Big data breaches happen quietly. A service you used years ago gets hacked, the database ends up for sale and your email address with its password starts circulating. You get no warning at all.
You find out later: strange logins, attempted purchases, messages sent from your account.
Why an old password is still dangerous
Because almost everyone reuses the same combinations. Criminals know this and automatically try the stolen email and password pair on dozens of other services: mail, social networks, online shops, banking. One match is enough.
How to check right now
There are public services that let you enter your email address and see which breaches it appears in. That is the first check to run, free and immediate.
The limitation is that you have to query them manually and they only cover breaches already made public. The continuous monitoring included in complete security suites, on the other hand, automatically checks email addresses, phone numbers and card details, and alerts you as soon as they show up somewhere.
How to tell an account has been compromised
Some signs are obvious, others less so. Watch out for:
- alert emails about logins from countries or devices you do not recognise;
- password reset requests you did not make;
- messages sent from your account that you did not write;
- orders, subscriptions or charges you do not recognise;
- changed settings, such as automatic email forwarding to an unknown address.
That last one is one of the most common tricks: the attacker sets up forwarding and keeps reading your mail even after you change your password. Always check the forwarding rules in your email settings.
How to create truly secure passwords
A secure password today is above all long and unique. A phrase of four or five random words is better than a short word with symbols. But the most important rule is never to use it on two different sites.
Remembering dozens of different passwords is impossible, which is why password managers exist: you remember only one, the master password, and the program generates and fills in all the others.
Two-step verification: which kind to choose
- SMS: better than nothing, but the weakest, because messages can be intercepted or your number can be moved to another SIM.
- Authenticator apps: generate a code on your phone that changes every 30 seconds. Much more secure.
- Passkeys and physical security keys: the highest level, practically immune to phishing. More and more services support them.
Turn it on at least for email, banking, social media and work accounts.
Passkeys: the password-free future
Google, Apple, Microsoft and many other services already let you sign in with passkeys: instead of typing a password, you confirm the login with your phone's fingerprint, face or PIN. There is nothing to steal in a data breach and nothing to type into a fake site. Where available, it is worth turning on.
If your card details were stolen
If the exposed data includes your payment card, call your bank immediately to block it and have a new one issued, check recent transactions and dispute any you do not recognise. Turn on notifications for every payment so you spot any unusual charge straight away.
What to do, in the right order
- Change the password of your main email account first: it is the key that opens all the others.
- Turn on two-step verification wherever it is available.
- Change reused passwords, starting with banking, payments and work accounts.
- Do not invent them in your head: use a password manager, so every service gets a different, long password.
- Check your devices: if a password was stolen by spyware, changing it is not enough while the spyware is still there.
Points four and five are the same product
Password manager, breach monitoring and antivirus are now bundled together by the main security suites. Buying them separately means paying two or three times for features you can have in one.
Take our free quiz: we tell you which suite really covers your devices, breach monitoring included, and where it costs least right now.