFraud.ftc.gov.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
