How to Protect Your Online Accounts from Hacking (2FA, Passkeys)

You wake up to an email saying someone logged in to your account from another country. Or worse, you can’t log in at all, because your password was changed overnight.

It happens to millions of people every year, and it’s rarely because the victim did something “stupid.” Hackers use automated tools, leaked password lists and convincing fake emails, and they only need one weak spot.

The good news is that you can block most attacks with a handful of habits. This guide explains how accounts get hacked, and how to protect yours with strong passwords, two-factor authentication (2FA) and passkeys.

How Do Accounts Actually Get Hacked?

Understanding the attack makes the defense obvious. The most common methods are:

Password reuse and credential stuffing. When a website is breached, the leaked emails and passwords end up in databases that criminals trade. They then try those same combinations on Gmail, PayPal, Facebook, banks and cloud accounts. If you reuse one password everywhere, one leak opens everything.

Phishing. You get an email or message that looks like it’s from Google, PayPal or AWS: “Your account is suspended, click here to verify.” The link leads to a fake login page that steals your password and sometimes your 2FA code too.

Weak or guessable passwords. Passwords like “password123”, your birthday or your name get cracked in seconds.

Malware and keyloggers. A malicious download or browser extension can record what you type or steal saved sessions.

SIM swapping. Attackers trick or bribe a phone company into moving your number to their SIM, so they can receive your SMS codes.

Leaked keys and tokens. For developers, API keys or cloud credentials accidentally posted in public code repositories are found by bots within minutes.

Unsecured public Wi-Fi and shared devices. Less common today thanks to HTTPS, but logging in on a shared computer and forgetting to sign out still causes problems.

Step 1: Use a Password Manager and Unique Passwords

The single best upgrade you can make is a password manager. It creates long, random passwords for every site and remembers them for you, so you only need to remember one strong master password.

Good options include Bitwarden, 1Password, and the built-in managers from Google, Apple and Microsoft. Pick one you’ll actually use.

Some simple rules:

Use a unique password for every account, no exceptions
Make passwords at least 14-16 characters, ideally random
For your master password, use a passphrase of several random words
Never store passwords in a notes app, a spreadsheet or a browser extension you don’t trust
Change a password immediately if a site announces a breach

Start with the accounts that matter most: your main email, your bank, payment accounts, cloud accounts and your phone’s Apple or Google account. Your email is the master key, because most “forgot password” resets go there.

Step 2: Turn On Two-Factor Authentication (2FA)

2FA means that a password alone isn’t enough. After you enter it, the site asks for a second proof, so a stolen password becomes much less useful.

Not all 2FA is equally strong. From weakest to strongest:

SMS codes. Better than nothing, but vulnerable to SIM swapping and interception.
Authenticator app codes (Google Authenticator, Microsoft Authenticator, Authy, 2FAS, or the one built into your password manager). These generate a code on your device and are much safer than SMS.
Push approvals. Convenient, but watch for “prompt bombing,” where attackers spam you with requests hoping you tap “Approve.”
Hardware security keys (such as YubiKey or Google Titan). A physical key you plug in or tap. This is the strongest option for important accounts, and it is very hard to phish.
Passkeys (see below), which combine security and convenience.

A practical approach: use an authenticator app everywhere you can, and a hardware key or passkey on your most valuable accounts. Turn on SMS only when nothing else is offered.

Important: when you enable 2FA, you’ll receive backup codes. Save them somewhere safe, like your password manager or a printed copy in a secure place. If you lose your phone without backup codes, you can get locked out of your own account.

Step 3: Start Using Passkeys

Passkeys are the newer, safer replacement for passwords, and many major services now support them, including Google, Apple, Microsoft, PayPal and others.

What is a passkey? It’s a pair of cryptographic keys. One stays on your device, and the other is stored by the website. When you log in, your device proves it holds the key, usually after you unlock it with your fingerprint, face or screen PIN. There’s no password to type, and nothing for a hacker to steal from a fake website.

Why passkeys are better:

They can’t be phished. A passkey only works on the real website it was created for
They can’t be guessed or reused. Each one is unique
They’re faster. One tap or glance, and you’re in
Nothing useful leaks in a data breach. The website stores only a public key

How to set one up:

Open the security settings of your account (for example, Google Account → Security → Passkeys).
Choose Create a passkey and follow the prompts.
Confirm with your fingerprint, face or device PIN.
Make sure your passkeys are backed up through your password manager, iCloud Keychain or Google Password Manager, so losing a phone doesn’t lock you out.

Passkeys are still being adopted, so not every site offers them yet. Keep a strong password and 2FA on accounts that don’t support passkeys.

Step 4: Learn to Spot Phishing

Technology helps, but attackers also target people. Build these habits:

Don’t click links in unexpected emails or texts. Open the website yourself by typing the address or using a bookmark
Check the sender and the URL. Look for small misspellings like “paypa1.com” or “amazon-security.net”
Be suspicious of urgency. “Act in 24 hours or your account will be deleted” is a classic pressure tactic
Never share codes. No real support agent will ask for your 2FA code, password or backup codes
Treat attachments carefully, especially unexpected invoices, ZIP files and “documents” you didn’t request
Verify through a second channel. If your “boss” or “bank” asks for something strange, call them using a number you already know

If you do click something suspicious, don’t enter anything. Close the page, and if you did type your password, change it immediately and check your account’s recent activity.

Step 5: Secure Your Email and Phone

Your email and your phone number are the recovery paths for almost everything else, so protect them first.

Use the strongest 2FA available on your email account
Review your recovery email and phone number, and remove old ones
Add a PIN or passcode with your mobile carrier to reduce SIM swap risk
Use a screen lock on your phone and keep your operating system updated
Review which third-party apps have access to your Google, Apple or Microsoft account, and remove ones you don’t use

Step 6: Keep Your Devices Clean

Install updates for your phone, computer, browser and apps, because many updates fix security holes
Download software only from official sources and avoid cracked or pirated programs, which are a top malware route
Limit browser extensions to a few trusted ones, since extensions can read what you do online
Use built-in protection such as Windows Security or reputable antivirus software
Log out of shared computers, and don’t save passwords on devices that aren’t yours

Extra Tips for Developers and Cloud Users

If you run cloud accounts such as AWS, Google Cloud or DigitalOcean, the stakes are higher, because a stolen key can lead to a huge bill within hours.

Enable MFA on the root or owner account, and avoid using it for daily work
Use least-privilege roles instead of full admin access
Never commit keys, tokens or .env files to public repositories, and use a secrets manager
Rotate keys regularly and delete ones you no longer use
Set budgets and billing alerts so unusual spending is caught early

What to Do If You’ve Already Been Hacked

Change your password from a clean device, and sign out of all other sessions (most accounts have a “sign out everywhere” option).
Turn on 2FA if it wasn’t already on.
Check your recovery email, phone number and forwarding rules to make sure the attacker didn’t change them.
Review recent activity, connected apps and any financial transactions.
Change passwords for any other account that used the same password.
Scan your device for malware.
Contact the service’s official support and, if money was involved, your bank.
Warn your contacts if the attacker may have messaged them from your account.

You can also check whether your email appeared in a known breach at Have I Been Pwned, which is a well-known, free service.

A Quick Security Checklist

Password manager installed, unique passwords everywhere
2FA on email, banking, payment and cloud accounts
Passkeys enabled where available
Backup codes saved safely
Phone carrier PIN set
Devices and apps updated
Old accounts and app permissions cleaned up

Final Thoughts

You don’t need to be a security expert to stay safe online. Most attacks work because people reuse passwords, click fake links or skip 2FA. Fix those three things, move to passkeys where you can, and you’ll be harder to hack than the vast majority of internet users.