Digital Safety Guide

Why: If something malicious is already on your computer, it can read every password you type from now on — including the new ones you're about to create. So do this first. Start the scan, then continue with the steps below while it runs.

Option A — A paid security suite with identity protection (if you can afford the subscription)

Beyond device protection, the top tiers of these suites watch for your personal data being misused: dark-web monitoring for your email, passwords and ID numbers; credit-file monitoring; alerts for social-media impersonation; and help plus insurance if your identity is stolen. That's the layer a free scan can't give you.

• Malwarebytes Ultimate — device protection + VPN + identity protection, personal-data removal from broker sites, and identity-theft insurance. malwarebytes.com/pricing
• Bitdefender — consistently at or near the top of independent detection tests, and usually the lightest on an older or slower computer. Its Premium/Ultimate tiers add the same VPN and identity-monitoring layer. bitdefender.com
• Norton 360 with LifeLock — the long-established alternative with similar identity protection, covering more devices per plan. us.norton.com/products
• Any is fine; pick whichever you find easier to use. Expect roughly $100–150 for the first year. Check the renewal price before you buy — they all charge substantially more from year two, so set a calendar reminder for a month before renewal to review or switch.

A note on VPNs. All three suites above bundle a VPN, and you can also buy one on its own — NordVPN and Surfshark are the two most commonly recommended (roughly $3–5/month on a longer plan). A VPN encrypts your internet traffic, which genuinely matters on public Wi-Fi — hotels, airports, cafés, conference centres, retreat venues — where you can't know who else is on the network. It also hides your home IP address from the sites you visit. Be clear about what it does not do: a VPN will not stop malware, will not spot a phishing page, and will not protect an account whose password has leaked. Treat it as good hygiene for travelling, not as a substitute for any step in this guide.

If a subscription isn't in your budget: the free path below gives you the same device protection, and steps 4, 6 and 7 (device review, carrier lock, credit freeze) cover the most important parts of identity protection for free.

Two more free tools that partly enhance the monitoring: haveibeenpwned.com (tells you if your email appeared in a known breach — sign up for alerts) and Google's built-in Dark web report (Google Account → Security → "Dark web report").

And one free thing that takes 30 seconds: clear your browser cookies. Cookies are what keep you signed in to sites, so deleting them is a quick way to end every logged-in session on that computer at once — including any an intruder is sitting in. Chrome/Edge/Brave: Settings → Privacy and security → Delete browsing data → tick Cookies and other site data → time range All time. Safari: Settings → Privacy → Manage Website Data → Remove All. Firefox: Settings → Privacy & Security → Cookies and Site Data → Clear Data. You will have to sign back in everywhere afterwards — that is the point, and it's a good moment to do it with your new password manager (step 5).

Option B — Free alternatives (just as effective for a scan; nothing to buy)

• Windows: Windows Security is already built in and excellent. Start → type "Windows Security" → Virus & threat protection → Scan options → Full scan → Scan now. It can take an hour or more — that's normal, keep using the computer. Step-by-step with screenshots: How to run a full scan using Windows Security. If an old expired antivirus (McAfee, Norton, etc.) is still installed, uninstall it first — it can block Windows Security from running.
• Mac: macOS protects itself silently, but for a one-time check use the free version of Malwarebytes: malwarebytes.com/mac — install, run one scan, then either keep it (the free version stays free) or uninstall it. Decline the paid trial if you don't want it.
• Android: Play Store → your profile picture → Play Protect → Scan.
• iPhone/iPad: there is no scanner to run — Apple does not let security companies build apps that can inspect the rest of the phone, so any "iPhone antivirus" in the App Store is not actually scanning anything. That is not the same as iPhones being safe. They are compromised regularly, in three ways: a malicious app installed after a phishing message; a configuration profile or "VPN" a scam support agent talked you into adding, which can then route or monitor your traffic; and, more rarely, zero-click exploits delivered through iMessage or a web page that need no tap from you at all. So instead of scanning, you check by hand — five minutes, and worth repeating a couple of times a year:
  • Apps you didn't install: Settings → General → iPhone Storage — scroll the whole list and delete anything you don't recognise.
  • Configuration profiles and unexpected VPNs: Settings → General → VPN & Device Management — unless your employer or school issued the phone, this should normally be empty. Remove anything you didn't knowingly add.
  • Permissions: Settings → Privacy & Security — check which apps have Location, Microphone, Camera, Photos and Full Disk access, and revoke anything that has no business with it.
  • Safety Check: Settings → Privacy & Security → Safety Check — Apple's guided review of who and what you're sharing with; it also has an Emergency Reset that cuts all sharing at once. Apple: How Safety Check works

Keeping the phone updated (step 2) is what closes the zero-click holes, which is why step 2 matters as much on iPhone as anywhere else.

Either option — if the scan finds something: let it remove it, restart, then run the scan once more. But do not stop there, and do not assume the removal was complete: modern malware is specifically built to hide from scanners, so a clean second scan is reassuring rather than conclusive. Treat every password you have typed on that computer as known to someone else, and treat any account that has shown up in a breach check the same way — change its password from a different device and turn on 2FA (step 3) while you're in there, because a new password alone won't keep out someone who still has a way back in. Appendix A at the end of this guide walks through the whole clean-up in order, including when a full reset is the honest answer.

Why: Most attacks work by exploiting flaws that were already fixed — on computers that hadn't installed the fix. Automatic updates close those holes without you having to remember. Do this once and you're done.

The words matter here: what you want on is security updates. Plenty of people switch off automatic updates for a reason that is entirely rational — a big OS upgrade can break the software and workflows they depend on. (Apple's phase-out of Rosetta 2, which is what lets older Intel-era Mac apps run on Apple Silicon, is a good recent example of a change that stops working software from working.) The good news is that these are two different things, and every system lets you accept the small, frequent security fixes without being pushed into the next major version. If you only do one thing in this step, do that.

• Windows: Settings → Windows Update → check for updates and install everything, then restart. Updates are automatic by default; just don't keep postponing the restart.
• Mac: System Settings → General → Software Update → install anything waiting, then click the ⓘ next to "Automatic updates" and turn everything on.
• iPhone/iPad: Settings → General → Software Update → install, then Automatic Updates → turn on both switches.
• Android: Settings → System → Software update (wording varies by phone). Apps: Play Store → profile picture → Settings → Network preferences → auto-update apps.
• Browser: Chrome, Edge, Safari, Firefox and Brave update themselves — but only when you close and reopen them. If you see "Update" in the top-right corner, click it.
• Everything else you've installed (Zoom, Adobe, Office, etc.): say yes when they ask to update. If a program hasn't asked in years, it may be abandoned — consider removing it.

⚠️ Update only from the update screen itself — never from a notification.
This is worth more than it looks, because "you need to update" is one of the most successful scam openings there is. A real update comes from one of exactly two places: the built-in update screen on your device (the Settings paths listed just above), or the official app store. That's it.

A real update never arrives as: a pop-up on a web page, a browser notification, an email with a download link, a message telling you your computer is infected, a box saying your Flash/Chrome/driver is out of date, or a phone call from "support". Every one of those is the attack, and the download it offers is the malware. If a message makes you think you might genuinely be behind on updates, close it, open Settings yourself, and check there.

If your device can no longer receive updates at all, see the last question in Quick answers below.

Why: Your email is the master key — whoever controls it can reset every other password you have. A passkey lets you sign in with your fingerprint or face instead of a password, and it's far harder to steal with a fake login page.

Which kind of 2FA? In rough order of strength:

• A passkey — sign in with your fingerprint, face, or device PIN instead of a password. The strongest option, and the one to choose when it's offered. But it isn't offered everywhere yet: your email provider and the big platforms support it, plenty of banks, shops and smaller services still don't. Don't wait for passkeys on a site that doesn't have them — use option 2 there today.
• An authenticator app (TOTP) — the six-digit code that refreshes every 30 seconds, from Google Authenticator, Microsoft Authenticator, Authy, or the one built into 1Password or Bitwarden (step 5). This works on essentially every site that offers 2FA at all, and it is the realistic default for most of your accounts. It's a big step up from text messages because the code is generated on your device and never travels through the phone network.
• Text message (SMS) — better than nothing, and worth turning on if it's the only choice a site gives you. But treat it as the weakest option and replace it wherever you can: see Appendix B for why.

🎥 New to passkeys? Watch these first:
• What is a passkey — and is it the future of online security? (BBC News, 3 min)
• Passkeys Explained (All Things Secured) — the same channel as the videos at the end of this guide.

Setting it up on your email:

• Gmail / Google: turn on 2-Step Verification first — Google: Turn on 2-Step Verification — and choose an authenticator app or Google prompt rather than SMS. Then add a passkey at g.co/passkeys → "Create a passkey" → follow the prompts (Face ID / Touch ID / Windows Hello / phone unlock).
  ▸ Official instructions: Google: Sign in with a passkey
  ▸ How-to video: Google Passkeys Tutorial — step by step
• Outlook / Hotmail / Microsoft: go to account.microsoft.com/security → "Advanced security options" → turn on two-step verification, and add a passkey (Windows Hello or your phone).
• Apple (iCloud email): two-factor is already required on Apple accounts. Check it's on: iPhone → Settings → your name → Sign-In & Security. Apple: Two-factor authentication

Then check your recovery methods, not just your login. This is the gap almost everyone leaves open: you carefully set up an authenticator app for signing in, and the account quietly keeps a text message to your phone number as the way to get back in if you're locked out. An attacker doesn't have to beat your strong method — they just use the weak one you forgot about. On the same security page, look for "recovery phone", "recovery email", "backup methods" or "account recovery", and make sure what's listed there is at least as strong as your login: printed backup codes (Part 2) and a recovery email you also control are the good answers; a phone number you keep only because you once had to is the one to remove. Do this on your email account first, then your bank and your main social accounts.

Tip: once your passkey or authenticator app is working, remove "text message (SMS)" as a sign-in method where the site lets you. Text-message codes can be intercepted or redirected — Appendix B explains the three common ways. Passkeys are far harder to steal: they are tied to the specific site, so a fake login page cannot use one, which is the single most common attack they defeat. "Far harder" is not "impossible", though — see Appendix C.

Why: If someone got into an account in the past, they may still be signed in on their own device — and changing your password doesn't always sign them out. This page shows every device and app connected to your account. Anything you don't recognize gets removed.

• Google (Gmail): run the guided Google Security Checkup — it walks you through devices, connected apps and recovery info in one place.
• Devices: myaccount.google.com/device-activity — for each device you don't recognize, click it → Sign out.
• Apps with access to your account: myaccount.google.com/connections — remove anything unfamiliar.
• One extra Gmail check: Gmail → ⚙ → See all settings → Forwarding and POP/IMAP → make sure no forwarding is set that you didn't create. This is the #1 thing intruders add so they keep receiving copies of your mail. While you're there, check Filters and Blocked Addresses too — a filter that quietly archives or deletes security alerts is the second thing they add.
• Microsoft (Outlook/Hotmail): account.microsoft.com/security → "View my sign-in activity" for anything unfamiliar, and account.microsoft.com/devices to remove unknown devices.
• Apple: iPhone → Settings → your name → scroll down to the device list. Tap any device you don't recognize → Remove from Account. ▸ Apple: Check your device list. Also check Settings → your name → Sign-In & Security → trusted phone numbers are all yours.
• Your other big accounts (Facebook, Instagram, Amazon, PayPal, your bank) have the same page, usually under Settings → Security → "Where you're logged in" or "Devices." Worth a look at the ones that matter to you — Part 2 has a dedicated social-media section.
• The blunt version of this step: if a site offers "sign out of all sessions" / "log out everywhere", use it, and then clear your browser cookies (the 30-second instructions are in step 1). Between them, those two actions end every authenticated session that exists — yours and anyone else's — instead of you having to recognise each one in a list.

If you found a device you didn't recognize: take a screenshot first, then remove it, then change that account's password (step 5 covers doing this properly). And let us know at digitalsafety@mandalaoflight.org — it helps us spot patterns.

Why: Most break-ins happen because one password was reused on many sites, or passwords were saved in the browser where malware can read them. A password manager gives every site its own strong password, and you only remember one.

Option A — 1Password (paid, ~$3/month individual, ~$5/month for a family of 5)

The most polished option: works on Windows, Mac, iPhone, Android and every browser, with excellent guided setup. 1password.com
🎥 Getting started: 1Password's official tutorials

Option B — Bitwarden (free, no meaningful limits)

Just as secure; slightly plainer to use. bitwarden.com/download
🎥 Videos: Bitwarden 101 walkthrough playlist · Bitwarden's short guided lessons

Whichever you choose: your master password should be 4 or 5 random words (example style: copper-piano-thunder-salad). Write it on paper and keep it somewhere safe at home. Never use it anywhere else. 1Password also gives you an "Emergency Kit" PDF at setup — print that too.

Both apps can also store your authenticator (TOTP) codes from step 3, which means the six-digit code appears right next to the password and gets filled in for you — the easiest way to get 2FA onto dozens of accounts without it becoming a chore.

Please avoid LastPass.

Why: Scammers can trick a phone company into moving your number to their phone, then receive your security codes. This is called a SIM swap, and it is the reason step 3 pushes you away from text-message codes — Appendix B has the full picture. A PIN and "port lock" on your account stops this. Takes 5 minutes in your carrier's app.

• Verizon: My Verizon app → Account → Security → set an Account PIN, turn on Number Lock and SIM Protection. Verizon: Number Lock
• AT&T: myAT&T app → Profile → Security → turn on Wireless Account Lock and set a passcode.
• T-Mobile: T-Life app or call 611 → turn on Port Out Protection and SIM Protection, and set an account PIN.
• Other carriers: search "[carrier name] port out protection" — every major carrier has it.
• Also set a SIM PIN on the phone itself — separate from the carrier lock, this stops a stolen SIM card being moved into another handset and used. iPhone: Settings → Cellular → SIM PIN. Android: Settings → Security & privacy → More security settings → SIM card lock. Change the default PIN when you turn it on, and store it in your password manager.

Why: A freeze stops anyone — including a scammer with your details — from opening loans or credit cards in your name. It's free by law. You can "thaw" it any time you apply for credit yourself.

• Equifax freeze · Experian freeze · TransUnion freeze — do all three.
• Plain-English explanation: FTC: What to know about credit freezes
• Write down the PIN/login each bureau gives you — keep it with your master-password paper.

Why: Nearly every attack starts with a message that looks normal. Knowing the pattern is the single best defense, and it's free.

• The most dangerous shape right now: a message from a familiar name, on a topic you actually care about, asking you to install a tool, plugin, app, or "AI skill" from a download link or GitHub. Never install anything from a link in a message. Get software only from official app stores or the maker's own website, typed into your browser yourself. (More in the AI section in Part 2.)
• Other classic shapes: "your account will be closed — click here," "I'm in a meeting, can you buy gift cards," "here's a shared document, sign in to view," a login page asking for a code you didn't request, a "support agent" asking you to install remote-access software, a pop-up saying "your computer is infected," a friend on social media asking for money or a code, a phone or video call that sounds exactly like someone you know asking for money or a code.
• FTC: How to recognize and avoid phishing

• Start with email, then bank, then anything with a credit card saved. Let your password manager generate a new random password for each. You don't have to do every site at once — the important ones first, the rest as you log in over time.
• Once a password is in the manager, turn off "save passwords" in your browser. (The 1Password and Bitwarden tutorials in step 5 both cover this.)

Hijacked social accounts are how scams spread to your friends — "it's me, I'm stuck abroad, can you send money" — and they're the accounts people most often leave unprotected.

• Turn on two-factor for each: Facebook & Instagram — accountscenter.facebook.com → Password and security → Two-factor authentication (use an authenticator app or passkey, not SMS). Do the same for X, TikTok, LinkedIn, WhatsApp (Settings → Account → Two-step verification), and Discord.
• Review where you're logged in on the same page ("Where you're logged in") and log out anything unfamiliar. Also "Apps and websites" → remove any third-party app you don't use. These connections are the ones people forget: a quiz app or photo filter you authorised in 2017 may still be able to read your account today, and it long ago stopped being maintained by anyone. If you're not sure what something is, remove it — a legitimate app will simply ask you to sign in again next time you use it.
• Tighten who can see your posts: set the default post audience to Friends, hide your friends list from the public, and limit who can find you by phone number or email. Scammers build convincing fake profiles from what's public.
• Know the social-media scam shapes: a friend request from someone you're already friends with (a cloned account — tell the real person); "is this you in this video?" links in DMs; "I need a code that was sent to your phone"; a "friend" suddenly recommending a crypto or investment opportunity. Never share a verification code with anyone, including a friend.
• If an account is taken over: Facebook — facebook.com/hacked; Instagram — instagram.com/hacked. Recovery works best in the first hours, so act immediately, and tell your friends through another channel that messages from that account may be fake.
• If you admin a community page or group: enable Facebook Protect (Settings → Security → Facebook Protect) — Meta's stricter security mode for page admins — and make sure at least two admins exist so a lockout isn't fatal.

AI assistants (ChatGPT, Claude, Gemini, Copilot) are useful and safe to use — the risks come from what gets added to them and what you put into them.

Installing AI "skills", plugins, extensions and agents

• Treat anything that extends an AI tool — a "skill", plugin, GPT, extension, MCP server, or automation — as software you're installing, because it is. It can run code and use whatever access you've given the AI.
• Install only from the tool's official marketplace (inside ChatGPT, Claude, or your browser's official store) — never from a link in an email, a chat message, or a GitHub page someone sent you, even someone you know. This exact route is how real people in our community have been attacked.
• Beware of fake AI apps: "ChatGPT for Chrome," "free Claude Pro," AI wallpaper apps and the like are a common disguise for malware. Use the official website or app-store listing, typed in yourself.
• When an AI tool asks to connect to your email, files, calendar, or browser, that's real access. Say yes only to the official tool, only for what you actually need, and review connected apps occasionally (step 4 shows where).

What not to type into an AI chat

• Never paste passwords, verification codes, recovery codes, credit-card or ID numbers, or other people's personal information (including member lists). A legitimate task never needs them.
• Assume anything you type may be stored. Use the official apps rather than third-party "AI chat" websites, which may keep or resell what you enter.

If you use an AI agent that reads your email or browses for you

• Text inside an email, document, or web page can contain instructions aimed at the AI ("forward this to…", "install this…"). A good agent asks you before acting; never approve an action you didn't ask for, no matter how reasonable the AI makes it sound.

AI-powered scams aimed at you

• Scam messages no longer have bad grammar — AI writes them perfectly, in the sender's style. Judge a message by what it asks for, not how it reads.
• Voice cloning: a call that sounds exactly like a family member or leader, in distress, asking for money or a code. A few seconds of someone's voice from a video is enough to fake it. Hang up and call them back on the number you already have. Consider agreeing on a family "safe word" for emergencies.
• Video calls can be faked too. If someone on a call asks for money, a transfer, or credentials, verify through a second channel before doing anything.
• The one rule at the top of this guide already covers all of these: a real request survives a callback.

Any modern browser is secure if it's up to date (step 2). Two small settings and one optional switch make it better:

• Turn on the built-in scam warnings: Chrome → Settings → Privacy and security → Security → Enhanced protection. Edge → Settings → Privacy → Microsoft Defender SmartScreen on. Safari → Settings → Security → Warn when visiting a fraudulent website. Firefox has this on by default.
• Check your extensions (Chrome: ⋮ → Extensions; Safari: Settings → Extensions; Edge: ⋯ → Extensions; Firefox: ≡ → Add-ons) and remove anything you don't recognize or no longer use. Extensions can read everything on the pages you visit.
• Optional — switch to a privacy-focused browser. Brave blocks ads and trackers out of the box, works with Chrome extensions, and runs on Windows, Mac, iPhone and Android. That means fewer scam ads and less tracking, though it's not more "secure" than an updated Chrome or Safari. If you try it: decline Brave Rewards and the crypto wallet during setup (you don't need them), and if a site misbehaves, click the lion icon to lower Shields for that site. Firefox is a good alternative. Brave gets a quick walkthrough at 1:57 in the "12 tools" video at the end of this guide.

If you ever lose your phone, backup codes get you back into your account. Print them and keep them with your master-password paper.

• Google: Get backup codes
• Microsoft: account.microsoft.com/security → Advanced security options → Recovery code.
• Apple: make sure your trusted phone number and recovery contact are current (Settings → your name → Sign-In & Security), or set a Recovery Key (see Part 3).
• Facebook/Instagram: Accounts Center → Password and security → Two-factor authentication → Additional methods → Recovery codes.

Everything above protects you from someone on the other side of the world. This protects you from something far more ordinary: a bag left on a chair, a phone off a café table, a laptop taken from a car. An unlocked device hands over your email, and your email is the master key to everything else — so a two-minute theft becomes a full account takeover. Yet plenty of people still have no passcode at all, or a passcode on the phone and nothing on the laptop.

There are three things to switch on, on every device you own.

1. A screen lock, with a decent code

Use fingerprint or face unlock for convenience, but the code behind it is what actually holds — so make it six digits or more, not four, and not a birthday or a repeated digit.

• iPhone: Settings → Face ID & Passcode → Turn Passcode On → Passcode Options → Custom Numeric Code.
• Android: Settings → Security & privacy → Device unlock → Screen lock → PIN or password.
• Windows: Settings → Accounts → Sign-in options → set up Windows Hello (face, fingerprint or PIN), and under "Additional settings" set If you've been away, when should Windows require you to sign in again? to When PC wakes up from sleep.
• Mac: System Settings → Lock Screen → set "Require password after screen saver begins" to Immediately and give the screen saver a short delay. Touch ID for daily use, but the account password still matters — make it a strong one.

2. Disk encryption — this is the one people miss

A screen lock alone doesn't stop someone pulling the drive out of a laptop and reading the files directly. Encryption does. It's built in and free on all four systems, and once it's on you'll never notice it again.

• Windows: Settings → Privacy & security → Device encryption (Home editions) or BitLocker (Pro). Save the recovery key somewhere you can find it — your password manager and your paper folder.
• Mac: System Settings → Privacy & Security → FileVault → Turn On. Keep the recovery key.
• iPhone and Android: already encrypted by default — but only once a passcode is set. Which is the other reason step 1 above matters.

3. Find-my-device, so you can lock or erase it remotely

Set this up before anything goes missing; it can't be turned on afterwards.

• iPhone/iPad/Mac: Settings → your name → Find My → turn on Find My iPhone, plus Find My network and Send Last Location. Locate, lock or erase from icloud.com/find. ▸ Apple: If your device is lost or stolen
• Android: Google's equivalent is Find Hub (previously Find My Device) and it's built into every Android phone. Check it's on: Settings → Google → All services → Find Hub, or open the Find Hub app. Locate, ring, lock or erase from google.com/android/find. ▸ Google: Find, lock, or erase a lost Android device. Two extras worth turning on while you're there (Settings → Security & privacy → Theft protection): Theft Detection Lock, which locks the screen automatically if the phone detects being snatched, and Remote Lock, which lets you lock the phone with just your phone number if you can't get to your Google account in a hurry.
• Windows: Settings → Privacy & security → Find my device → On. Then account.microsoft.com/devices.

And if a device does go missing: mark it as lost or erase it remotely straight away, then change your email password from another device and sign out all sessions (step 4) — in that order. If the phone was your 2FA method, this is what your printed backup codes are for.

• Stolen Device Protection — protects your Apple account even if someone steals your phone and knows your passcode. Settings → Face ID & Passcode → Stolen Device Protection → On.
  ▸ Apple: About Stolen Device Protection · Apple Support video: turn on Stolen Device Protection
• Lockdown Mode — only if you have specific reason to think you're targeted (an admin role, a public profile, an activist connection). It disables the features zero-click exploits arrive through, at the cost of some convenience. Settings → Privacy & Security → Lockdown Mode. Apple: About Lockdown Mode

• ☐ Google Advanced Protection — Google's strictest security mode, free: landing.google.com/advancedprotection. Requires two passkeys (e.g., phone + computer).
• ☐ Apple Recovery Key — iPhone → Settings → your name → Sign-In & Security → Recovery Key. Print it. Apple: Recovery Key
• ☐ Separate browser profile for anything experimental (AI tools, new plugins, unfamiliar sites) so it can't reach your saved logins. Chrome, Edge and Brave: click your profile picture → Add profile.
• ☐ Bank verbal password — call your bank and ask for extra verification on your profile.
• ☐ Run the step 4 device review on the shared admin accounts too, not just your personal ones. A compromised admin account affects every member.
• ☐ Remove SMS from every shared or admin account's recovery options, and make sure the recovery email is one at least two trusted people can reach. Shared accounts tend to be the ones still pointing at a phone number nobody remembers issuing.
• ☐ Full-disk encryption and a screen lock on any laptop that holds member data — see "Lock your devices" in Part 2. A stolen unencrypted laptop is a data breach affecting everyone on the list, not just you.

Just Part 1, step 3 — two-factor authentication on your email, with the videos. That alone puts you ahead of most people. Do the rest when you can.

Passkeys also work with a PIN (Windows Hello PIN) or with your phone — when you sign in on the computer, a QR code appears; scan it with your phone.

It's protected by your master password and can be locked with a passkey/2FA itself. That's far safer than the same password reused on 40 sites, which is what most people have today.

For detection, yes — Windows Security's scanning is on par with paid products. What a subscription adds is always-on blocking of bad links and downloads, identity monitoring, and not having to remember to scan. Nice to have, not required.

It's free, reversible in minutes online, and doesn't affect your existing cards or score. The only time you'll notice it is when you apply for new credit — and then you unfreeze for a day.

Everything here applies. Two-factor and passkeys: Settings → Google → Manage your Google Account → Security. Scanning: Google Play Protect is built in (Play Store → profile → Play Protect → Scan). Lost phone: Find Hub, covered in Part 2.

They defeat the attack that actually happens to people — the convincing fake login page — because a passkey is bound to the real site and simply won't work on a copy. The known attacks against them need malware already on your device or physical access to it. See Appendix C.

A fair worry, and you don't have to choose. Turn on "Install Security Responses and system files" and leave the full macOS upgrade off — step 2 has the exact setting. You keep the security fixes and keep your software working.

Those no longer receive security updates and can't be made safe. If upgrading isn't possible, please don't use that machine for email or banking — use your phone instead.

Work through this in order. It's written for the worst case; if you're not sure how bad it is, do it anyway — none of it does harm.

1. Disconnect the device from the internet. Turn off Wi-Fi and unplug the network cable. Leave the device on — don't wipe anything yet.

2. Use a different device for everything that follows. A phone, a partner's laptop, a library computer. Do not log in to anything from the suspect machine, including to "check" whether an account is okay.

3. Accept that removal may not be enough. This is the part people resist, and it's the most important thing in this appendix. Malware is written specifically to survive being found: it hides from scanners, reinstalls itself after deletion, and can plant itself in places a normal scan never looks. A scanner that says "removed, all clean" is telling you what it can see, not what's there.

So: if the infection was minor and obvious (an adware extension, a bundled toolbar), removal plus a second clean scan is a reasonable place to stop. But if any of the following is true, the only honest answer is a full reset — a clean reinstall of the operating system:

• You installed something from a link in a message, or let a "support agent" connect to your computer.
• The scan found something described as a trojan, spyware, stealer, rootkit or remote-access tool.
• Money moved, or an account you own was used to message other people.
• The problem came back after you removed it.
• You just can't shake the feeling something is wrong.

A reset is genuinely tedious and genuinely conclusive. Nothing else is conclusive.

4. Back up documents only — then reset. Copy your files (photos, documents, spreadsheets) to an external drive or cloud storage. Do not back up applications, installers or system settings, and don't restore from a system backup made after the infection started — that puts the malware straight back. When the machine is clean, scan those files before opening them.

• Windows: Settings → System → Recovery → Reset this PC → Remove everything → Cloud download.
• Mac: System Settings → General → Transfer or Reset → Erase All Content and Settings.
• iPhone: Settings → General → Transfer or Reset iPhone → Erase All Content and Settings.
• Android: Settings → System → Reset options → Erase all data (factory reset).

5. Change every password — from the clean device, in this order. Email first, always: whoever holds your email can reset everything else. Then your bank and anything with money in it. Then everything else, working down by how much damage it could do. Let your password manager generate each new one, and never reuse an old password.

Pay particular attention to any account that has shown up in a breach — check haveibeenpwned.com for your addresses — and to any account where you'd used the same password as somewhere else. Those are the ones an attacker will already have tried.

6. Turn on 2FA on every account as you change its password. This is the step that actually keeps them out. A new password on its own only helps until the next time your password is captured; two-factor means the password alone is never enough. Use an authenticator app rather than SMS where you can (step 3), and while you're on each security page, check the recovery options too — there's no point hardening the front door and leaving a spare key under the mat.

7. End every existing session. Password changes don't always log intruders out. On each important account, use "sign out of all devices" / "log out everywhere" (step 4), and clear cookies in your browsers — cookies are the logged-in sessions, so deleting them ends all of them at once. You'll sign back in afterwards; that's expected.

8. Hunt for the things that survive a password change. An intruder's first move is usually to leave themselves a way back in that a new password won't touch:

• Email forwarding rules and filters (Gmail → ⚙ → See all settings → Forwarding and POP/IMAP, and Filters and Blocked Addresses).
• Recovery phone numbers and recovery email addresses that aren't yours.
• Connected apps with account access (myaccount.google.com/connections and the equivalents).
• App passwords / device passwords issued to unknown devices.
• On a phone: unknown configuration profiles and VPNs (step 1's iPhone checks; Android: Settings → Security & privacy → More security settings → Device admin apps).

9. Protect the money. Call your bank's fraud line — the number on the back of your card, not one from a message. Review recent transactions, including small ones (fraudsters test with a $1 charge first). Freeze your credit if you haven't (step 7).

10. Tell people, and report it. Warn anyone who might receive a message "from you" — through a different channel than the compromised one. Email digitalsafety@mandalaoflight.org so we can warn the community about the pattern. Report at reportfraud.ftc.gov, identitytheft.gov, or ic3.gov if money was lost.

One thing not to do: don't quietly hope it was nothing. The cost of over-reacting is a wasted afternoon. The cost of under-reacting is someone reading your email for the next six months.

SMS two-factor is much better than no two-factor, and you should absolutely turn it on where it's the only option. But it's the one method that can be defeated without ever touching your password, which is why this guide keeps steering you towards an authenticator app or a passkey. There are three routes, and they're worth recognising.

1. SIM swap. Someone contacts your mobile carrier pretending to be you — armed with details scraped from social media or bought from a breach — and asks for your number to be moved to a SIM card they control. It works often enough that it's an industry. From that moment your codes ring on their phone, not yours. The tell: your phone abruptly loses service or shows "No SIM" for no reason. Treat that as an emergency, not an outage — call your carrier from another phone immediately. The defence: step 6 — a carrier port lock and account PIN, which forces them to clear a hurdle a phone call can't talk past.

2. Message mirroring. An app on your phone with permission to read notifications or SMS quietly forwards your messages elsewhere. This usually arrives as a "helpful" app you installed, or through the linked-device feature that lets messages appear on a tablet or computer — an attacker who briefly has your unlocked phone can pair their own device in seconds. The defence: review which apps have SMS and notification-access permissions (Android: Settings → Apps → Special app access → Notification access), check the list of linked devices in your messaging apps, and lock your phone properly ("Lock your devices", Part 2).

3. Network-level interception. The signalling protocols the global phone network runs on were designed decades ago, in an era when only a handful of trusted carriers could reach them, and they have essentially no authentication. Access to them is now purchasable. Text messages also travel unencrypted through the carrier's systems, meaning a determined attacker can in principle read or redirect them without going near you or your phone. This is the rarest of the three and the one you can do least about — which is exactly why the answer is not to rely on SMS for anything valuable.

And the gap almost everyone leaves: you can do everything right on the login — authenticator app, passkey, the lot — and the account will still quietly accept a text message to recover it. Attackers know this and go straight there. Whenever you set up 2FA, open the same security page and check what's listed under recovery, backup methods, or account recovery, and get SMS out of there if the site allows it. Printed backup codes (Part 2) are the replacement.

What to do, in one line: use an authenticator app or passkey wherever it's offered; keep SMS only where there's no alternative; lock your number at the carrier (step 6); and check your recovery options, not just your login.

Passkeys are the best consumer login technology we have, and this guide recommends them. They're also marketed as "unphishable" and "impossible to steal", and that's not quite true — worth knowing, so that a headline saying otherwise doesn't make you abandon something genuinely good.

What a passkey actually is: instead of a shared secret you type, your device holds a private key and gives the site a proof that it has it. The key never leaves your device, is never transmitted, and is bound to the real site's address.

What that reliably defeats:

• Phishing. This is the big one. A fake login page can't use your passkey, because the passkey simply won't offer itself to the wrong address. No amount of convincing design gets around it. Phishing is how most ordinary people actually lose accounts, so this alone is worth the switch.
• Password reuse and breaches. There's no password on the site's servers to leak.
• Code interception. No code travels anywhere, so nothing can be intercepted or SIM-swapped.

What it doesn't defeat:

• Malware already on your device. Researchers have demonstrated attacks — the "pass-ta-key" technique against synchronised passkeys is the most-covered example — where software running on a machine you already control manipulates the passkey process to register an attacker's own key or capture the sign-in. The prerequisite is malware on the device. Which is why "scan your computer" is step 1 of this guide and not step 8.
  ▸ Malwarebytes: Google's synchronized passkeys can be stolen in "pass-ta-key" attacks
  ▸ Forbes: Yes, your passkeys can be hacked — new attack breaks the myth
• Physical access to an unlocked device. Your passkey unlocks with your face, fingerprint or device PIN — so someone holding your unlocked phone effectively holds your passkey. Part 2's device-lock section is the answer.
• Account recovery. If the site lets you recover the account with a text message, the passkey isn't the weakest link any more — the recovery path is. See Appendix B.
• Being talked into something. No login technology stops you from voluntarily transferring money to a scammer. The rule at the top of this guide is what covers that.

The sensible conclusion: use passkeys where they're offered, keep an authenticator app for the many sites that don't offer them yet, keep your devices clean and locked, and check your recovery options. Passkeys move the attacker from "send a convincing email" — cheap, scalable, and how nearly everyone gets caught — to "get malware onto that specific person's device or steal it while unlocked". That's a very large improvement. It just isn't a force field.