How to Build Your Family’s Digital Defenses

Key Points

Cyber scams continue to evolve, but certain technical and behavioral precautions can lower your risk of financial loss.
Five foundational steps can help strengthen your security: protect your primary email account, set up passkeys where available, enable multifactor authentication, establish a family verification phrase, and freeze your credit.
Consider adopting best practices individually and as a family for a comprehensive approach.

Cyberfraud is becoming more opportunistic. Although tactics range from simple to elaborate, strengthening your family’s digital safety, and therefore its financial safety, does not have to be complicated.

Most schemes aim to convince victims to take action: reset a password, approve a payment, or wire funds. Many scams also begin with access to sensitive information, making it important to secure accounts and personal identities for yourself and your loved ones.

For example, access to something as simple as your phone number and information about a friend or family member’s location, collected from public sources and social media accounts, can enable a hoax call that creates urgency, such as a travel emergency. Deepfakes also enable impersonation. These AI-generated re-creations of a person’s likeness and speech can make scam communications more persuasive. Timing adds credibility: a tax notice during filing season or a charitable appeal following a disaster can seem logical.

Modern lifestyles make it difficult to eliminate exposure to fraud, but you can deprive perpetrators of information and opportunity. By raising cybersecurity awareness among family members of all ages, you can reduce risk.

We outline four areas to focus on, starting with securing access to your accounts. We suggest working through these areas and actions with your family. Select a section to learn more.

Lorem Ipsum

Protect Access to Your Accounts

Vikas Bangia

Chief Information Security Officer

Eleonora Lawrence

Director of Governance, Risk, Compliance and Awareness

Protect Access to Your Accounts

Think of your personal accounts as the front door to your financial and personal life, and your primary email as the key.

If a criminal gains access to your email, they may be able to use it to reset passwords and recover access to other accounts, including those tied to your banking, investments, payments, social media, and digital assets.

A secure sign-in process can help keep that door locked, protecting your private information and limiting the potential impact of a compromised account. Consider the following steps to strengthen your account security:

Use Passkeys When Available

A passkey is a simpler, more secure alternative to a password. Instead of typing a password or waiting for a security code, you sign in using the same method you may use to unlock a phone, tablet, or computer, such as facial recognition, a fingerprint, or a device PIN.

A passkey is made for one account and one website or app, so it can’t be used to sign in anywhere else. Designed to resist phishing, passkeys help reduce the risks associated with stolen passwords, password reuse, fake login pages, and fraudulent requests for security codes.

Your device or a trusted credential manager stores your passkeys. Passkeys often sync securely across personal devices, so they are available when you replace a phone or use another device connected to the same account.

When you approve access to a passkey using your fingerprint or face, the website receives confirmation that your device successfully verified you. It does not store your biometric information.

Creating a Passkey

While the exact steps will vary by provider, creating a passkey generally follows these steps:

Start with your primary email account and other sensitive accounts.
Open the provider’s official application or type its website address yourself.
Sign in and go to Security, Sign-In, Login & Security, or Account Settings.
Look for Passkeys, Create a Passkey, Add a Passkey, or Passwordless Sign-In.
Select where the passkey should be saved (your phone, tablet, or computer; your device’s built-in password manager; another trusted password manager; or a physical security key).
Follow the prompt to unlock your device using your face, fingerprint, or device PIN.
Sign out and test the passkey.
Confirm that you still have a secure backup or account recovery method.
Repeat the process for other important accounts that support passkeys.

Common Examples*

Google

Open your Google Account.
Select Security & sign-in.
Under How you sign in to Google, select Passkeys and security keys.
Select Create a passkey.
Unlock your device when prompted.

Google advises creating passkeys only on devices you personally own and use. Anyone who can unlock a device containing your passkey may be able to access the associated account.

Microsoft

Open your Microsoft account.
Go to Advanced Security Options.
Select Add a new way to sign in or verify.
Select Face, Fingerprint, PIN, or Security Key.
Follow the instructions and confirm where the passkey will be saved.

On a Windows device, locally saved passkeys can be reviewed by opening Settings, selecting Accounts, and then selecting Passkeys.

Apple Devices

When an Apple-supported website or application offers a passkey:

Sign in to the account and open its security or account-management settings.
Select Create a passkey, Save a passkey, or a similarly named option.
Select Continue.
Use Face ID, Touch ID, or your device passcode to approve the passkey.

On current Apple devices, passkeys can be reviewed and managed in the Passwords application. Passkeys saved through Apple can be made available on other devices signed in to the same Apple Account.

*The instructions above reflect the setup processes available at the time of writing and may change. Please consult your provider’s official website or support resources for the most current guidance.

Secure Your Passkeys and Be Prepared with Backups

Passkeys can reduce many of the weaknesses associated with traditional passwords, but the devices and accounts that store them must still be protected. It is equally important to have a secure backup or recovery method in place:

Create passkeys only on devices you own and control.
Do not create a passkey directly on a public, borrowed, or shared device.
Protect your devices with a strong device PIN or passcode, face or fingerprint recognition, and automatic screen locking, and keep software and security updates current.
Protect the password manager account that synchronizes your passkeys.
Maintain at least one secure backup or recovery method.
Review your saved passkeys periodically.
Remove passkeys associated with lost, stolen, sold, or unused devices.
Do not scan a QR code or approve a passkey sign-in at the direction of an unexpected caller.
Contact the provider through its official app or website if you receive an unexpected passkey notification.

Adding a passkey does not always remove an existing password or older recovery method. Continue to protect those alternatives, including your recovery email, phone number, and primary device account.

Use Multifactor Authentication When Passkeys Are Not Available

For many websites and apps, a passkey can replace both the password and the separate security step required during multifactor authentication, depending on how the provider has implemented passkeys. However, not every website or application supports passkeys.

For accounts that still require passwords, use a unique password for each account and enable multifactor authentication (MFA, also known as two-factor authentication, 2FA, or two-step verification) as it adds another identity check before anyone can sign in. MFA can help your account stay protected, even if your password has already been stolen. That said, not all MFA methods offer the same level of protection:

Security keys and other phishing-resistant methods tend to be the strongest. A security key is a small physical device you use to confirm that it’s you.
Authenticator applications are a strong, practical alternative. These are apps on your phone that generate sign-in codes.
Codes sent by text message or call are better than using a password alone, but they are more vulnerable to phishing and phone number takeover attacks.

To set up MFA:

Begin with your primary email account, then move on to your other important accounts, including financial, payment, and social media.
Open the provider’s official application or website.
Go to Security, Sign-In, or Login Settings.
Look first for a passkey option.
When passkeys are not supported, select Multifactor Authentication, Two-Factor Authentication, 2FA, or Two-Step Verification.
Choose the strongest method available.
Add at least one secure backup method.
Download or print recovery codes when offered, and store recovery codes appropriately.
Sign out and test the new sign-in process.

Protect Your Mobile Phone Number

Your phone number may be used for security codes or account recovery. Ask your mobile carrier whether it offers an account pin, a number transfer, or a port-out lock to prevent someone from transferring your phone number to another device or carrier without your permission. These safeguards can make it more difficult for a criminal to take control of your phone number and intercept security codes.

Exercise Caution When Responding to Sign-in Prompts

Never approve a sign-in request you did not initiate and never share a security code or password reset code to an unexpected caller — even when the caller claims to represent your bank, technology provider, or fraud department. If you receive an unexpected prompt:

Deny the request.
Open the account through its official application or website.
Review recent sign-ins and devices.
Change the password if the account still uses one.
Contact the provider using a number or support method you independently locate.

Use a passkey when available. Otherwise, use the strongest multifactor authentication the account supports, and never approve a sign-in request or share a security code you didn’t initiate.