A Household Cybersecurity Plan for Email, Banking, Phone, and Home

Almost every account you hold, from the brokerage login to the utility portal, can be reset through a single email inbox. That makes the inbox, more than any bank password, the thing most worth protecting, and it makes household cybersecurity less a matter of gadgets than of order: which lock goes on first, and who holds the spare keys.

This plan is for a household that may now have one decision-maker where there used to be two. By the end you should know what to secure this week, what to ask your carrier and bank to change, and what belongs in your estate file.

Treat your primary email as the master key

Begin with the address your bank and advisers use for password resets; it is the account a thief most wants.

CISA’s Secure Our World guidance recommends passwords of at least 16 characters, either a random string or a passphrase of unrelated words, and a different one for every account. Give this account such a password and its strongest second factor. Check the recovery phone number and backup address; an old number is a side door left open. Then review the apps you have allowed to connect to the account and remove any you do not recognize, because an app you once authorized can keep its access after a password change.

Whoever controls your email can reset nearly everything else, which is why the inbox deserves the strongest lock in the house.

A password manager, and the strongest second factor each account allows

No one can remember forty unique passwords of that length. As CISA describes it, a password manager generates, stores, and fills them in, so you need to remember only one: the password that opens the manager. Use it nowhere else. Before recording anything for an estate file, learn exactly how that manager handles recovery and emergency access; a sealed recovery kit or emergency-access designation may be safer and more useful than a loose copy of the master password.

Second factors, in the FTC’s grouping, are something you know, something you have (a code, an authenticator app, or a security key), or something you are. They are not equally strong. The FBI warns that multi-factor authentication will not protect you on a fraudulent login page, since a code typed into a convincing fake can be passed to the real site. In CISA’s ranking, the strongest is phishing-resistant authentication built on the FIDO/WebAuthn standard: a physical key you plug in or tap against a device, or an authenticator built into your phone or laptop, which many services now offer as a passkey. Authenticator apps come next. Codes sent by text or voice call are, in CISA’s words, a last resort, vulnerable to phishing and to SIM swaps.

Where an account allows it, use this order:

1. A passkey or physical security key.
2. An authenticator app.
3. A text or voice code, only where nothing better is offered.

Any second factor is better than none. Register two physical keys and keep the spare in your safe. Never read a code aloud to someone who has called you; as the FBI notes, companies generally do not ask for one.

Lock your mobile number against SIM swaps and port-outs

Your mobile number is often the fallback for everything above. In a SIM swap, as the FCC describes it, a criminal persuades your carrier to move your service to a phone the criminal holds. In port-out fraud, the criminal, posing as you, opens an account with another carrier and has your number transferred there. Either way, your phone goes quiet and your codes go to someone else.

On November 15, 2023, the FCC adopted rules requiring wireless carriers to authenticate a customer securely before a SIM change or port-out, to notify the customer immediately and before acting on the request, and to offer every customer, at no cost, the option to lock the account against both. The rules also call for an easy way to report fraud and, on request, documentation of a fraudulent change. The order left the compliance date to a later announcement. The eCFR was current through October 16, 2026 when this guide was reviewed, and both the SIM-change rule and the port-out rule still said compliance was not required until a date is inserted. Do not assume the protections are active on your line. Ask your carrier for a SIM-change lock, a port-out lock, and an account PIN used nowhere else, and confirm where alerts will go.

If your phone suddenly shows no service while others nearby have it, call the carrier from another line, then your bank.

Make your bank tell you everything, immediately

Ask for alerts on every card transaction and transfer, however small, and on any new payee, wire, change of contact details, password reset, or sign-in from a new device.

In November 2025 the FBI’s Internet Crime Complaint Center warned that criminals impersonating bank staff were taking over accounts; it had received more than 5,100 complaints of account takeover fraud since January 2025, with losses exceeding $262 million. Typically, a call or text reports fraud, asks for your one-time code, and uses it to reset your password and move money. The FBI’s advice: reach your bank through a bookmark rather than a search result, do not trust caller ID, and hang up and call a number you have verified yourself.

Suppose a text that appears to come from your bank’s fraud desk asks you to confirm a wire you did not send. Close it and call the number on your card. If money has moved, the FBI advises asking the bank at once for a recall and a Hold Harmless Letter or Letter of Indemnity, and filing a complaint at ic3.gov; speed may reduce or eliminate the loss. If you have a private banker, ask about a verbal password or call-back requirement for wires.

The house network, its devices, and its backups

The FTC recommends changing both the router’s default administrator credentials and its Wi-Fi password, keeping firmware updated, and turning off remote management, Wi-Fi Protected Setup, and Universal Plug and Play unless a specific need justifies them. Use WPA3 Personal where supported, or WPA2 Personal if WPA3 is unavailable. If a router offers only the obsolete WPA or WEP choices even after an update, replace it.

Every camera, thermostat, and television is a small computer. In March 2026 the FBI warned that compromised devices, including streaming boxes, digital picture frames, and routers, can route criminals’ traffic through a household’s connection, making the homeowner appear responsible. It advised avoiding streaming devices that promise free movies, shows, and sports, using only official app stores, and keeping firmware current, and noted that factory-installed malware may survive a factory reset. Buy from established makers, and keep smart devices on a guest network, away from the computers that hold your records. When an installer or staff member who set these up leaves, change the credentials; our guide to household security after a change in occupancy covers the physical side.

CISA advises turning on automatic updates and installing all of them, especially for web browsers. The FTC recommends backing up your computer to an external drive or the cloud, and your phone as well. Keep one of each, with the drive in a safe, and test a restore once a year.

Recognizing phishing when it is well made

The FTC lists the usual stories: suspicious login attempts, a problem with your payment details, a request to confirm personal information, an unfamiliar invoice, a payment link, a government refund. CISA adds urgent or emotional language and addresses that differ by a letter from the real one, and cautions that with artificial intelligence, some fraudulent emails now have perfect grammar.

The reliable test is where your response would go. If you have an account with the apparent sender, contact the company through a number or website you already know. If not, report and delete. The FTC asks that phishing emails be forwarded to reportphishing@apwg.org, texts to SPAM (7726), and attempts reported at ReportFraud.ftc.gov.

Decide who can reach your own accounts if you cannot

Several large account and cloud providers let you name a legacy contact or plan for long inactivity. Set these up for your principal accounts and note them in your estate file. A legacy contact typically receives data rather than your credentials. For the password manager, use a documented emergency-access or recovery method the provider supports; if no suitable feature exists, ask your estate-planning lawyer how to store a sealed recovery kit without giving anyone premature access. How state law treats online designations alongside a will is explained in our guide to digital accounts after a death.

Securing your late husband’s phone, laptop, and accounts

His devices may hold the only copies of photographs, records, and the authenticator apps that generate his codes. Do not reset, sell, or give them away until your executor agrees on what to preserve. Keep them charged and secure, and avoid repeated passcode guesses, which can lock a device.

His mobile number may still receive codes for his accounts and some of yours. Keep the line active, under your own carrier account and with both locks, until each such account is transferred, closed, or updated. Keep his email active too, since some providers delete accounts after long inactivity. A password you happen to know is not the same as authority to sign in; use each provider’s survivor process and your executor’s authority. A deceased person’s identity also attracts fraud, and our identity theft response plan sets out the reports to make.

A household cybersecurity checklist

1. Give your primary email a long, unique password, its strongest second factor, and current recovery details.
2. Install a password manager and replace reused passwords, starting with email, banking, and your carrier.
3. Use passkeys or security keys where offered, otherwise an authenticator app, with a spare key in the safe.
4. Ask your carrier for SIM-change and port-out locks and a unique PIN, for your line and your husband’s.
5. Turn on bank and card alerts for every transaction, new payee, and contact change.
6. Secure the router, update its firmware, and move smart devices to a guest network.
7. Turn on automatic updates and keep one local and one cloud backup.
8. Name legacy contacts and set up emergency access to your password manager.
9. Preserve your husband’s devices and accounts until your executor decides what to keep or close.

This article provides general U.S. educational information and is not legal, technical, or financial advice. Confirm current protections with your carrier, bank, and service providers, and consult a qualified professional who knows your facts.