How to Protect Your Personal Information Online

Your email, your bank, your photos and your address all live online now. You do not need to be a computer expert to keep them safe. You need a short list of habits, done in the right order.

This checklist starts with steps you can do on your phone today. It ends with bigger steps that take an afternoon. Do one section at a time.

1. Turn on two-step sign-in, starting with your email

Two-step sign-in means a password is not enough to get into your account. The site also asks for a code from your phone, or a tap on a prompt. If someone steals your password, they still cannot get in.

Start with your email. Your email can reset the password for almost every other account you own. If someone gets into it, they can get into the rest.

• Open the security settings in your email account.
• Look for "2-Step Verification" or "two-step sign-in."
• Follow the steps to link your phone.
• Do the same for your bank, then your social media accounts.

One warning: never tap Yes on a sign-in prompt you did not start. A scammer can trigger a real prompt and then call you to ask you to approve it. We wrote about this trick in No One From Google Will Call You About Your Account.

2. Install updates when your phone or computer asks

Updates fix weak spots that attackers already know about. Putting them off leaves the door open.

• Turn on automatic updates on your phone.
• Turn on automatic updates on your computer.
• Restart your devices about once a week so updates can finish.
• Update your apps, too, not only the phone itself.

3. Check what your apps can see

Many apps ask for more than they need. A flashlight app does not need your contacts. A game does not need your location.

• On an iPhone, open Settings, then Privacy & Security.
• On an Android phone, open Settings, then look for Privacy or Permission manager.
• Check which apps can use your location, camera, microphone and contacts.
• Switch off anything that does not make sense.
• Delete apps you have not opened in months.

4. Share less on social media and in forms

Scammers collect small details and put them together. Your birthday, your pet's name and your home town are common answers to security questions.

• Do not post your full birth date, your address or your phone number.
• Post vacation photos after you get home, not while the house is empty.
• Skip online quizzes that ask for your first car or your mother's maiden name.
• Set your social media accounts so only friends can see your posts.
• When a form asks for your phone number or birth date, ask yourself if they really need it. Leave optional boxes empty.

Parents can read our post on childcare scams on Facebook to see how scammers use public posts.

5. Use a different password for every account

When one website is hacked, criminals try the stolen email and password on other sites. If you use the same password everywhere, one leak opens every door.

Nobody can remember 50 different passwords. A password manager can. It is an app that creates strong passwords, saves them, and fills them in for you. You remember one main password, and the app remembers the rest.

• Pick a well-known password manager. Your iPhone, Android phone and web browser have one built in.
• Make your main password long. A short sentence of four or five random words works well.
• Change the password on your email first, then your bank.
• Replace the rest as you sign in to each site over the next few weeks.

6. Learn to spot fake texts, emails and calls

Most attacks start with a message that tries to rush you. The goal is to make you click a link, share a code or send money before you stop to think.

Warning signs:

• The message says your account is locked, a package is stuck, or you owe money.
• It wants you to act right now.
• It asks for a password, a code from a text message, or a gift card payment.
• The sender's address or the link looks almost right, but not quite.
• A caller says they are from your bank, Google, Microsoft or the government and asks you to confirm details.

What to do:

• Do not click the link. Open the app or type the website address yourself.
• Hang up and call the number on the back of your card or on the official website.
• Never read a sign-in code out loud to anyone. A real company will not ask for it.

Our free course How Not to Get Phished walks you through real examples. You can also read our guide to fake bank emails.

7. Be careful on public Wi-Fi

Free Wi-Fi in a coffee shop, hotel or airport is handy. You do not know who runs it, though, and a fake network can use a name that looks real.

• Ask staff for the exact name of the network before you join.
• Avoid banking or shopping on public Wi-Fi when you can.
• Use your phone's mobile data for anything private. It is safer.
• Tell your phone to forget the network when you leave.

8. Check if your email was in a data breach

A data breach is when a company loses customer information to criminals. Your email may be in one without you knowing.

• Go to Have I Been Pwned. It is a free and trusted site.
• Type in your email address.
• The site lists the breaches your email appears in.
• For each one, change the password on that site and on any site where you used the same password.

Read what to do after a big data breach for more steps.

9. Freeze or lock your credit

A credit freeze stops lenders from looking at your credit file. That means a criminal cannot open a new loan or credit card in your name. A freeze is the strongest step on this list.

In Canada, the two credit bureaus are Equifax Canada and TransUnion Canada.

• Contact both bureaus. Each one keeps its own file on you.
• Every Canadian can ask both bureaus to add a fraud alert. A fraud alert asks lenders to check that it is really you before they approve credit.
• Residents of Quebec and Ontario have a legal right to a full freeze. Other provinces may offer a paid lock service instead.
• You can find Equifax Canada at equifax.ca.

In the United States, there are three credit bureaus: Equifax, Experian and TransUnion.

• A credit freeze is free by law.
• You must contact all three bureaus.
• You can lift the freeze for a short time when you apply for a loan.
• USA.gov explains how to freeze your credit, with links to each bureau.

10. Know what to do if something goes wrong

If you clicked a bad link, shared a code or sent money, act fast. It is not your fault. These scams fool careful people every day.

1. Call your bank right away if money or card details are involved.
2. Change the password on the affected account. Then change it anywhere you used the same one.
3. Sign out of the account on all other devices. Most accounts have this option in their security settings.
4. In Canada, report it to the Canadian Anti-Fraud Centre.
5. In the United States, go to IdentityTheft.gov. The site gives you a recovery plan, step by step.
6. Call your local police if someone used your identity.

Keep going

You do not need to do all ten steps today. Start with two-step sign-in on your email. Add one step each week.

• Take our free Secure Online course, or browse all our free courses.
• Download a checklist from our free guides.
• Not sure if a message is real? Ask Dave, our free helper, before you click.
• The Government of Canada's Get Cyber Safe site has more tips.