Cybercrime · Do

Lock it down. One hour, $0.

Is a scam happening right now? Start here.

One hour, $0: guard your email, learn the call-back rule, then lock your phone number and freeze your credit. The cybercrime that reaches a household is rarely a hacker who picked you. It’s a scam sent to everyone, or a password leaked from someone else’s breach. Americans reported a record $20.9 billion in losses to the FBI in 2025.¹ Print it; tick it.

What’s true Keep it going

The whole thing

1. Get a password manager, then guard your email.

   Whoever controls your email can reset everything else. Put a passkey or two-step sign-in on it first, then on your bank, your phone carrier and the manager itself. weak: Google’s data on its own users In Google’s data, any second step blocked nearly all automated account takeovers, and not one security-key user was phished.²² The exact taps.

   25 minutes · $0

2. Learn the call-back rule.

   The three tells are urgency, secrecy, and a payment you can’t reverse. When one shows up, hang up and call back on a number you already have. none but plausible: aimed at the biggest losses It’s the habit that touches where most of the money goes: investment, business-email and tech-support scams took $13.8 billion of the $20.9 billion.¹ In one trial, warning banners on suspicious emails cut clicks by about two-thirds; nobody has tested the rule itself.²³ The rule and a family safe word.

   2 minutes · $0

3. Lock your phone number and freeze your credit. US

   Two switches. A credit freeze is free by law,⁷ AT&T and T-Mobile say their number locks are free;⁵⁶ Verizon’s help page names no price.⁴ none but plausible: small share of losses A stolen number gets your codes; a freeze stops new accounts in your name. SIM swaps were $17 million of the $20.9 billion, and about 7% of identity-theft victims had a new account opened in their name, so do these after the two above.¹²⁴ Your carrier’s steps.

   20 minutes · $0 for the freeze

Pick the day and time you’ll do step one:

That is most of the protection. The full list below adds backups, updates, one older relative, and what to do if it already happened.

Near you

Enter your ZIP code and this page adds the steps that depend on where you live: your state’s own programs and laws, and the finders that take a ZIP. The code stays in your browser, like the ticks.

1. A password manager 10 min

• iPhone, iPad or Mac: the Passwords app is already there (iOS 18 and later). Turn on sync in Settings → [your name] → iCloud → Passwords.
• Android or Chrome: Google Password Manager is built in. Go to passwords.google.com → Go to Password Checkup → Check passwords to find reused or leaked passwords.
• Mixed devices: Bitwarden Free works on all of them, with unlimited passwords and devices.¹⁰
• Today, change only three passwords to long ones the manager makes: email, bank, phone carrier. Fix the rest as sites prompt you.
• Turn on two-step sign-in for the manager itself, and let it fill passwords for you. When it won’t fill a page, stop and check the address: that’s a phishing check you get for free.

2. Passkeys or two-step sign-in 15 min

• Google: myaccount.google.com → Security & sign-in → How you sign in to Google → Turn on 2-Step Verification. For a passkey: passkeys page → Create a passkey.³
• Apple Account: on iPhone, Settings → [your name] → Sign-In & Security → Two-Factor Authentication. It’s on by default for most accounts, so check rather than assume.¹¹
• Microsoft (Outlook, Hotmail, Xbox): account.live.com/proofs/manage → Add a new way to sign in or verify → Face, Fingerprint, PIN, or Security Key.¹²
• Your bank: in the app, open Profile or Security and look for “passkey”, “two-step” or “security key”. Take the strongest one offered. If text codes are the only option, use them anyway.

Text-message codes are the weakest kind, because a thief who takes your number gets them too. Google still says any two-step sign-in beats none.³ Step 3 makes taking your number harder.

3. Lock your phone number 5 min

• Verizon: My Verizon app → Me → Edit profile and settings → Security. Turn on SIM Protection, then Number Lock. You need both: Number Lock alone doesn’t stop a SIM change.⁴
• AT&T: AT&T app → the person icon → Wireless account lock → swipe to lock. Prepaid: Profile & Settings → Account Info & Preferences → Wireless Account Lock.⁵
• T-Mobile: T-Life app → Manage → the gear icon → Security → SIM Protection, and turn it on for the whole account. Then Manage → See Plans → Manage add-ons, tick Port Out Protection and submit; repeat for each line. T-Mobile says both are free. For the account PIN: Account → the gear icon → Security → T-Mobile ID → Account PIN/Passcode, on T-Mobile’s network with Wi-Fi off. On Apple devices, SIM Protection doesn’t stop an eSIM transfer.⁶
• Any other carrier: call and ask for “port-out protection” or a “number lock”, plus an account PIN.

4. Freeze your credit 15 min

A freeze stops anyone, including a thief with your Social Security number, from opening new credit in your name. It’s free and doesn’t touch your score. You place it at each bureau separately.⁷ It stops new accounts: in 2021, about 7% of identity-theft victims had one opened in their name. Most identity theft is misuse of accounts you already have, which a freeze doesn’t touch.²⁴ Register your own account at each bureau while you’re there, so you hear about any change to it: TransUnion itself was breached in July 2025, and Experian has let strangers re-register over existing accounts.²⁵

• Equifax
• Experian · 1-888-397-3742
• TransUnion · 1-800-916-8800
• Optional: an IRS Identity Protection PIN stops anyone else filing a tax return in your name. Without an IRS online account, you set one up and verify your identity first.¹⁸

Applying for a loan, a card or an apartment? Lift the freeze online first. By law it has to come off within an hour.⁷

5. See what’s already out there 3 min

• Put your email into Have I Been Pwned and click Notify me, or use Mozilla Monitor, which does the same job. If a breach lists a password you still use anywhere, change it there.¹⁹

6. Back up 5 min

• iPhone: Settings → [your name] → iCloud → iCloud Backup → Back Up This iPhone. The free 5 GB fills fast; 50 GB is $0.99 a month.
• Android: Settings → Google services → All services → Backup. It uses your Google account’s free 15 GB.
• Mac: System Settings → General → Time Machine → Add Backup Disk. You need an external drive, so this one isn’t $0 if you don’t own one.
• Windows 11: open the Windows Backup app and turn on Desktop, Documents and Pictures.

For one household, ransomware is rare: 3,611 complaints in all of 2025.¹ A lost, stolen or dead phone is only a disaster when there’s no second copy.

7. Let it update itself 5 min

• iPhone: Settings → General → Software Update → Automatic Updates, all on.
• Mac: System Settings → General → Software Update → the (i) next to Automatic Updates → turn everything on.
• Android: the menu differs by maker; search your phone’s help page for “software update”.
• Chrome: it updates when it restarts. When you see Relaunch, click it.
• Still on Windows 10? Support ended on 14 October 2025. Free extended security updates run to 12 October 2027 if you sync your PC settings to a Microsoft account; otherwise they cost 1,000 Rewards points or $30.¹⁷ Without them, the PC gets no security fixes.

8. Hang up, call back, and a family safe word 2 min

• When a call feels wrong, hang up and call back on a number you already have. The FTC’s rule for voice clones: “Don’t trust the voice.”⁹ none but plausible
• Then pick a word or phrase only your family knows, and ask for it when someone calls as your kid, your parent or you, in trouble and needing money. The FBI suggests it; nobody has measured it.⁸ none but plausible
• Learn the three tells: urgency, secrecy, and a payment you can’t reverse (wire, crypto, gift cards).

Done? You’ve closed the doors most household cybercrime uses. Send this page to the person in your family most likely to get the “Grandma, it’s me” call.

9. One older relative 10 min

People over 60 reported $7.7 billion in losses in 2025, about $38,500 each on average.¹ Be the person they talk an offer over with, and make it mutual, not supervision: you’re each other’s second person.

• Agree a rule both ways: “Neither of us sends more than $500 to anyone new without calling the other first.” moderate: correlational Of 1,408 people who reported a scam, those who engaged and told no one at the time lost money more often.²⁶
• Ask their bank or brokerage to add a trusted contact: someone it may call if a transaction looks wrong.
• Save the National Elder Fraud Hotline, 833-372-8311 (US Department of Justice). It assigns a case manager, and warns that scammers impersonate it too.²⁷
• Say the shame out loud first: in one survey of fraud victims, only about a third reported it to the authorities, and nearly half blamed themselves. “If it ever happens, call me, and we fix it together.”²⁸

If it already happened

• Money left your account: call your bank’s fraud line the same day. For an electronic transfer you didn’t authorise, federal rules cap your loss at $50 if you report it within two business days of finding out. A payment you were tricked into sending yourself isn’t covered by that rule. A bank wire isn’t covered either: the rule leaves out transfers through Fedwire and similar systems. Ask the bank for a wire recall the same day; the sooner you report, the better the odds. If you sent it abroad through a money-transfer service, federal rules let you cancel free within 30 minutes, if the money hasn’t been picked up.²⁹ Then report at ic3.gov. In 2025 the FBI’s recovery team froze $679 million of the $1.16 billion it chased, across about 3,900 cases out of a million complaints; frozen isn’t always returned.¹
• A scam text: forward it to 7726 (it spells SPAM) to report it, then delete it.³⁰
• Someone used your identity: identitytheft.gov builds a recovery plan and pre-filled letters. Then freeze your credit.
• Any scam, even with no loss: report it at reportfraud.ftc.gov. Reports feed the database law enforcement uses.
• An account was taken over: go to the provider’s recovery page by typing its address yourself, never from a link in a message. Then do step 2 for that account.

What happens after

• After you call your bank’s fraud line about an electronic transfer you didn’t make, it has 10 business days to investigate. It can take up to 45 days if it puts the money back in your account, provisionally, within those 10 days. Some cases get longer, such as debit-card purchases and new accounts. It may ask you to confirm in writing within 10 business days of your call; if you don’t, it needn’t put the money back while it looks. It sends the result within three business days of finishing, with a written explanation, and you can ask for the documents it used.³⁵ Report any transfer you didn’t make within 60 days of the statement that shows it, or you can be liable for later ones.²⁹
• A bank wire isn’t covered. The rules exclude transfers through Fedwire or a similar wire system.³⁵ Ask the bank to reverse it anyway. The FTC says that’s unlikely to work, and that you should still ask.³²
• After you report at ReportFraud.ftc.gov, your report goes into a database open to over 2,000 law enforcement partners. The FTC uses reports to bring cases. It can’t resolve yours, answer it or give you updates. You get next steps on screen, and by email if you give an address. Save or print the report before you leave the page: you can’t get a copy later. Typically nobody calls; if the FTC does, the caller will have your report number. If an FTC case gets money back, the FTC tries to contact the people who lost it.³²
• After you report at ic3.gov, an analyst reviews it and may pass it to law enforcement. You won’t hear from the IC3: it doesn’t investigate and can’t tell you a status. The FBI says it will contact you if it needs more information. Save or print the complaint when you submit it; it isn’t emailed. Keep your evidence, because an agency that opens a case may ask you for it. To add something, file a new complaint that says so.³³
• After you report at IdentityTheft.gov, you get an FTC Identity Theft Report and a recovery plan. The report proves to businesses that someone stole your identity. With it you can place a seven-year fraud alert and have fraudulent information blocked from your credit report. With an account, the site walks you through each step and pre-fills forms and letters. Without one, print the report and plan at once: they’re gone when you leave the page.³⁴
• After you freeze your credit, each bureau must send you written confirmation within five business days and tell you how to lift it. The freeze stays until you ask. Lifting is free: within an hour online or by phone, three business days by mail, and you can lift it for dates you choose. Experian runs it from a free account with no PIN and can email you when it changes. Equifax uses your myEquifax login online, or by phone a one-time PIN by text.³⁶
• After you help an older relative call the Elder Fraud Hotline, they get a case manager who stays their contact.²⁷ The case manager helps report the fraud to the right agencies and can help you fill in the IC3 and FTC forms for them. The hotline doesn’t investigate and can’t promise the money back. It won’t share the case without consent, but its staff may have to report suspected abuse or immediate danger. Callers can stay anonymous.³⁷

In other languages: ReportFraud has a full Spanish site; the elder fraud hotline answers in English, Spanish and other languages; the FBI’s IC3 complaint form is in English only.³¹

If you run something small

A PTA, a church, a club, a five-person business. These five matter most.

• Two-step sign-in for everyone, admins first. Microsoft 365: entra.microsoft.com → Entra ID → Overview → Properties → Manage security defaults → Enabled (free).²⁰ Google Workspace: Admin console → Security → Authentication → 2-step verification, then set enforcement.
• Confirm every payment change by phone. Make it a written rule: new bank details or an “urgent” payment get a call to a number you already have. Business email scams cost $3.05 billion in 2025.¹
• Keep one backup ransomware can’t reach, and restore one file from it each quarter to prove it works.
• Turn on automatic updates everywhere, and deal with any Windows 10 machine.
• Remove people’s access the week they leave. Shared logins go in a shared password-manager vault, not a spreadsheet.

Questions people ask

Ask for one thing

The federal grant that pays for cyber defence in towns, counties, schools and water systems, the State and Local Cybersecurity Grant Program, expired in September 2025. The House passed a renewal; as of September 2026 it hadn’t moved in the Senate.¹⁵ Find your senators at senate.gov and say: “Please support a long-term reauthorization of the State and Local Cybersecurity Grant Program, and fund it.”

Honestly, one call is a small push. It protects your town’s systems, not your accounts. Your hour on the list above is the part that changes your own risk.

With an AI beside you

Paste these into Claude, ChatGPT or Gemini. Never paste a password or a code.

Send this page to one person:

Sources

1. FBI Internet Crime Complaint Center, 2025 Internet Crime Report, April 2026. primary Its investment ($8.65 billion), business email ($3.05 billion) and tech-support ($2.13 billion) losses add up to $13.8 billion. our arithmetic
2. FTC, testimony to the Joint Economic Committee, 25 March 2026. primary
3. Google, Turn on 2-Step Verification and passkeys, checked 5 Nov 2026. primary
4. Verizon, SIM Protection and Number Lock, checked 5 Nov 2026 and re-read 6 Nov 2026 (it gives the steps and names no price). primary
5. AT&T, Wireless Account Lock, updated 22 April 2026. primary
6. T-Mobile, Protect your T-Mobile account from fraud (steps for SIM Protection, Port Out Protection and the account PIN; both protections “a free feature”) and SIM Protection (the eSIM limit), read 6 Nov 2026. The two pages give different menus and disagree on Prepaid; the steps here follow the fraud page. primary
7. FTC, What to know about credit freezes, August 2025, and Free credit freezes are here, page dated 23 June 2022 (the law took effect 21 September 2018) primary. TransUnion’s site blocked our read; its number is confirmed in the CFPB’s 2025 list of consumer reporting companies primary.
8. FBI, public service announcement on generative-AI fraud, 3 December 2024. primary
9. FTC, Scammers use AI to enhance family emergency schemes, 20 March 2023. primary
10. Bitwarden, pricing, checked 5 Nov 2026. primary
11. Apple, Two-factor authentication for Apple Account, 13 August 2026. primary
12. Microsoft, Create and save a passkey, checked 5 Nov 2026. primary
13. LastPass, Notice of security incident, 22 December 2022. primary
14. UK National Cyber Security Centre, Password managers, reviewed 21 May 2026. primary
15. StateScoop, House passes bill to reauthorize state and local cyber grant program, 18 November 2025, and grant program tops state CIOs’ priorities, 1 September 2026. news
16. Cybersecurity Ventures, cybercrime damage projection, 13 November 2020. industry projection
17. Microsoft, Windows 10 end of support, checked 5 Nov 2026. primary
18. IRS, Get an Identity Protection PIN, updated 2 November 2026. primary
19. Have I Been Pwned FAQs, checked 5 Nov 2026. primary
20. Microsoft, Security defaults in Microsoft Entra ID, article dated 21 July 2025, checked 5 Nov 2026. primary
21. FBI, North Korea responsible for $1.5 billion Bybit theft, 26 February 2025; joint advisory AA25-239A, 27 August 2025. primary
22. Google Security Blog, How effective is basic account hygiene at preventing hijacking, May 2019 (SMS codes blocked 100% of automated bot attacks, 96% of bulk phishing and 76% of targeted attacks; security keys blocked all three) industry research; NIST, SP 800-63B-4, July 2025 (one-time codes are not phishing-resistant) primary.
23. Lain, Kostiainen and Čapkun, Phishing in organizations: findings from a large-scale and long-term study, IEEE Symposium on Security and Privacy, 2022 (14,733 employees in 12 near-equal groups; 3,964 clicks with no warning against 1,427 and 1,289 with short and detailed warnings; voluntary training after a failed test didn’t help, and clicks were higher with it) research; “about two-thirds” is our reading of those counts our arithmetic.
24. Bureau of Justice Statistics, Victims of Identity Theft, 2021, October 2023 (23.9 million victims in the year; 1.6 million had a new account opened in their name; for 76%, the latest incident was misuse of one kind of existing account, and for 3.2% a new account alone) primary; 1.6 of 23.9 million is about 7% our arithmetic.
25. TechCrunch, TransUnion says hackers stole 4.4 million customers’ personal information, 28 August 2025 news; Krebs on Security, on Experian account re-registration, November 2023 news.
26. FINRA Investor Education Foundation, BBB Institute and Stanford Center on Longevity, Exposed to Scams: what separates victims from non-victims?, September 2019, an issue brief (a survey of 1,408 people who had reported a scam to BBB Scam Tracker; among those who engaged, those who discussed it with no one were more likely to lose money; when a bank, wire service or other company stepped in, 51% avoided the loss). industry research
27. US Department of Justice, Office for Victims of Crime, National Elder Fraud Hotline, read 6 Nov 2026. primary
28. FINRA Investor Education Foundation, Non-traditional costs of financial fraud, March 2015, a report by Applied Research & Consulting (an online survey of 600 self-reported victims of financial and investment fraud; 35% reported it to the authorities; 47% blamed themselves; of those who didn’t report, 48% said it “wouldn’t have made a difference” and 29% “was embarrassed”). industry research
29. Consumer Financial Protection Bureau, Regulation E §1005.6, §1005.3(c)(3) (wires through Fedwire, CHIPS, SWIFT and similar systems excluded; also on eCFR, current to 4 Nov 2026), its electronic fund transfer FAQs and money transfer FAQs (the 30-minute cancellation), read 6 Nov 2026 primary; its archived 2019 blog on mortgage closing scams (“Ask for a wire recall”) primary. Whether a wire started in online banking is partly covered is disputed: the CFPB said so in 2024 and withdrew it in March 2025, per Goodwin news.
30. FTC, How to recognize and avoid phishing scams, September 2022, read 6 Nov 2026 through a fetch tool (forward scam texts to 7726). primary
31. FTC, What to do if you were scammed (read through a fetch tool; the site refuses scripts) primary; ReportFraud in Spanish primary; US Department of Justice, National Elder Fraud Hotline page (hours and languages) primary; FBI IC3 complaint form, read 6 Nov 2026 primary.
32. FTC, ReportFraud.ftc.gov FAQs (“After I file a report” and “Getting my money back”), read 6 Nov 2026 in a headless browser. primary
33. FBI Internet Crime Complaint Center, Frequently asked questions (“After a complaint is filed”), read 6 Nov 2026. primary
34. FTC, IdentityTheft.gov recovery steps and Know your rights, read 6 Nov 2026 in a headless browser. primary
35. Consumer Financial Protection Bureau, Regulation E §1005.11, error resolution, and eCFR, 12 CFR 1005.3(c)(3) (up to date as of 4 Nov 2026), read 6 Nov 2026. primary
36. Consumer Financial Protection Bureau, What is a credit freeze?, last reviewed 5 September 2025, and the law it describes, 15 U.S.C. §1681c-1(i) (Cornell LII’s copy) primary; Equifax and Experian freeze pages primary; all read 6 Nov 2026. TransUnion’s page blocked our read, so this says nothing about how TransUnion lifts a freeze. unread
37. US Department of Justice, Office for Victims of Crime, National Elder Fraud Hotline FAQs, page created 18 March 2021, read 6 Nov 2026. primary

Menu names change every few months. Each path was read from the company’s own help page on 5 Nov 2026 unless the source says otherwise.

No tracking on any link.Ticks stay on this device.Facts checked 5–6 Nov 2026.What changedContested