Guides
Part of Account security: the six ways into an account
Account security: what to check and what to do when settings go stale
A yearly account security review: the drift list, how to handle an announced sign-in change safely, what triggers a full pass, and which settings go stale first.
What to take away
- Your account setup goes stale on its own. Nobody has to attack it for it to stop matching your life.
- An announced security change is the best phishing cover there is. Act inside the app, never inside the message.
- Circumstances trigger a full review, not datesa move, a job change, a breakup, a new phone, a breach notice.
- Recovery contacts, connected apps and shared access age fastest. Passwords age well.
- One plain note per account turns the next review into a comparison instead of a search.
The drift list
None of these items sends you an alert. Each one changed quietly while you were not looking.
- Recovery email and phone number still reach you
- Second factor works on the phone you carry now
- Backup codes exist, are current, and you can find them
- Connected apps and third-party sign-ins you would still approve
- Shared accesswho else can get in, and should they
- Cards and addresses on file still current
- Public profile detailsname, photo, location, employer
- Old sign-in methods you stopped using but never removed
Account security drift list
- Phone number you gave up
- Email address you stopped controlling
- Device you sold, lost, or handed on
- App you stopped using
- Person who left
- Company acquired or closed
- Second factor method retired
- New method arriving
Run it once a year. The habits that stay current no matter what a provider changes are set out in CISA's cybersecurity best practices. The questions behind each line, and the order to answer them, sit in account security, which is worth reading before your first pass rather than during it.
Handling a change your provider announces
Providers retire sign-in methods and add passkeys. You hear about it by email, in-app banner or push notification.
That overlap is the fake's advantage, because the real notice has already taught you to expect one. The fake arrives while your guard is down and asks for the one thing a genuine change never needs: your password, typed into a page you reached from a link.
Three steps cover it.
Handling a provider change
- Never act from the message. Open the app you already have, or type the address yourself. A genuine change waits for you there. A fake one does not exist.
- Register the new method early, while the old one still works. Sign in with it once to confirm. Deadline-day rushes are where lockouts come from.
- Print fresh backup codes, then remove the old method last. Deleting a working way in before the replacement is tested is how people lose an account for days.
Step one is the callback rule in phishing scams: reach the provider through a channel you chose, not one a message supplied. CISA's guidance on recognizing and reporting phishing covers the shape of a fake announcement.
The events that should trigger a full pass
Time is a poor trigger. Circumstances change who holds access and what is publicly known about you, and those two things feed everything else.
- Moving house or changing your phone number
- Starting or leaving a job
- A relationship ending, especially if the other person knew your passwords
- A new phone, laptop or tablet
- A breach notice naming a service you use
- Taking over the accounts of someone who has died
A breach notice arrives unannounced, and it usually means credentials are in circulation, not just contact details. The FTC's identity theft resources set out what follows: credit freezes, fraud alerts, and reporting.
The parts of your setup that age worst
Some elements go stale faster than others and deserve attention first.
Parts that age worst
| Element | How fast it goes stale | What actually happens |
|---|---|---|
| Recovery contacts | Fastest | Point at addresses and numbers from an earlier life |
| Connected apps | Fast | Permissions pile up and nothing prompts removal |
| Shared access | Fast, worst at work | People leave more often than anyone audits |
| Backup codes | Quietly | Older sets get superseded, or go missing |
| Passwords | Slow | Strength holds; reuse and breaches do the damage |
What ages worst in your setup
Ages fastest
- Recovery contacts
- Point to old life
- Connected apps
- Permissions pile up
- Shared access
- People leave
- Backup codes
- Quietly superseded
- Passwords
- Age well
Ages next
- Recovery contacts
- Set once
- Connected apps
- No removal prompt
- Shared access
- Rarely audited
- Backup codes
- May be lost
- Passwords
- Strong unique stays strong
Ages well
- Recovery contacts
- Needs update
- Connected apps
- Audit needed
- Shared access
- Organizations suffer
- Backup codes
- Not a backup
- Passwords
- Reuse and breach matter
Password rotation on a schedule tends to produce weaker passwords, because people change one character and keep the shape. Change a password when a service reports a breach, when you find it reused, or when you suspect exposure.
Work the table from the top. Shared access and connected apps take minutes to fix and are the items most people skip entirely.
Example: one note per account
One plain note per important account is enough. Keep it in your password manager.
Card issuer, updated 2027-03-14 Recovery: work email, phone ending 4417 Second factor: authenticator app, plus one hardware key Backup codes: printed, in the fire safe Connected: budgeting app, airline app Shared: nobody Changed since last pass: second factor moved off SMS
Next time you are comparing rather than investigating. Anything different is either a change you made or a question worth asking.
Do the settings work on the same visit, because a redesign moves the controls as well as the menus; the reasoning is in privacy setting changes.
Common questions
Should I change my passwords every few months?
No. Change on a breach report, on discovering reuse, or on suspicion. A strong unique password does not weaken with age.
My provider is retiring the sign-in method I use. What is the safe order?
Add the new method, sign in with it once to confirm, print fresh backup codes, then remove the old method. Never the other way round.
A message says my account will be closed unless I update my security. Is it real?
Treat it as false until you have checked in the app. A genuine deadline will still be there when you look, and a message is not how you should learn about it.
What should I do first after a breach notice?
Change that password, then change it anywhere you reused it. Check recovery contacts and connected apps, since those are edited first. For a social account, the order in the social media account security audit saves time.
