The 7-Day Personal Security Reset

You can lock down most of your personal digital life in seven sessions of 30 to 60 minutes each. The order matters more than the effort. Secure your main email account first, because email is where every other password reset lands. Then move outward: your phone, your home network, the AI tools you talk to, your money, your devices, and finally a recovery plan.

None of this needs technical skill. Every step is a setting you switch on or a habit you set once. CISA's Secure Our World campaign boils personal security down to four actions: recognise phishing, use strong passwords, use multifactor authentication with a password manager, and update software. This week turns those four lines into specific clicks, so the cheap, common takeover routes are closed.

How to use this plan. Do one day per sitting. Each day says roughly how long it takes and ends with an action checklist. Tick items as you go: the checkboxes save your progress in this browser, so you can close the page and pick up tomorrow. If a day runs long, finish it the next day rather than skipping ahead, because Day 1 is the foundation for the rest.

Day 1: Lock down your email and passwords

Time: about 60 minutes. Start here, even if you skip everything else this week.

Why email comes first

Your email inbox is the master key. Almost every service resets a forgotten password by sending a link to your email. The UK's NCSC puts this first in its Cyber Aware advice: use a strong password for your email that you do not use anywhere else, because criminals who get into your email can often reach your other accounts. If you only protect one account this week, protect this one.

Step 1: Pick a password manager

A password manager creates and remembers a unique password for every site. That defeats credential stuffing, where passwords leaked from one site are tried on others. Two broad options:

• Built into your platform. Apple's Passwords app stores passwords, passkeys and verification codes, syncs through iCloud Keychain, and alerts you if your passwords appear in known data leaks. Google and Microsoft offer their own built-in managers.
• A standalone manager. Better if you mix Apple, Windows and Android devices, or share logins with family. Compare options in the password manager comparison.

Choose one that works on every device you own, supports passkeys, offers breach alerts, and allows emergency access for a trusted person. Protect the manager itself with a long passphrase you have never used elsewhere. NCSC suggests three random words as a pattern that is memorable and hard to crack. For why reuse is the real problem, read why passwords fail, and for the deeper habits, see credential hygiene.

Step 2: Secure the email account

1. Change the email password to a new, unique one generated by your manager.
2. Add a passkey if your provider supports it. On Google, go to myaccount.google.com/signinoptions/passkeys and choose Create a passkey. Microsoft personal accounts support passkeys too, added from your account's security settings.
3. Turn on two-step verification (2SV, also called MFA). Prefer an authenticator app, a passkey, or a security key over text messages.
4. Check the recovery phone number and recovery email. Delete any old numbers or addresses you no longer control.
5. Review signed-in devices and sign out anything you do not recognise.

A passkey is a sign-in credential stored on your phone or computer and unlocked with your face, fingerprint or PIN. The FIDO Alliance explains why it resists phishing: it uses challenge-response cryptography, so there is no password to steal and nothing a fake site can capture and replay. Google notes a new passkey can take up to 7 days before you can use it, and you should only create one on a device you personally own.

Step 3: Rank your sign-in options

Use text-message codes only where nothing better is offered; SMS MFA is not MFA explains why. Also watch for push-bombing, where an attacker spams approval prompts until you tap yes. Scam Atlas documents it as MFA fatigue.

Step 4: Move your top ten accounts

Give your most important accounts fresh passwords and the best second factor available. In order: email, phone carrier, banks and cards, your Apple, Google or Microsoft account, social media, then shopping sites with saved cards. Do the rest as you log in over the coming weeks.

Common mistakes

• Turning on MFA but leaving an old, reused password in place.
• Keeping a recovery phone number from a previous contract.
• Saving the password manager's master password inside the manager and nowhere else.
• Treating a password as safe because it is long, while it is reused across sites. If one leaked, here is what to do next.

Action checklist

• Install a password manager on your phone and computer
• Set a long, unique master passphrase and write it down somewhere physically safe
• Change your main email password to a unique generated one
• Add a passkey or authenticator app to your email account
• Remove old recovery phone numbers and email addresses
• Sign out of unrecognised devices on your email account
• Update passwords and MFA on your top ten accounts

Day 2: Harden your phone

Time: about 45 minutes. Your phone holds your passkeys, authenticator app, banking apps and the number that receives your codes.

Updates and the lock screen

The FTC's phone security advice is direct: updates often include critical patches, so turn on automatic updates for the system and your apps. It recommends a passcode of at least 6 digits, plus auto-lock. Face or fingerprint unlock is fine on top of that. Avoid simple patterns and birthdays.

Theft protection

A thief who watches you type your passcode, then grabs the phone, can use that passcode to change your account passwords. Both major platforms now have a defence against exactly this. Turn it on before you need it.

• iPhone: Stolen Device Protection requires Face ID or Touch ID, with no passcode fallback, for actions like using saved passwords away from familiar locations. Critical changes, such as your Apple Account password, also need a one-hour Security Delay. Turn it on in Settings > Face ID & Passcode > Stolen Device Protection. It needs iOS 17.3 or later.
• Android: Theft protection lives under Settings > Google > All services > Theft protection. It includes Theft Detection Lock, Offline Device Lock, Remote Lock, and on supported devices Identity Check. Availability varies by phone model and Android version.

Also confirm Find My or Find Hub is on, so you can locate, lock or erase a lost phone.

App permissions

Check which apps can see your location, contacts, photos, microphone and camera, and remove anything that does not need it. Delete apps you have not opened in months. On iPhone, Safety Check under Settings > Privacy & Security > Safety Check walks you through sharing, app permissions and devices on your Apple Account. On Android, the permission manager in privacy settings gives a similar view.

Protect your number from SIM swaps

A SIM swap is when a criminal convinces your carrier to move your number to their SIM. Port-out fraud is the same trick through a new carrier. Either way, your text-message codes go to them. The FCC adopted rules in 2023 requiring carriers to authenticate customers securely before moving a number, and to notify customers immediately of SIM change or port-out requests.

Your part: call your carrier or open its app, set an account PIN that differs from your phone passcode, and turn on any SIM lock or port-out protection it offers. Names vary by carrier. T-Mobile, for example, calls its free feature Account Takeover Protection. See how the attack works in Scam Atlas under SIM swap. If it has already happened, follow the SIM swap recovery steps in Locked Out.

Common mistakes

• Using the same 4-digit code for the phone and the carrier account.
• Leaving theft protection off because "my phone never leaves my pocket".
• Granting "always" location access to apps that only need it while open.

Action checklist

• Turn on automatic system and app updates
• Set a passcode of at least 6 digits and enable auto-lock
• Turn on Stolen Device Protection (iPhone) or Theft protection (Android)
• Confirm Find My or Find Hub is on
• Review location, camera, microphone and contacts permissions
• Delete apps you no longer use
• Set a carrier account PIN and turn on SIM or port-out protection

Day 3: Secure your home network and router

Time: about 45 minutes. Your router sits between every device in the house and the internet, and most people never log in to it after setup.

What to change

CISA's home network security guidance gives a clear list. Log in to your router's admin page or app, then work through it:

1. Change the admin password. CISA warns about attacks using default credentials. This is the router login, not the Wi-Fi password.
2. Update the firmware. Check the manufacturer's site for the latest version and turn on automatic updates if offered. If the maker no longer ships updates for your model, plan to replace it.
3. Use WPA3. CISA recommends WPA3 Personal with AES. If older devices cannot connect, choose a mixed WPA2/WPA3 mode.
4. Turn off remote management, so nobody can change router settings over the internet.
5. Turn off WPS. Its PIN design allows brute-force attacks.
6. Turn off UPnP unless something you rely on needs it, since malware can use it to open holes in the firewall.
7. Rename the network to something that does not identify you, your family or your address.
8. Check connected devices and remove anything you do not recognise.

Guest network and DNS

Put visitors and smart-home gadgets (cameras, plugs, TVs, speakers) on a separate guest network if your router supports one. That keeps rarely-updated gadgets away from your laptops and phones.

DNS is the phone book your devices use to find websites. Many routers let you choose an encrypted DNS resolver, and some resolvers block known malicious domains. It is a small upgrade, explained in encrypted DNS and Private Relay.

Common mistakes

• Changing the Wi-Fi password but not the admin password.
• Assuming the internet provider updates a router you bought yourself.
• Using the house name or street number as the network name.

Action checklist

• Change the router admin password to a unique one in your manager
• Update the router firmware and enable automatic updates
• Switch Wi-Fi security to WPA3, or WPA2/WPA3 mixed mode
• Disable remote management, WPS and (if unused) UPnP
• Rename the network to something anonymous
• Move smart-home devices and visitors to a guest network
• Remove unknown devices from the connected list

Day 4: Set boundaries with AI assistants and chatbots

Time: about 30 minutes. People now paste contracts, medical questions and work documents into chatbots, which makes their settings part of your security.

What not to paste in

The NCSC's advice on large language models is short: do not include sensitive information in queries to public chatbots, because the provider can see your prompts and may store them. Google's own Gemini privacy help asks users not to enter confidential information they would not want a reviewer to see.

A simple rule: never paste passwords, recovery codes, full card or bank numbers, ID numbers, other people's private details, or work material your employer has not approved. Summarise or redact first.

Data and training settings

Every major assistant has a setting that controls whether your chats are used to improve its models. Check yours:

• ChatGPT: OpenAI's data controls are under Settings > Data controls. Turning off the model improvement option excludes new conversations from training.
• Gemini: With Keep Activity off, Google says future chats are not used to train models, unless you send feedback. Chats are still kept for 72 hours, and chats already reviewed by humans are kept for up to 3 years even if you delete your activity.

Turning training off does not mean nothing is stored.

Connected apps and plugins

Assistants can connect to your email, calendar and cloud drive. Each connection gives the assistant, and anything that tricks it, access to that data. Open the connected apps page and remove anything you do not actively use. Be wary of granting an assistant permission to send email or move files on your behalf. Hidden instructions in a web page or document can steer an assistant, a risk called prompt injection. For the wider picture, see threat modelling AI systems.

Voice clone awareness

Criminals can clone a voice from a short clip. The FBI warns that scammers use AI audio to impersonate a close relative in a crisis, and recommends a secret word or phrase within your family. The FTC's advice is the same in spirit: do not trust the voice, and call the person back on a number you already know. Scam Atlas documents the pattern as the grandparent voice clone. The full defence playbook is in AI-powered social engineering.

Common mistakes

• Pasting a whole document "just to summarise it" without reading what is in it.
• Connecting an assistant to your entire inbox for a one-off task and never disconnecting.
• Assuming a familiar voice on the phone proves who is calling.

Action checklist

• Review the training and history settings in every chatbot you use
• Remove connected apps and plugins you do not actively use
• Write down your personal "never paste" list
• Agree a family code word for emergency calls
• Tell older relatives about voice cloning and the call-back rule

Day 5: Protect your money

Time: about 45 minutes. Today you make fraud harder and make sure you hear about problems fast.

Freeze your credit

A credit freeze stops lenders from opening new accounts in your name, because they cannot pull your report. In the US it is one of the most effective free steps against new-account identity theft. The FTC's guidance covers the basics: placing or lifting a freeze is free, it does not affect your credit score, and you need to contact all three bureaus (Equifax, Experian and TransUnion) separately.

It is also fast to undo. Under the federal rules the FTC announced, bureaus must place a freeze within one business day of an online or phone request, and lift it within one hour. Parents can also freeze, for free, the credit of children under 16. A freeze does not stop misuse of cards you already have, which is why alerts matter.

Outside the US, ask your bank or consumer agency what equivalent exists.

Turn on account alerts

Log in to each bank and card account and turn on alerts for:

• every transaction above a low threshold, or all card-not-present purchases
• new payees or changes to payee details
• password, phone number or email changes on the account
• logins from a new device

Payment app settings

Payment apps move money fast and are hard to reverse. The FTC's payment app advice says to protect your account with multi-factor authentication or a PIN, never share login details with anyone who contacts you, and check the recipient before you pay. It also warns it is hard to get money back once sent. If a friend asks for money through the app, confirm with them directly, because their account may be hacked. Review each app's privacy setting so your transactions are not public.

Common mistakes

• Freezing at one bureau and assuming it covers all three.
• Losing the PIN or login for the freeze, then panicking when applying for a loan.
• Paying a stranger through a payment app for something you have not received.
• Trusting a "bank security team" call. Real banks do not ask you to move money to keep it safe. Scam Atlas covers this under callback phishing.

Action checklist

• Place a credit freeze at Equifax, Experian and TransUnion
• Store each bureau login in your password manager
• Turn on transaction, payee-change and login alerts at every bank and card
• Add MFA or a PIN to every payment app
• Set payment app transactions to private
• Freeze your children's credit if they are under 16

Day 6: Secure your laptops, backups and old devices

Time: about 60 minutes. Computers, backups, and the devices sitting in a drawer.

Updates and disk encryption

Turn on automatic updates for the operating system and your browser. Then make sure the disk is encrypted, so a stolen laptop does not mean stolen files.

• Mac: Go to System Settings > Privacy & Security > FileVault and turn it on. Apple's FileVault guide explains the unlock choices: your iCloud account, or a recovery key you store somewhere safe, away from the Mac.
• Windows: Go to Settings > Privacy & security > Device encryption. Microsoft notes that it turns on automatically when you sign in with a Microsoft account, but not with a local account. The recovery key is attached to that Microsoft account. BitLocker is the fuller option on Pro, Enterprise and Education editions.

Built-in malware protection on modern Windows and macOS is a reasonable baseline; the antivirus comparison sets out the criteria.

Backups

Backups are your protection against ransomware, theft, a dead drive and your own mistakes. The NCSC's Cyber Aware advice is to copy important data, like photos and key documents, to an external drive or cloud storage. Aim for two copies of anything irreplaceable, with one stored away from the device. A cloud backup plus an occasional external drive copy, unplugged when not in use, covers most homes. Test it by restoring one file today. For how ransomware targets backups, read ransomware readiness.

Old devices

Old phones and laptops still hold logins, photos and messages. Before you sell, recycle or hand one down, follow the FTC's four steps, as summarised by CISA: back up your data, remove SIM and SD cards, erase personal information, and verify that it is gone. Sign out of your Apple, Google or Microsoft account first, so activation lock does not block the next owner. Then remove the device from your account's device list.

Common mistakes

• Encrypting the disk but saving the recovery key only on that same laptop.
• Assuming photo sync is a backup. Deleting a photo on one device can delete it everywhere.
• Keeping an old, unpatched laptop online "just for one program".

Action checklist

• Turn on automatic OS and browser updates on every computer
• Turn on FileVault or Device encryption and store the recovery key safely
• Set up an automatic backup of photos and important documents
• Restore one file to prove the backup works
• Wipe or recycle old phones and laptops properly
• Remove old devices from your Apple, Google or Microsoft account

Day 7: Plan your recovery and set a monthly routine

Time: about 45 minutes. Today makes sure you can get back in if something still goes wrong.

Build a recovery kit

A lockout becomes permanent when you have no second way in. Spend this session on the fallback:

• Save backup codes for your email, Apple, Google and Microsoft accounts. Print them or store them offline, not only in the account they unlock.
• Add a second passkey or a hardware security key to your most important accounts, so losing one phone is not fatal.
• Set up emergency access or a legacy contact in your password manager and platform accounts.
• Write down where the essentials live: master passphrase, recovery keys, freeze logins. Store that sheet somewhere physically secure.

Locked Out's recovery kit is a fill-in version of this list. If you are ever locked out, start at Locked Out and use the official recovery path for your platform, such as Google or Apple. Beware anyone offering to recover accounts for a fee. Locked Out explains the common recovery scams.

Know your warning signs

Act quickly on a login alert you did not trigger, MFA prompts you did not start, or reset emails you did not request. A sudden, unexplained loss of phone signal can mean your number was moved, so call your carrier from another phone.

Your monthly 15-minute routine

Put a recurring reminder in your calendar for the first weekend of each month:

1. Install any pending updates on phone, computer and router.
2. Check your password manager's security report and fix one weak or reused password.
3. Review signed-in devices on your email and main platform account.
4. Scan bank and card statements for anything you do not recognise.
5. Remove one app, browser extension or connected AI integration you no longer use.
6. Confirm last night's backup ran.

Once a year, re-check recovery numbers and repeat Day 4 as AI tools change.

Common mistakes

• Storing backup codes only in the email account they are meant to rescue.
• Having one passkey, on one phone, for everything.
• Doing the reset once and never looking again.

Action checklist

• Save and store backup codes for your core accounts offline
• Add a second passkey or security key to your email account
• Set up emergency access in your password manager
• Fill in a recovery kit and store it securely
• Add a monthly 15-minute security reminder to your calendar

Your complete checklist

• Install a password manager and set a unique master passphrase
• Give your main email a unique password plus a passkey or authenticator app
• Remove outdated recovery phone numbers and email addresses
• Move your top ten accounts to unique passwords with MFA
• Turn on automatic updates on your phone and set a 6-digit or longer passcode
• Enable Stolen Device Protection or Android Theft protection
• Set a carrier PIN and turn on SIM or port-out protection
• Change the router admin password and update its firmware
• Switch Wi-Fi to WPA3 and disable remote management and WPS
• Put smart-home devices on a guest network
• Review training settings and connected apps in every AI assistant
• Agree a family code word for emergency calls
• Freeze your credit at all three bureaus
• Turn on transaction and login alerts at every bank and card
• Protect payment apps with MFA or a PIN
• Turn on disk encryption and store the recovery key safely
• Set up automatic backups and test a restore
• Wipe old devices before you sell or recycle them
• Store backup codes and a recovery kit offline
• Schedule a monthly 15-minute security check