Be safer
online.

1. Protect your accounts

   Passwords, passkeys and your ways back in.

   1. Check for leaked or reused passwords

      Your password manager can flag passwords that have appeared in known leaks or are used on more than one account.

      iPhone, iPad or Mac

      1. Open the Passwords app and choose Security.
      2. Open each warning, starting with email and banking. Use Change Password to create and save a different password, or upgrade to a passkey.

      Apple password checks

      Android or Chrome

      1. Open Google Password Manager and choose Checkup. You can also use the official password-check page below.
      2. Replace compromised and reused passwords on the real services, then save the replacements.

      Google Password Checkup

      Checked when: You have reviewed the warnings and fixed the passwords for the important accounts you still use.

      Check for leaked or reused passwords

   2. Create passkeys for important accounts

      A passkey lets you sign in with your device’s face check, fingerprint or screen lock. It helps stop fake sign-in pages stealing your login.

      Google / Gmail

      1. Open your Google Account, then Security & sign-in.
      2. Under How you sign in to Google, open Passkeys and security keys. Choose Create a passkey and follow the prompts on a device you own and lock.

      Google passkey help

      Microsoft / Outlook

      1. Open your Microsoft account’s Security settings and the options for adding a sign-in method.
      2. Choose the passkey option and follow the prompts. Save it to your own locked device or password manager.

      Microsoft passkey help

      Other accounts, on a phone or computer

      1. Open the account’s real app or website, then its Security or Sign-in settings. Look for Create a passkey.
      2. Follow the device’s face, fingerprint or screen-lock prompt. Keep the account’s recovery details up to date.

      NCSC passkey guidance

      Keep a unique password and extra sign-in protection on accounts that do not offer passkeys. Never create a passkey on a public or borrowed device.

      Checked when: You have added passkeys to important accounts that offer them.

      Create passkeys for important accounts

   3. Add an authenticator app or security key

      These provide a second sign-in check without relying only on your phone number. An authenticator app generates temporary codes; a security key is a small physical device.

      1. Open an important account’s Security settings and its two-step verification or two-factor authentication options.
      2. Add an authenticator app or security key using the service’s instructions. Complete its test sign-in and save the recovery options.
      3. Keep the existing method until the new one works. Never approve a sign-in you did not start or give its code to a caller.

      Passkeys and security keys resist fake sign-in pages. App codes can still be phished. Text codes remain useful when they are the only extra check offered.

      Checked when: Your important password-based accounts have an extra sign-in check and a recovery option.

      Google two-step verificationMicrosoft two-step verification
      Add an authenticator app or security key

   4. Keep a way back in without your phone

      Check your recovery details and keep recovery codes somewhere private that you can reach if your phone goes missing.

      Google / Gmail

      1. In your Google Account, check the recovery phone number and email address.
      2. Open Security & sign-in, then 2-Step Verification, then Backup codes. Save or print the codes and store them safely away from your phone.

      Google backup codes

      Apple Account

      1. Open Settings or System Settings, select your name and then Sign-In & Security. Check your trusted phone numbers.
      2. Follow Apple’s recovery-contact instructions to add a trusted person who can help you recover access. Agree this with them first.

      Apple recovery contacts

      Microsoft or another service

      1. In the account’s Security settings, check that the recovery email and phone number are current.
      2. Save any recovery code the service offers somewhere private, away from the phone you use for sign-in. Read how account recovery works before you need it.

      Microsoft account security

      Treat recovery codes like passwords. Do not send them to anyone who contacts you. Do not turn on an Apple recovery key casually: it changes how account recovery works.

      Checked when: Your recovery details are current and you have a recovery route that does not depend entirely on the missing phone.

      Keep a way back in without your phone

   5. Remove old devices and connected apps

      A device or app may retain access after you stop using it. Review both the signed-in devices and the apps connected to your account.

      Google / Gmail

      1. Open your Google Account, then Security & sign-in. Review Your devices and sign out devices you no longer use.
      2. Review Your connections to third-party apps and services. Remove access that is unnecessary or unfamiliar.

      Review Google devicesReview connected apps

      Apple Account

      1. In Settings or System Settings, select your name and review the devices listed under your account.
      2. Remove devices you no longer own. Review apps using Sign in with Apple and their access before removing anything you still need.

      Apple account device list

      Microsoft or another service

      1. Open the service’s account Security settings and review devices, recent sign-ins and connected apps.
      2. Sign out old sessions and revoke unneeded access. If activity is unfamiliar, use the provider’s account-recovery guidance too.

      Microsoft account security

      Make sure you have another way to sign in before disconnecting an app that uses your account for login.

      Checked when: You recognise the devices and apps that still have access.

      Remove old devices and connected apps

   6. Check for hidden email forwarding

      Someone with inbox access can add rules that copy your mail elsewhere or hide security messages.

      Gmail, in a web browser

      1. Open Gmail, choose Settings and then See all settings. Review the Forwarding settings for addresses you did not add.
      2. Review Filters and Blocked Addresses for rules you do not recognise. In account settings, check for delegated access too.

      Google’s email security checks

      Outlook, in a web browser

      1. Open Outlook’s Settings, then Mail. Review Forwarding (sometimes called Forwarding and IMAP) and Rules.
      2. Remove forwarding addresses and rules you did not create. If anything is unfamiliar, change your password and review account access.

      Outlook forwarding help

      Another email service

      1. Open the provider’s settings in a web browser. Search its help for forwarding, filters, rules and delegated access.
      2. Check that any forwarding addresses and rules are ones you deliberately set up.

      NCSC account recovery checks

      Checked when: You recognise the forwarding addresses, inbox rules and delegated access, or have confirmed none are set.

      Check for hidden email forwarding

   7. Protect your WhatsApp login

      WhatsApp has its own two-step verification, separate from your phone’s screen lock.

      1. On your main phone, open WhatsApp Settings, then Account, then Two-step verification. Enable it or review the protection already in place.
      2. Follow the app’s password or PIN prompts. Add a recovery email under Account and verify it.
      3. Never share a WhatsApp registration code, even if the request appears to come from a friend.

      WhatsApp is moving its two-step PIN to a password. Follow the wording shown in your version of the app.

      Checked when: WhatsApp’s extra sign-in protection and recovery email are set up, or you do not use WhatsApp.

      WhatsApp’s verification and recovery help
      Protect your WhatsApp login
   0/7

2. Protect your phone

   A few settings that help if it is lost or stolen.

   1. Use a longer screen-lock PIN

      Choose at least six digits, or a longer password. Avoid birthdays, repeated digits and your bank-card PIN.

      iPhone

      1. Open Settings, then Face ID & Passcode or Touch ID & Passcode.
      2. Choose Change Passcode, then Passcode Options if needed. Set a six-digit or longer code. Cover the screen when entering it in public.

      Apple passcode help

      Android

      1. Search your phone’s Settings for Screen lock.
      2. Choose a PIN with at least six digits, or a password. Keep fingerprint or face unlock enabled if you use it.

      Android screen-lock and theft guidance

      Checked when: Your screen lock uses at least six digits or a longer password.

      Use a longer screen-lock PIN

   2. Turn on extra theft protection

      These settings help protect sensitive accounts and settings if a thief gets your phone and knows its screen-lock code.

      iPhone

      1. Open Settings, then Face ID & Passcode or Touch ID & Passcode.
      2. Turn on Stolen Device Protection. Under Require Security Delay, choose Always for the additional checks even in familiar places.

      Apple Stolen Device Protection

      Android

      1. Open Settings, then Google, All services, then Theft protection.
      2. Turn on Identity Check if it is listed, and follow the biometric and trusted-place setup. Review the other theft-lock settings too.
      3. If Identity Check is absent, the phone does not support it. Keep its screen lock and available theft protections on.

      Android theft protection

      Checked when: You have enabled the extra theft protections your phone supports.

      Turn on extra theft protection

   3. Hide message contents on the lock screen

      Prevent a person holding your locked phone from simply reading incoming messages and sign-in codes.

      iPhone

      1. Open Settings, then Notifications, then Show Previews.
      2. Choose When Unlocked or Never. Check Messages, Mail and your banking apps for any individual overrides.

      Apple notification previews

      Android

      1. Open Settings and search for Lock screen notifications or Sensitive notifications.
      2. Choose to hide sensitive content, or hide notification contents while the phone is locked. Lock the phone and check the result.

      Android notification controls

      Checked when: Message contents stay hidden until you unlock the phone.

      Hide message contents on the lock screen

   4. Protect your mobile number from transfers

      A criminal may try to move your number to another SIM or provider. The PIN on your mobile-provider account is separate from your screen-lock PIN.

      1. Open your mobile provider’s official app or website and look for account security. Add a strong account PIN or password.
      2. Ask the provider which protections it offers against unauthorised SIM changes and number transfers. Enable the appropriate lock or extra verification.
      3. If calls and texts suddenly stop unexpectedly, contact the provider from another phone and check whether your number has been moved.

      Checked when: Your provider account has extra protection and you know how to contact the provider without your own phone.

      FTC advice on SIM-swap protection
      Protect your mobile number from transfers

   5. Practise finding a lost phone

      Check that you can reach your phone-finding service from another trusted device before you need it.

      iPhone

      1. In Settings, select your name, then Find My, and check that Find My iPhone is on.
      2. On another trusted device, open icloud.com/find and check that your phone appears. Do not erase it as a test. Sign out when finished.

      Apple Find DevicesApple Find My setup

      Android

      1. Open your device’s Find Hub settings and check that finding the device is enabled.
      2. From another trusted device, open android.com/find and check that your phone appears. Do not erase it as a test. Sign out when finished.

      Google Find HubPrepare an Android device for loss

      Checked when: You know how to find or lock your phone from another device, with a way to access the account if your phone is missing.

      Practise finding a lost phone
   0/5

3. Protect your money

   Checks before you pay, click or reply.

   1. Turn on notifications for every payment

      Alerts help you notice an unfamiliar payment quickly, including small test transactions.

      1. Open your banking app’s Notifications or Alerts settings.
      2. Enable notifications for card payments and transfers, including small amounts. Check your contact details are current.
      3. Investigate unfamiliar activity through the real banking app or the number on your card, not a link in a message.

      Checked when: Payment alerts are on and you know how to report a payment you do not recognise.

      Report Fraud: bank account protection
      Turn on notifications for every payment

   2. Save your bank’s genuine website

      A saved address gives you a trusted route when an alarming message tells you to sign in.

      1. Get the bank’s website address from a statement or another trusted bank document. Type it into your browser yourself.
      2. Use the browser’s Bookmark or Add to favourites option. On a phone, the official banking app is another trusted route.
      3. Use that route to check unexpected messages. Do not search for a support number in a hurry or follow the message’s login link.

      Checked when: Your bank’s genuine website is bookmarked, or its official app is ready to use.

      FCA banking scam guidance
      Save your bank’s genuine website

   3. Call to verify changed bank details

      A genuine email account or invoice thread can be compromised. An email reply is not an independent check.

      1. Before paying a builder, solicitor or supplier into a new or changed account, call them on a number you already trust.
      2. Ask them to confirm the payment details. Do not use a new number included in the email you are checking.
      3. Read any account-name warning from your bank. Stop and verify a mismatch before sending money.

      Checked when: You have adopted a rule to verify new or changed bank details by a separate trusted route.

      UK Finance: invoice and mandate scams
      Call to verify changed bank details

   4. Agree a family rule for money requests

      A familiar message or voice can be faked. Agree the check in advance, so an urgent request does not catch you off guard.

      1. Agree with close family that you will call their existing number before sending money in response to a message or call.
      2. If the request claims they have a new number, try the old one first. If you cannot reach them, verify through another trusted relative.
      3. Treat an instruction to keep the request secret or act immediately as a reason to stop and check.

      Checked when: Your family knows the verification rule and you have their trusted numbers saved.

      FTC: fake family emergencies and cloned voices
      Agree a family rule for money requests

   5. Read what a sign-in or payment approves

      A real code or approval prompt can still be used to trick you into authorising a criminal’s action.

      1. Read the amount, recipient and purpose before approving a payment, new payee or sign-in.
      2. Decline an action you did not start. Never approve a payment to “cancel fraud” or move money to a “safe account”.
      3. End the call and contact the bank through its official app or the number on your card. Never tell a caller the approval code.

      Checked when: You know to check the action itself and refuse approvals you did not start.

      FCA banking scam guidance
      Read what a sign-in or payment approves

   6. Treat QR codes like unfamiliar links

      A sticker on a parking meter or a code in a message can lead to a fake payment or sign-in page.

      1. For parking, use the operator’s official app or a web address you know is genuine.
      2. Before opening a scanned link, read its destination. Do not rely on the logo or the fact that it came from a QR code.
      3. Do not scan an unexpected QR code in an email, text or parcel to resolve an urgent account or payment problem. Open the real service yourself.

      Checked when: You know to verify the destination or use the operator’s genuine app before paying.

      FTC advice on QR-code scams
      Treat QR codes like unfamiliar links
   0/6

4. Check your devices

   Updates, browser permissions and home Wi-Fi.

   1. Check that updates actually installed

      Automatic downloads do not always mean an update has finished. Apply any pending install or restart.

      iPhone / iPad

      1. Open Settings, then General, then Software Update.
      2. Install pending updates and review Automatic Updates. Check app updates in the App Store too.

      Apple update help

      Android

      1. Search Settings for Software update or System update. Install pending security updates.
      2. In Google Play, check app updates and its automatic-update settings.

      Android update help

      Windows

      1. Open Settings, then Windows Update. Install updates and complete any required restart.
      2. Open your browser’s About page to check its updates, and review updates in Microsoft Store.

      Microsoft Windows Update help

      Mac

      1. Open System Settings, then General, then Software Update. Install pending updates and review automatic updates.
      2. Check app updates in the App Store and update other apps through their own menus.

      Apple Mac update help

      If a device no longer receives security updates, plan to replace it with a supported model.

      Checked when: Your devices, browsers and important apps are updated, with automatic updates enabled.

      Check that updates actually installed

   2. Remove browser extensions you do not need

      Extensions are browser add-ons. Review them instead of leaving old ones with continuing access to websites.

      Chrome, on a computer

      1. Open Chrome’s menu, then Extensions, then Manage Extensions.
      2. Remove add-ons you do not recognise or use. Review any Safety Check warnings.

      Manage Chrome extensions

      Safari, on iPhone, iPad or Mac

      1. On iPhone or iPad, open Settings, then Apps, then Safari, then Extensions. On a Mac, open Safari, Settings, then Extensions.
      2. Review the list. Turn off unneeded extensions; uninstall the associated app or use Uninstall on Mac to remove them.

      Safari extensions on Mac

      Edge or another browser

      1. Open the browser’s menu and find Extensions or Add-ons.
      2. Review the list and remove anything you do not recognise or need. Do not remove a password manager you still rely on without another way to reach your passwords.

      Microsoft Edge extensions

      Checked when: You recognise the remaining browser add-ons and need the access they have.

      Remove browser extensions you do not need

   3. Stop unwanted website notifications

      A website can send alarming notifications after you grant permission. A “virus” message from a site is not proof that your device is infected.

      Chrome, on a computer

      1. Open Settings, then Privacy and security, then Site settings, then Notifications.
      2. Remove or block permission for sites you do not recognise. Review Chrome’s Safety Check too.

      Chrome notification controls

      Chrome on Android

      1. Open Chrome’s Settings, then Site settings, then Notifications.
      2. Turn off permissions for unwanted sites. Do not install an app or call a number supplied by a frightening website alert.

      Chrome notification controls

      Safari or iPhone web apps

      1. On a Mac, open Safari, Settings, Websites, then Notifications and deny unwanted sites.
      2. On an iPhone or iPad, review Settings, Notifications for web apps you added to the Home Screen and turn off unwanted alerts.

      Safari website notifications

      Checked when: Only websites or web apps you trust still have permission to notify you.

      Stop unwanted website notifications

   4. Check your router’s administrator password

      This controls your home router’s settings. It is different from the password people use to join your Wi-Fi.

      1. Use your internet provider’s official app or the router manufacturer’s instructions to open its settings.
      2. Change a default or shared administrator password to a strong unique one. Store it in your password manager.
      3. Enable automatic router updates, or ask your provider how it supplies security updates. If settings are managed by the provider, ask it to confirm the protections.

      Use the label and official manual for your own router. Do not change settings on a shared or workplace network you do not manage.

      Checked when: You have checked the administrator password and how your router receives security updates.

      FTC home Wi-Fi guidance
      Check your router’s administrator password
   0/4

5. Make sure you can recover

   Backups you know you can restore.

   1. Check that recent files reached your backup

      Find a photo or document you created recently. A file visible on your phone is not proof that a backup exists.

      iPhone / iPad

      1. Open Settings, your name, iCloud, then iCloud Backup. Check the last successful backup date.
      2. Check your photo and file services too. Confirm recent items appear in the backed-up library and that storage is not full.

      Apple iCloud backups

      Android

      1. Search Settings for Backup and review the latest backup and what it includes.
      2. In Google Photos, check the backup status for recent photos. Resolve any paused or storage-full warning.

      Android backups

      Windows or Mac

      1. Open your backup service or app and check the most recent successful backup.
      2. Browse the backup for a recent important file. Check that the folders you care about are included and there is enough space.

      NCSC backup guidance

      Checked when: A recent successful backup includes the important files and photos you expect.

      Check that recent files reached your backup

   2. Restore a photo or document as a test

      A small recovery test shows that you can get a file back, not just that a backup setting is switched on.

      1. Choose a non-sensitive test file or a copy of a photo. Keep the original safe.
      2. Use your backup service’s Restore, Download or Recover option to retrieve a separate copy. Do not erase or reset your phone to test a whole-device backup.
      3. Open the restored copy and check it works. If your backup is a whole-device image, follow the provider’s safe recovery-check instructions.

      Checked when: You have retrieved and opened a file from your backup, or safely checked the provider’s recovery process.

      NCSC backup testing guidance
      Restore a photo or document as a test

   3. Keep a separate copy of irreplaceable files

      Keep another copy of family photos and essential documents, and learn how your cloud service handles accidental changes.

      1. Copy irreplaceable files to a separate backup location, such as an external drive. Protect that copy with a password or encryption.
      2. Safely eject and unplug a backup drive when finished, so malware on your computer cannot automatically reach it.
      3. Check the deleted-file recovery and version-history options in your cloud service. File syncing can copy deletions too.

      Checked when: You have an independent copy and know how to recover a deleted or earlier version of a file.

      NCSC: keeping and restoring backups
      Keep a separate copy of irreplaceable files
   0/3

You’ve worked through all 25 checks. Keep these habits going.

This browser can’t save your ticks. You can still use the checklist.