Privacy guide
Protect Yourself from Identity Theft & Online Fraud
Learn practical steps to protect your identity, recognise online fraud and strengthen your account security.
Protect your main email and financial accounts first. A VPN does not stop a phishing site from collecting a password you give it.
What you will accomplish
Make important accounts harder to take over and know what to do if something looks wrong.
Do it now
Strengthen sign-in
Use unique passwords stored in a reputable password manager, or supported passkeys. Enable MFA and keep recovery methods current. Change a compromised or reused password; do not rely on a fixed six-month rotation rule.
Check: Each important account has a distinct credential and a recovery option you control.
Verify requests independently
For a payment or urgent account warning, open the official app or a saved bookmark. Do not use the message's login link or share one-time codes with an unexpected caller.
Check: The request is confirmed through a trusted route.
Respond to suspicious activity
Review account sessions and alerts. Revoke unknown sessions where supported and contact the bank or service through its official channel if you see unauthorized activity.
Check: The service has your report and you know the next recovery step.
Check the result
The service has your report and you know the next recovery step. Change one thing at a time so you know what made the difference.
If something does not work
Do not enter passwords, recovery codes, identity documents or card details into a privacy-check website. For suspected fraud, use your bank's official reporting process and appropriate local authorities.
Open the Browser Privacy Setup Guide for device-specific steps, completion checks and undo instructions.
Background and further explanation
Passwords and recovery
Unique credentials reduce the damage when one service is breached. Password managers can make long, distinct passwords practical; passkeys can offer phishing-resistant sign-in where supported. Protect the password manager and recovery methods too. Routine forced password changes are not a substitute for changing compromised credentials or enabling appropriate MFA.
Securely stored recovery codes can help when a device is lost. Do not share them or keep the only copy on the device you would need to recover. For the authentication guidance behind this advice, see NIST's authentication and authenticator-management guidance.