The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
To secure your accounts against AI-powered phishing, make stolen credentials harder to use. Use passkeys or FIDO/WebAuthn security keys on important accounts when available, use a password manager to create unique passwords for the rest, and treat unexpected sign-in requests and verification-code requests as suspicious. Protect recovery methods too: a weak recovery route can undermine a strong sign-in method.
What changes when phishing messages are written with AI?
AI can help scammers produce more convincing messages, but it does not change the basic defense: don’t let a deceptive message turn into reusable account access. A message that looks polished, sounds familiar, or appears well written is not proof that it is genuine. NIST warns that increasingly capable AI can be used to craft more convincing phishing messages in its phishing guidance.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesAI-generated lures may imitate a company’s tone, personalize a request with details from public profiles, or create convincing urgency without the spelling errors people traditionally look for. Treat a familiar name, logo, writing style, or caller ID as easily copied. The important question is not whether the message looks authentic, but whether the action is being performed through a channel you independently trust.
Be especially cautious when an unexpected message urges you to click a link, open an attachment, sign in, transfer money, or provide sensitive information. Rather than judging legitimacy by spelling or tone, verify the request through a route you already trust. Open the service using a saved bookmark or an address you type yourself, or contact the organization using a number you already know is legitimate.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Pause before responding to pressure. A request to “verify immediately,” an invoice that changes payment details, a password-expiration warning, or a demand for a one-time code should all be handled by leaving the message and starting a new session with the real service. Never let an attacker choose both the message and the login path.
The official guidance cited here describes the threat qualitatively; it does not establish a rate at which AI-powered phishing causes account compromise. There is no AI-specific compromise percentage to use as a reliable measure of your personal risk.
Which accounts should you secure first?
Start with accounts that hold sensitive information or can unlock other accounts. Your primary email account is particularly important because it may be used to reset passwords elsewhere. CISA recommends making an inventory of valuable accounts, including email and social media, in its Mobile Communications Best Practice Guidance.
- Primary email: Secure the inbox used for password resets and account notices.
- Work identity and cloud storage: Prioritize accounts that provide access to business systems, files, or other people’s information.
- Financial accounts: Protect accounts where unauthorized activity could move or expose money.
- Social accounts and other high-value services: Include accounts that contain sensitive information or could be used to impersonate you.
Make the inventory practical: note the service, the email address or phone number used for recovery, the available MFA methods, and whether a password is reused elsewhere. This list helps you find hidden dependencies, such as a shopping account that uses your primary email for resets or a cloud account that stores identity documents.
Secure the account that controls recovery before less important accounts. If an attacker takes over that mailbox, changing passwords on individual services may not be enough because reset messages can still be intercepted. After the highest-value accounts are protected, work through the rest of the inventory instead of waiting for a breach to reveal which services matter.
This is a prioritization method, not a reason to leave lower-priority accounts unprotected. Once you have secured the accounts that can unlock others, work through the rest of your inventory.
Are passkeys and security keys safer against phishing?
Where a service supports them, passkeys and FIDO/WebAuthn security keys are the strongest phishing-resistant sign-in options described in the cited guidance. Their cryptographic authentication is associated with the legitimate verifier, so a lookalike phishing site cannot simply capture and replay the credential as if it were the real site.
CISA says FIDO/WebAuthn is the only widely available phishing-resistant authentication in its More than a Password guidance. NIST’s SP 800-63B explains that phishing resistance relies on binding authentication to the legitimate verifier or channel. Its authenticator examples include FIDO U2F and FIDO2 passkeys with user verification.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
To enable one, open the account’s security settings and look for labels such as “passkey,” “security key,” “FIDO,” or “WebAuthn.” Names and menu locations differ by provider, so use that service’s own help instructions if the option is not obvious. Confirm what devices and connection methods the service supports, and review how you will recover the account if your enrolled device or key becomes unavailable.
A safe enrollment sequence is straightforward:
- Start from the provider’s app or a bookmark you already trust, not from an email or text link.
- Open security or sign-in settings and verify the account identity before adding a factor.
- Register the passkey or key, completing the device unlock or user-verification step the provider requests.
- Sign out and test the new method, if the service permits a test, before removing an older factor.
- Record the recovery options and enroll a second usable method when the provider supports it.
Phishing resistance protects the authentication exchange; it does not make every account setting safe. Continue to scrutinize recovery, support, and session-management options, since those may follow different rules.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Passkey or physical security key?
A passkey can use a device you already have; a hardware security key is a separate physical item that may work across services that support it. Neither option is universal: service support and device compatibility vary. A hardware key may require a particular port or NFC, depending on the device and key. Check compatibility and recovery procedures before relying on one. CISA’s mobile guidance describes hardware-based FIDO keys as most effective where feasible and passkeys as an acceptable alternative; that guidance is not a model-by-model product assessment.
CISA gives Yubico and Google Titan as examples of hardware-based FIDO keys. Those examples do not establish a preferred model, current availability, price, or performance ranking. Choose only after checking the services you use, the computers and phones you carry, and whether the key connects by USB, NFC, or another supported method.
Where supported, enroll a usable backup method or follow the provider’s recovery procedure before you depend on a single device or key. A primary factor is only practical if you can still regain access when it is lost or unavailable. Store a spare key in a secure place if your account and provider make that approach workable, and understand how a lost key is revoked.
Are authenticator apps or SMS codes enough?
They are better than having no second factor when those are the only options, but manually entered codes are not phishing-resistant. An attacker can create a fake sign-in page, capture a code you enter, and relay it to the real service while it is still valid. NIST explains in SP 800-63B that manual entry does not bind an authenticator output to the specific login session.
Free tools Windows power users keep installed
One-click scans. No signup required.
An authenticator app is generally less exposed to SIM swapping than SMS, but an app-generated code can still be phished. SMS and email codes are fallback options, not substitutes for a passkey or security key when one is available. The FTC’s two-factor authentication guidance says using a second factor is better than having none, while recommending stronger options when available.
Push approvals are also not automatically safe. If you receive an unexpected approval prompt, deny it; never approve a sign-in you did not initiate. An attacker may generate repeated prompts in an attempt to make you approve one. If prompts continue, change the password through a trusted route and review active sessions and enrolled devices.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Do not read a code to a caller, chat contact, or “support agent” who contacted you first. The code is intended for the service’s sign-in flow, not for proving your identity to another person. If you initiated a support call using a known number, follow the provider’s documented process instead of accepting an unsolicited request for a code.
| Sign-in method | Phishing resistance | Practical takeaway |
|---|---|---|
| Passkey or FIDO/WebAuthn security key | Designed to resist fake-verifier credential capture; NIST lists FIDO authenticator examples as phishing-resistant. | Prefer on important accounts when the service supports it; check device compatibility and recovery. |
| Authenticator-app code | Not phishing-resistant when you manually enter the code. | Generally less exposed to SIM swapping than SMS, but do not enter a code on a page reached through an unexpected message. |
| SMS or email code | Not phishing-resistant when manually entered; SMS may also be exposed to SIM swapping. | Use if it is the only second factor offered, then review whether the account allows stronger sign-in or recovery options. |
| Push approval | Can be abused through repeated unexpected prompts. | Deny prompts you did not initiate. |
If you enroll a stronger factor, check whether the account still permits SMS as a fallback or recovery route. CISA’s mobile guidance recommends disabling weaker SMS MFA after stronger FIDO enrollment where the service allows it, while noting that SMS may remain in account recovery. Removing a factor without confirming another recovery path can lock you out, so document the provider’s process first.
How should you protect passwords that still matter?
Some services still require passwords. Use a password manager to generate and store a different strong password for each such account, and secure the password-manager account itself with MFA if available. NIST’s password guidance, updated January 5, 2026, supports using unique passwords rather than reusing one across services.
Uniqueness limits the damage if one service is breached or you accidentally enter a password on a fake site: the exposed password should not also unlock your other accounts. A password manager helps prevent reuse, but it does not verify that a login page is genuine. Before filling in credentials, make sure you reached the intended site through a trusted route.
Protect the manager as carefully as the accounts it stores. Use a unique manager password, enable its strongest available MFA, keep recovery information current, and understand how to regain access if you lose a device. Do not copy a password into an unsolicited support chat or disclose the manager’s recovery code to anyone who contacts you.
If you learn that a password was exposed, change it on the affected account and anywhere else you reused it. Do not wait for suspicious activity before replacing a password you know has been compromised.
How do you secure account recovery and your phone number?
Review recovery methods with the same care as everyday sign-in. An account that uses a strong passkey at login may still be vulnerable if an attacker can reset it through a weaker email or SMS recovery route. Check backup codes, recovery email addresses, phone numbers, and any alternate sign-in methods the provider allows you to manage.
Secure the email account and phone number used for recovery. CISA recommends setting a PIN or passcode on your mobile carrier account and enabling MFA there where available to help counter SIM-swapping techniques. Also check whether a service lets you remove SMS from fallback or recovery; some services retain it even after stronger MFA is enrolled.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Review recovery after major changes: replacing a phone, changing a number, adding a new administrator, or enrolling a new device. Remove old addresses and devices you no longer control. Keep backup codes offline in a secure location, and never store them in an unprotected note that can be read by anyone who gains access to your phone or cloud account.
Recovery processes differ by provider, and not every setting can be removed or changed. The practical goal is to know which routes can restore access, keep those routes under your control, and avoid assuming that enrolling a security key automatically closes weaker recovery paths.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What should you do with a suspicious message?
Do not use an unexpected link or attachment to handle a request that could affect your account. If the message may be real, leave it and reach the organization using a saved bookmark, an address you type yourself, or a contact method you already know is legitimate.
- Pause when an unexpected message asks you to sign in, download something, transfer funds, or disclose sensitive information.
- Inspect the destination without opening it when your mail or browser allows that, but do not treat a familiar-looking domain or logo as proof of safety.
- Do not share a verification code with someone who contacted you first. The FTC’s two-factor guidance warns against giving a verification passcode to a person unless you initiated contact.
- Report phishing to the FTC at ReportFraud.ftc.gov. The FTC also lists [email protected] for forwarding phishing emails in its April 2025 phishing guidance.
Reporting is useful even when you did not lose money or enter credentials. Preserve the message for the reporting process, but do not forward it to coworkers or friends in a way that could cause someone else to click the lure.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What if you entered a password or verification code?
Act promptly: change the affected password, replace it anywhere it was reused, and contact the provider through a known route if the account may have been accessed. The NIST phishing guidance and FTC phishing advice support changing exposed passwords, contacting the affected provider, and monitoring for unauthorized activity.
- Change the exposed password. Go directly to the real service rather than returning through the suspicious message.
- Replace reused passwords. Change every other account where that same password was used.
- Review account controls. Where the provider offers them, check recovery settings, active sessions, enrolled devices, forwarding rules, and recent security notifications.
- Secure the second factor. Remove an unfamiliar authenticator, key, phone number, or remembered device, and enroll a stronger factor if available.
- Contact the right people. For a financial account, use a known contact route and monitor for unauthorized activity. For a work account, notify the appropriate security or IT contact and follow workplace incident procedures.
If you provided a code but not a password, treat it as a potential account compromise too: the code may have been relayed to an active login. Contact the service through a trusted route and use its available controls to review or secure the account. If you downloaded an attachment, follow your device or workplace security process rather than opening it again to investigate.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteHow can you choose a workable protection plan?
Choose based on protection, compatibility, and recoverability—not on the assumption that one method works on every account. Use this order when reviewing each high-value service:
- Check whether it offers a passkey or FIDO/WebAuthn security key and whether your device can use it.
- Enroll the strongest method you can reliably access, then understand the provider’s recovery process.
- If FIDO or passkeys are unavailable, enable the best MFA method offered; treat codes as vulnerable to phishing.
- Use a unique password for every account that still requires one.
- Review weaker fallbacks, especially recovery through email or SMS, and secure the inbox and carrier account involved.
- Test that you can sign in from your normal devices and know how to revoke a lost device or key.
Compare options on four practical axes. Phishing resistance favors FIDO/WebAuthn; NIST does not classify manually entered OTP or out-of-band codes as phishing-resistant. Availability depends on the service, device, port, and NFC support. Recovery resilience depends on backup codes, alternate devices, support procedures, and the security of your email and carrier accounts. Practicality means choosing a method you will actually use, with a workable backup plan.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
There is no single setup that removes every phishing risk. These controls reduce the chance that a convincing message can turn into lasting access, while verification through trusted routes helps you avoid handing over credentials in the first place.
Frequently Asked Questions
Does an authenticator-app code stop a fake login page from stealing my account?
No. An app code is generally less exposed to SIM swapping than an SMS code, but a fake page can still capture and relay a manually entered code. NIST’s distinction is about whether the authentication is bound to the legitimate login session, not simply whether the code came from an app.
Are passkeys safer than SMS codes?
Yes, when the service implements them correctly. Passkeys and FIDO/WebAuthn keys use verifier-bound cryptography and are designed to resist fake-site credential capture. SMS codes are manually entered, are not phishing-resistant, and can also be exposed through SIM swapping.
Should I use a hardware security key?
It can be a strong choice for important accounts that support FIDO/WebAuthn. Check the service, device ports or NFC support, and recovery process first. CISA cites Yubico and Google Titan as examples but does not provide a model ranking, current price, or product test.
What happens if I lose my passkey or security key?
Use the provider’s documented recovery method, such as another enrolled device or backup factor. Before relying on one key, enroll a usable backup where allowed and review how to revoke a lost authenticator. Recovery may still use weaker email or SMS methods, so secure those routes too.
Can I report a phishing email even if I did not lose money?
Yes. The FTC accepts phishing reports through ReportFraud.ftc.gov, and its guidance also lists [email protected] for forwarding phishing emails. Reporting does not require you to first prove that an account was compromised.
Recommended Free Tools
Is there a reliable statistic for how much AI increases phishing success?
The cited official guidance describes AI’s ability to make phishing messages more convincing, but it does not provide an AI-specific account-compromise rate. A broad phishing statistic should not be presented as a measurement of AI’s added effect.
If I enrolled a security key, can I remove SMS immediately?
Not necessarily. Some services retain SMS for account recovery even after stronger MFA is enrolled. Check the provider’s fallback settings and recovery procedure before disabling anything, and make sure you have another reliable way to regain access.
The Bottom Line
Make every important account difficult to reuse after a phish. Prefer passkeys or FIDO/WebAuthn security keys, use unique password-manager credentials where passwords remain, secure email and carrier recovery routes, and verify unexpected requests through a known channel. If you enter a password or code, change credentials and contact the provider immediately.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
