Privacy Hacks

Every hack is checked against a cited source · open the link to see where it comes from.

• 🔒

  Use a long unique passphrase for every account

  Give each account its own long, random, unique password and let a password manager remember them.

  1. 1♻️One reused password
  2. 2🔑Unique per account
  3. 3🗝️Manager remembers

  Steps

  1. Make each password long (aim for 16+ characters) and unique to that one account.
  2. Prefer a passphrase of 4-7 unrelated words, which is long yet easier to recall.
  3. Install a reputable password manager to generate and store a different password per account.
  4. Protect the manager itself with one long master passphrase you keep only in your head.
  5. Stop reusing or lightly tweaking one password across sites.

  Why it works

  Long, unique passwords mean a breach of one site cannot unlock the rest, and a manager makes that practical without memorizing dozens.

  Good to know: Modern guidance (NIST/CISA) drops forced periodic resets; only change a password when it is weak, reused, or exposed in a breach.

  Source: CISA (Secure Our World)
• 🔒

  Turn on multi-factor authentication

  Add a second login factor so a stolen password alone cannot open your account.

  1. 1🔒Password
  2. 2📱Plus app code
  3. 3✅Account opens

  Steps

  1. Open the security settings of each important account (email, bank, social) and enable MFA / 2FA.
  2. Choose an authenticator app or a hardware security key rather than text-message codes when offered.
  3. Save the backup or recovery codes the service gives you somewhere safe.
  4. Repeat for every account that offers it, starting with email since it can reset others.

  Why it works

  MFA requires a second proof beyond your password, so an attacker who steals or guesses the password still cannot get in.

  Good to know: CISA warns SMS codes can be intercepted (SIM-swap); use an authenticator app or FIDO security key where possible. App codes still beat nothing if that is all a site supports.

  Source: CISA (Secure Our World)
• 🔒

  Freeze your credit at all three bureaus

  A free credit freeze stops thieves from opening new accounts in your name.

  1. 🆕Thief opens credit
  2. 🧊Freeze blocks it

  Steps

  1. Contact all three credit bureaus: Equifax, Experian, and TransUnion.
  2. Request a free credit freeze with each one (online or by phone is fastest).
  3. Save the PIN or login each bureau gives you so you can lift the freeze later.
  4. Temporarily lift the freeze only at the bureau a lender will check, then refreeze when done.

  Why it works

  Lenders usually will not extend credit without seeing your report, so a freeze blocks identity thieves from opening new accounts in your name.

  Good to know: A freeze must be placed at all three bureaus to be effective; placing it at only one leaves the others open. It does not affect your credit score and is free to place and lift.

  Source: Federal Trade Commission
• 🔒

  Spot phishing and never click unexpected links

  Treat urgent, unexpected messages asking you to click or confirm info as likely scams.

  1. 1📧Urgent message
  2. 2🛑Do not click
  3. 3📞Verify yourself

  Steps

  1. Be suspicious of unexpected emails or texts claiming an account problem, suspicious activity, or a refund.
  2. Do not click links or open attachments in messages you did not expect.
  3. Ask: do I actually have an account with this sender? If not, it is likely phishing.
  4. Verify by contacting the company through a phone number or website you look up yourself, not the message.
  5. Report it: forward phishing texts to 7726 (SPAM) and report to ReportFraud.ftc.gov.

  Why it works

  Phishing messages impersonate trusted companies to trick you into handing over passwords or account numbers; not clicking and verifying independently defeats them.

  Good to know: Legitimate companies do not email or text a link asking you to update payment details; a familiar logo or name does not prove a message is real.

  Source: Federal Trade Commission
• 🔒

  Keep your software and devices updated

  Install updates promptly and turn on automatic updates to close known security holes.

  1. 🐛Unpatched flaw
  2. 🛡️Update closes it

  Steps

  1. Install software and operating-system updates as soon as you are notified, especially critical ones.
  2. Turn on automatic updates in your device and app security settings.
  3. Prioritize updates for your web browser and security/antivirus software.
  4. Apply updates to your phone, computer, and other connected devices alike.

  Why it works

  Many updates patch security flaws that criminals exploit to reach your files or accounts; installing them quickly is what actually delivers the protection.

  Source: CISA (Secure Our World)
• 🔒

  Review and minimize app permissions

  Check what your apps can access and switch off permissions they do not need.

  1. 1⚙️Open privacy settings
  2. 2📍See app access
  3. 3🔕Switch off extras

  Steps

  1. Open the privacy settings on your smartphone to see what each app can access (location, contacts, photos).
  2. Turn off permissions an app does not need to function.
  3. Delete apps that demand lots of permissions unrelated to what they do.
  4. Review the privacy settings on connected TVs and streaming devices too.

  Why it works

  Apps often request more access than they need; trimming permissions limits how much of your personal data they can collect and share.

  Source: Federal Trade Commission
• 🔒

  Lock devices with a strong passcode plus biometrics

  Set a strong PIN or password as the root unlock and add fingerprint or face for convenience.

  1. 1🔢Long passcode
  2. 2👆Add biometrics
  3. 3🔐Backups encrypted

  Steps

  1. Set a screen lock on every device using a PIN, pattern, or password.
  2. Choose a longer code over a short one: a six-digit-or-longer PIN beats four digits.
  3. Add fingerprint or face unlock as a fast layer on top of, not instead of, the passcode.
  4. Use that screen lock so automatic and manual backups are encrypted.

  Why it works

  A strong device lock keeps anyone who finds or steals your phone from reaching your accounts, messages, and stored data, and it encrypts your backups.

  Good to know: Biometrics are a convenience layer; the PIN or password remains the true root of trust, so keep it long and never set it to something guessable like 1234.

  Source: CISA
• 🔒

  Back up your important data

  Keep a copy of your files on an external drive or in the cloud so an attack cannot wipe you out.

  1. 1💾Copy your files
  2. 2☁️Drive or cloud
  3. 3♻️Restore anytime

  Steps

  1. Back up the data on your computer to an external hard drive or to the cloud.
  2. Back up the data on your phone too.
  3. Turn on automatic backups so copies stay current without you remembering.
  4. Confirm the backup is protected by your device screen lock so it is encrypted.

  Why it works

  A current backup means ransomware, theft, loss, or a failed device cannot permanently destroy your photos, documents, and records.

  Source: Federal Trade Commission
• 🔒

  Stay safe on public Wi-Fi

  Most sites are encrypted now, so check for HTTPS and keep accounts protected on public networks.

  1. 1📶Public Wi-Fi
  2. 2🔒Check for https
  3. 3🔑MFA + logout

  Steps

  1. Confirm a site is encrypted: look for a lock symbol or https in the address bar before entering anything.
  2. Only log in or enter personal info on sites that use encryption, and log out when you finish.
  3. Use strong unique passwords and turn on two-factor authentication for your accounts.
  4. Keep your operating system, browser, and security software updated, with automatic updates on.

  Why it works

  Widespread HTTPS encryption makes public Wi-Fi usually safe, so verifying the connection and locking down your accounts covers the real remaining risk.

  Good to know: Encryption only protects data in transit; a scammer's own fake site can still steal what you type, so do not email financial details and watch for impersonator sites.

  Source: Federal Trade Commission
• 🔒

  Check breaches and change exposed passwords

  See where your email has leaked, then change those passwords and add 2FA.

  1. 1🔍Check your email
  2. 2🔁Reset exposed
  3. 3📱Add 2FA

  Steps

  1. Check whether your email has appeared in known breaches using a reputable tool like Have I Been Pwned.
  2. For every breached site, change that password to a new long unique one (a password manager helps).
  3. If you reused that password anywhere else, change it on those accounts too.
  4. Turn on two-factor authentication on the affected accounts.
  5. Delete old accounts you no longer use to shrink your exposure.

  Why it works

  Reused passwords let one breach cascade into your other accounts (credential stuffing); changing exposed passwords and enabling 2FA stops the chain.

  Good to know: Watch for follow-on phishing and strange medical or financial bills after a breach, and consider freezing your credit if sensitive identity data was exposed.

  Source: Electronic Frontier Foundation