To reduce automated account-takeover attempts, change the settings that control authentication and recovery: enable the strongest available multi-factor authentication (MFA), use a unique password of at least 15 characters, remove predictable security-question answers, protect recovery codes and backup authenticators, and turn on failed-login throttling or lockout controls. Start with your email account, then secure banking, payment, social, shopping, tax, gaming and other high-value accounts. Review active sessions and enrolled devices after every major change.
What automated account takeover looks like
Automated takeovers usually begin with software trying stolen username-and-password pairs, guessing common passwords across many accounts, or replaying credentials at high speed. Reusing a password lets one breach become a chain of account compromises. Automation also makes a single-factor account easy to test continuously: a bot can submit logins around the clock while the owner sees nothing until an attacker changes the recovery email or password.
As an Amazon Associate I earn from qualifying purchases.
Identity settings cannot stop every malicious login attempt, but they can make a stolen password insufficient. MFA adds a second proof of identity; unique passwords prevent one site’s breach from unlocking another; rate limits reduce guessing; and carefully designed recovery controls keep an attacker from simply taking over the fallback route.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Find the right identity settings first
Sign in directly to the service, rather than following a login link in an unexpected message. Open the area labeled Security, Login, Privacy or Account Settings. CISA notes that MFA can also appear under Profile, Preferences or Privacy, so search those sections when the label is different.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Make a short inventory before changing anything:
- Primary email and any email account used for password resets.
- Banking, payment, tax and other accounts that can move money or expose financial records.
- Social, shopping, gaming, work and cloud-storage accounts containing personal data.
- Password-manager and device accounts that can unlock many other services.
Secure the email account first. Control of that inbox often gives an intruder the ability to reset other accounts. Then work through the remaining accounts in order of financial impact and data sensitivity.
Replace reused passwords with long, unique credentials
Set a different password or passphrase for every account. The Federal Trade Commission recommends aiming for at least 15 characters. Length matters more than a predictable mixture of punctuation and numbers; a long passphrase made from unrelated words can be easier to remember than a short, complicated pattern.
Do not modify one old password slightly for each site. Automated attackers try common variations, and a password exposed in one breach remains useful wherever a variation was reused. Change passwords from the account’s security page, save each new credential immediately, and sign out other sessions if the service offers that option.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Use a password manager as the credential system
A password manager can generate a different, long password for each site and store those credentials in an encrypted vault. NIST describes the security benefit as the ability to generate unique, long, complex and easily changed passwords while storing them securely in a local or cloud-based vault.
When choosing or configuring one, check these capabilities:
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Unique-password generation with adjustable length and character rules.
- Encrypted storage and reliable access on the devices you actually use.
- MFA for the password-manager account itself.
- A recovery design that does not expose the vault through an easily guessed or broadly accessible master-password reset.
- Cross-device synchronization that lets you use the same vault without copying passwords into notes, browsers or messages.
Create a long master passphrase that you do not use anywhere else. Enable MFA on the manager, and keep its recovery codes offline. A manager that allows unrestricted master-password recovery can create a single recovery path an attacker may target, so understand exactly what recovery reveals and who can authorize it.
Choose the strongest MFA method the account supports
CISA’s current ordering places a physical security key first, followed by number-matching or one-time-code authenticator apps, biometrics, and text or email codes. The FTC likewise says authenticator apps and security keys are more secure than SMS. Enroll the strongest method available, then add a second method or recovery option so a lost device does not lock you out.
| MFA method | Phishing resistance | Phone-number dependence | Recovery burden | Portability | FIDO2/WebAuthn |
|---|---|---|---|---|---|
| Physical security key | Strongest listed by CISA; encryption-based | None | Keep a spare key or recovery codes | Portable USB or NFC device | Supported when the service offers FIDO2/WebAuthn |
| Authenticator app | More secure than SMS; number matching or one-time codes | Not required for each sign-in | Plan for phone loss or migration; retain backup codes or another authenticator | Moves with the enrolled device and backup process | OTP apps are separate from FIDO2/WebAuthn; use a passkey or key when offered |
| Biometrics | Listed below authenticator apps by CISA; depends on the device and service | Usually tied to the enrolled device rather than a phone number | Requires another recovery method if the device is unavailable | Limited to compatible enrolled devices | May unlock a device-bound passkey when the service supports it |
| SMS or email code | Weakest listed option; vulnerable to interception or account compromise | SMS depends on the phone number; email depends on the inbox | Convenient but exposed if the number or inbox is taken over | Follows the number or email account | No |
Why security keys and authenticator apps beat SMS
A security key proves possession through cryptography instead of sending a code that can be copied. The FTC warns that criminals can perform a SIM-swap attack, move a victim’s phone number to a device they control, and receive texted verification codes. Use a key or authenticator app whenever the account supports one; leave SMS as a fallback rather than the primary protection.
Some services display a number on the login screen and ask you to match it in the authenticator app. Number matching helps prevent approving an unexpected prompt, while a one-time-code app requires you to type a rotating code. Neither removes the need to verify that the sign-in request is yours, but both avoid dependence on a phone number.
Enroll more than one strong authenticator
If the service allows it, register two security keys or a key plus an authenticator app. Store one key in a secure secondary location. This avoids making your only authenticator the single point of failure while preserving a strong sign-in method.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Remove predictable security-question answers
Security questions often ask for facts that can be found online or in public records. The FTC specifically cautions against answers such as a ZIP code, birthplace or mother’s maiden name. If the service lets you choose arbitrary answers, generate random strings and store them as separate entries in your password manager. Treat each answer like a password: never reuse it, and do not publish clues that reveal it.
If a provider requires a fixed fact and does not permit an arbitrary answer, choose the least discoverable truthful option and rely on MFA and recovery codes to provide the stronger protection. Review old questions after changing your password; an attacker who already knows the answer may still pass that challenge.
Design recovery so it helps you, not an attacker
Recovery settings are part of your identity perimeter. A strong login can be bypassed if an intruder controls the backup email, phone number or recovery contact.
- Generate the service’s recovery codes after enabling MFA.
- Print or write the codes and store them offline in a place you can reach during a device loss.
- Keep more than one authenticator enrolled where the provider permits it.
- Check that recovery email addresses and contacts are current and belong to you.
- Remove old phone numbers, devices and authenticators that you no longer control.
- Record the provider’s recovery process in your password manager without storing the codes only in the account they recover.
NIST identifies recovery codes, remaining authenticators and prearranged contacts as recovery mechanisms. Do not leave codes in an unprotected screenshot or send them to yourself in ordinary email. Anyone who obtains an unused code may be able to bypass the second factor.
Turn on throttling, lockout and sign-in monitoring
Look for controls named login alerts, failed-attempt limits, lockout, risk-based sign-in or session monitoring. Enable alerts for new devices, unusual locations and password or MFA changes.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
NIST SP 800-63B-4 (2025) says verifiers generally must limit consecutive failed attempts for an authenticator to no more than 100 and disable that authenticator; lower limits are allowed. A service may enforce a shorter threshold, introduce a delay, require an additional challenge or temporarily disable sign-in. Those controls make password spraying and rapid guessing less effective. CISA also recommends lockout after failed attempts and monitoring for brute-force and password-spraying activity.
When a provider exposes a choice, use the strictest practical limit that will not block legitimate users and make sure a recovery route remains available. Never disable alerts simply because automated attempts are noisy; the pattern can reveal that a password is being tested elsewhere.
Review sessions and devices after every security change
Changing a password or adding MFA does not always terminate existing sessions. Open Active sessions, Where you’re signed in, Devices or a similarly named page.
- Sign out sessions you do not recognize.
- Remove old browsers, phones, tablets and third-party app connections.
- Delete authenticators and recovery devices that are lost, sold or no longer yours.
- Re-enroll only devices you currently control.
- Check the account’s security-log entries for password, email, phone-number or MFA changes you did not make.
Labels differ between providers, so follow the current instructions shown in that account’s security center. If you see an unfamiliar change, reset the password from a device you control, revoke unknown sessions and restore your own recovery details before adding new integrations.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →A practical rollout for multiple accounts
Work in batches so you do not lose track of recovery information:
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- Primary email: set a unique 15-character-or-longer password, add a security key or authenticator app, save offline recovery codes and remove unknown sessions.
- Financial and tax accounts: repeat the same sequence, choosing a key or authenticator app instead of SMS whenever offered.
- Password manager and device accounts: use a unique master passphrase, enable MFA and verify the recovery design.
- Social, shopping, gaming and cloud accounts: replace reused passwords, remove predictable security answers and review connected devices.
- Lower-value accounts: apply the same controls when time permits, especially if they share an email address or password with a high-value account.
After each account, record the date of the change and the location of offline recovery material. This prevents a later device replacement from turning into an emergency search for codes.
Fix common problems without weakening the settings
The account offers only SMS
Enable SMS temporarily, then look for an authenticator-app, passkey or security-key option in the same security area. Keep SMS only as a fallback if the service requires it, and protect the email account that receives any alternate recovery message.
You lost the phone with the authenticator app
Use an offline recovery code or a second enrolled authenticator. Once inside, revoke the lost device, enroll the replacement and generate a fresh set of recovery codes. Do not leave the lost phone listed as an active authenticator.
You cannot find MFA controls
Check Security, Login, Account Settings, Profile, Preferences and Privacy. Search the provider’s help center for its current account-security path, and confirm that you are editing the correct personal, work or organization account.
Login alerts arrive when you are not signing in
Do not approve an unexpected MFA prompt. Open the account directly, change the password, revoke unknown sessions, inspect the security log and remove unfamiliar authenticators or recovery contacts. Reusing that password anywhere else means those accounts need new unique credentials as well.
Maintenance checklist
- Review active sessions and enrolled devices whenever you change a password, phone or computer.
- Regenerate recovery codes after a suspected exposure or after using one.
- Test that a backup authenticator works before travelling or replacing a phone.
- Remove former recovery contacts and old phone numbers promptly.
- Update the password-manager master passphrase if it may have been exposed, then rotate the most important stored passwords.
- Keep sign-in and failed-attempt alerts enabled so automated activity is visible.
These settings work together: a unique password limits the value of stolen credentials, strong MFA blocks password-only access, recovery controls prevent a fallback takeover, and throttling slows automated guessing. Applying them in that order gives the highest-value accounts the strongest protection first.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors
