Free tools Windows power users keep installed
One-click scans. No signup required.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
If an unexpected message, call, or sign-in prompt pressures you to use its link or hand over a password, stop. A familiar voice, logo, caller ID, or polished message does not prove who sent it. Open the service through its known app or an address you type yourself, then verify the request through a separate channel you found independently.
What to check before entering a password
- Pause when the request is unexpected or urgent. Scammers may claim your account is at risk, a subscription is renewing, a package is delayed, or you face a legal problem. Pressure to act immediately is a reason to verify, not a reason to skip checks. The FTC lists these kinds of lures in its impersonation-rule announcement and phishing guidance.
- Do not use the sender’s link or contact details to authenticate the request. Open the service’s app you already use, or type its familiar web address yourself. If the message claims to be from a person or organization, contact them using details you obtained separately—not a number, address, or reply path in the message. For an important request, confirm through another type of communication. The UK National Cyber Security Centre’s phishing guidance also advises checking suspicious messages through a separate route.
- Check whether the request appears in the genuine account. After opening the app or site independently, look for the claimed security alert or account issue there. If it is not present, do not follow the message’s instructions; contact the organization using its independently sourced support details.
- Do not treat appearance or sound as proof. AI can make text, images, and voices more convincing. Caller ID, a familiar display name, a company logo, or a realistic voice can all be imitated. In February 2024, FTC Chair Lina M. Khan warned that fraudsters were using AI tools to impersonate people with “eerie precision” and at greater scale; that is an official warning about the risk, not evidence that every scam uses AI. The FTC’s announcement is available at its AI impersonation release.
- Only sign in after navigating independently. Check that you are on the genuine service’s site or in its official app before entering credentials. A password manager may decline to autofill on an unfamiliar or fake domain, which can be a useful warning, but it does not detect every scam.
Why impersonation deserves attention
AI is one way to make an impersonation more persuasive; the core danger is still being steered into trusting an unverified request. The FTC reported more than $1.1 billion in combined losses to government and business impersonation scams in 2023. In 2025, it reported nearly $3 billion in losses to impersonation scams during 2024. These are reported-loss figures for impersonation fraud overall, not estimates of AI-enabled scams; the scopes differ, so they should not be read as a like-for-like year-to-year comparison. The FTC notes its data rely on consumer reports. See its 2023 data spotlight and 2025 report.
As an Amazon Associate I earn from qualifying purchases.
Choose sign-in protection that resists phishing
Account protections reduce the damage a convincing fake login can cause, but support and recovery options vary by service and device. Check compatibility and make sure you can recover access before changing how you sign in.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
| Method | How it helps | What to check |
|---|---|---|
| Passkey | Recommended by the NCSC where available; passkeys are tied to the legitimate service and resist phishing because they cannot be intercepted, reused, or stolen like passwords. | Confirm the account and your devices support passkeys, and understand the service’s recovery and backup access. See NCSC passkey advice. |
| Unique password plus two-step verification | A strong, different password for each account prevents a stolen password from automatically opening other accounts. Two-step verification adds another check at sign-in. | Enable the available verification method and keep account recovery options current. See NCSC password-manager advice. |
| FIDO2 security key | A compatible FIDO authenticator can block an attempt to sign in on a fake website, according to CISA’s FIDO guidance. | Check that your particular accounts and devices support the key, and arrange backup access. It is an optional physical authenticator, not a scam detector or a guarantee against every impersonation tactic. |
| Password manager | Helps create and store unique passwords; some managers will not autofill credentials on a fake domain. | Use domain-aware autofill as a helpful signal, not proof that a site is safe. A manager cannot be assumed to identify every scam. |
If you already entered your password
- Go to the real service through its known app or an address you enter yourself, then change the affected password immediately.
- Change that password anywhere else you reused it. Give every account a unique password.
- Turn on available MFA or a passkey for the affected account and review its recovery options.
- If you cannot access the account, use the service’s genuine account-recovery process reached independently—not a recovery link in the suspicious message.
The FTC’s cybersecurity guidance and its phishing guidance recommend changing exposed passwords, including on accounts where the same password was reused.
Quick Recap
Bestseller No. 2
Rank #4
Sale
Thetis Nano-A FIDO2 Security Key Hardware Passkey Device with USB Type A, TOTP/HOTP, FIDO2.0 Two Factor Authentication 2FA MFA, Works with Windows/mac/iOS/Android/Linux/Gmail/Facebook/GitHub/Coinbase
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Rank #3
OnlyKey Duo - The Best Protection for All of Your USB-C and USB-A Devices
- ✅ PROTECT ONLINE ACCOUNTS – A password manager, two-factor security key, and secure communication token in one, OnlyKey can keep your accounts safe even if your computer or a website is compromised. OnlyKey is open source, verified, and trustworthy.
- ✅ UNIVERSALLY SUPPORTED – Works with all websites including Twitter, Facebook, GitHub, and Google. Onlykey supports multiple methods of two-factor authentication including FIDO2 / U2F, Yubico OTP, TOTP, Challenge-response.
- ✅ PORTABLE PROTECTION – Extremely durable, waterproof, and tamper resistant design allows you to take your OnlyKey with you everywhere.
- ✅ PIN PROTECTION – Locking your device means that if this device is stolen, data remains secure, after 10 failed attempts to unlock all data is securely erased.
- ✅ EASY LOG IN – No need to remember multiple passwords because by plugging OnlyKey to your computer, it automatically inputs your username and password. It works with Windows, Mac OS, Linux, or Chromebook, just press a button to login securely!
Rank #2
FIDO2 U2F Security Key Passkey Two-Factor Authentication (2FA) USB Key PIN+Touch (Non-Biometric) USB-C Type TrustKey T120
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T120. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T120 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-C port : Insert the T120 security key into the USB-C port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
#1 Best Overall
Yubico - YubiKey 5 NFC - Multi-Factor authentication (MFA) Security Key and passkey, Connect via USB-A or NFC, FIDO Certified - Protect Your Online Accounts
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.
