Account security that holds

The National Cyber Security Centre received 1,129 incident reports between April and June 2026, with $2.7 million in reported direct losses. A large share of account takeovers start with a password reused from a breached site, or a code handed over to someone pretending to be a bank or a delivery company. Both are preventable.

Work through this in order. Each step makes the next one safer.

1. Your email account comes first

Your email is the master key. Anyone who controls it can press “forgot password” on almost everything else.

• Give it a long, unique password that you use nowhere else. Three or four random words is fine.
• Turn on two-step verification. Use an authenticator app or a passkey rather than text messages if you can.
• Open the security settings and look at the recovery phone number and recovery email. Remove anything you don’t control today, such as an old number or an ex-partner’s address.
• Look at signed-in devices and sign out anything you don’t recognise.
• Look for forwarding rules and filters you didn’t create. Attackers set these up to keep copies of your mail or hide bank alerts.

2. Use a password manager

A password manager remembers a different strong password for every site, so a breach at one site doesn’t open the others. The built-in managers in Apple, Google and Microsoft accounts are fine for most people, as are well-known standalone managers. Choose one, then change passwords for your most important accounts first, starting with email, banking, your Apple or Google account, social media, and anything storing your ID.

Protect the password manager itself with a strong password and two-step verification.

3. Turn on passkeys or two-step verification everywhere it matters

Passkeys replace passwords with a key stored on your device, unlocked with your face, fingerprint or PIN. They can’t be phished, because they only work on the real website. Use them where they’re offered.

Where passkeys aren’t available, use two-step verification. In order of strength:

1. A passkey or physical security key
2. An authenticator app
3. A text message code

Text codes are much better than nothing, but they can be intercepted if someone takes over your phone number.

4. Lock your phone number

Criminals sometimes persuade a phone company to move your number to a new SIM card, then receive your text codes. Ask your mobile provider whether you can add a PIN or password that must be given before any change to your account or SIM. Use a PIN nobody could guess from public information about you.

5. Secure the phone itself

• Use a PIN of six digits or more. Patterns and four-digit PINs are easy to guess or to watch over your shoulder.
• Keep the operating system and apps updated. Turn on automatic updates.
• Turn on Find My (iPhone) or Find My Device (Android) so you can lock or wipe it if it’s lost.
• Set notifications so message previews don’t show on the lock screen, if other people are often near your phone.

6. Decide your rule for unexpected messages

No bank, government department or delivery company in New Zealand needs you to click a link in a text to log in or pay a fee. Make a rule now, while you’re calm, that you will never act on an unexpected message asking for money, a code, a password or remote access to your device. You’ll close it and contact the organisation through its app, its website typed by hand, or the number on your card.

Forward scam texts to 7726. It’s free.

7. Check what’s already leaked

Enter your email addresses on the NCSC’s How Exposed Am I. If an address appears in breaches, change the password for that site and anywhere you used the same password.

8. Write down your recovery codes

When you turn on two-step verification, most services give you one-time recovery codes. Print them or write them down, and keep them somewhere safe at home. They get you back in if you lose your phone.

If you share accounts or devices

Families often share streaming, cloud storage, phone plans and location. That’s fine when everyone trusts each other. Review who can see what at least once a year, and straight away after a relationship ends. If you think someone is using that access to monitor or control you, read the technology-facilitated abuse guide before changing anything.

If something has already gone wrong

Go to someone has got into my account on the Get help now page.