Digital hygiene at home: the household baseline

Criminals rarely need to break encryption when they can reuse a leaked password or borrow a familiar voice. In 2025 the FBI's Internet Crime Complaint Center received 22,364 complaints that mentioned AI, with reported losses near $893 million, and the FBI notes that many victims don't realize AI was involved.¹ The good news is that most of the defenses are free and already on your devices, and this guide puts them in the order that protects the most for the least effort.

1. 1

   Step 1: Put one password manager in charge

   Choose one password manager for the household and install it on every phone and computer. If everyone uses iPhones and Macs, Apple Passwords is free and built in; on Android and Chrome, Google Password Manager is.²³ Mixed households do better with a cross-platform manager such as Bitwarden, which is free for one person and $47.88 a year for a family of up to six.⁴

   Start with your email account, then your bank, then change the rest as you log in over the next few weeks. Let the manager create every new password, and never reuse one. CISA, the US Cybersecurity and Infrastructure Security Agency, pairs a password manager with MFA in its core advice for everyone.⁵

   How you know it worked

   Your password manager's security or health check shows no reused or leaked passwords on your email and bank accounts.

2. 2

   Step 2: Lock your key accounts with passkeys or MFA

   Your email, bank, mobile carrier and Apple or Google account can reset everything else, so protect them first. Turn on a passkey where it's offered; it signs you in with your phone's screen lock and is phishing-resistant, meaning it won't work on a fake site.⁶ Where passkeys aren't offered, use an authenticator app, and fall back to text-message codes only when nothing else is available.

   For the one email account that controls everything, consider two hardware security keys: one on your keyring, one in a drawer. Yubico, which makes them, recommends always registering a backup key.⁷

   How you know it worked

   Sign out of your email on a computer and sign back in. It asks for your passkey, security key or authenticator code, not just a password.

3. 3

   Step 3: Turn on automatic updates everywhere

   Updates close security holes that criminals already know about, so let phones, computers, browsers and apps update themselves. Updating software is one of CISA's four core steps for everyone.⁵

   Don't skip the router, the smart TV or anything else with a login. Check each maker's app or settings for automatic updates, and replace devices that no longer get them.⁸

   How you know it worked

   Each phone's and computer's software update screen says it's up to date, with automatic updates switched on.

4. 4

   Step 4: Back up phones and computers, then test a restore

   On iPhone, go to Settings, tap your name, then iCloud, then iCloud Backup, and turn on Back Up This iPhone.⁹ On Android, go to Settings, then Google services, then All services, then Backup.¹⁰

   For computers, use a cloud backup service such as Backblaze, which costs $99 a year per computer, or an external drive you unplug between backups.¹¹ Keep irreplaceable photos and documents in at least two places.

   How you know it worked

   On iPhone, the iCloud Backup screen shows a recent successful backup. On a computer, restore one file from last week's backup and open it.

5. 5

   Step 5: Agree on a family safe word and a callback rule

   Criminals use AI to make audio in a loved one's voice and stage an emergency, so a call that sounds exactly like your grandchild is no longer proof.¹² The FBI recommends agreeing on a secret word or phrase with family, and hanging up to call back on a number you find yourself.¹²

   In 2025, victims told the FBI they lost more than $5 million to 'distress' scams that used voice cloning to imitate a loved one.¹ Pick a word you'd never post online, say it in person, and practice the callback once so it feels normal.

   How you know it worked

   Everyone in the family, grandparents included, can tell you the safe word and the number they'd call back on.

6. 6

   Step 6: Check your AI assistants' settings

   Open the settings of every chatbot your family uses and look for the setting that lets your chats train the AI. On ChatGPT's personal plans, for example, your content is used for training unless you opt out.¹³

   While you're there, review what the assistant remembers about you and which apps or accounts it's connected to, and switch off anything you don't use. Our guide to locking down AI assistants walks through each major one.

   How you know it worked

   In each assistant's privacy or data controls, the training setting is off, and you've looked at what it remembers about you.

7. 7

   Step 7: Know what never goes into a chatbot

   Treat a chatbot like a stranger's notebook. Keep out passwords, one-time codes, full card or bank account numbers, Social Security numbers, medical records and other people's private details.

   If you need help with a document such as a tax form or a medical letter, remove the names and numbers first. Be cautious about AI agents, tools that read your email or browse websites for you, because hidden instructions on a web page can try to steer them.

   How you know it worked

   Search your chatbot history for words like password, account and SSN, and delete any conversation that contains them.

8. 8

   Step 8: Set up kids' devices with controls and a conversation

   Use the controls built into your children's devices: Screen Time through Family Sharing on iPhone and iPad, or Google Family Link on Android and Chrome devices.¹⁴¹⁵ Turn on approval for new apps and purchases, and limit who can contact them.

   Then talk. Tell them that any message asking for secrecy, money, gift cards or photos is a reason to come to you, and that they won't be in trouble for asking.

   How you know it worked

   Try to download a new app on your child's device. It asks you for approval first.

9. 9

   Step 9: Protect older relatives without taking over

   People 60 and older filed 201,266 complaints and reported $7.7 billion in losses to the FBI's complaint center in 2025, more than any other age group.¹ With their permission, turn on Screen Unknown Callers on an iPhone or Call Screen on a Pixel, and check that their carrier's free scam-call blocking is on.^1617181920

   Freeze their credit at all three bureaus, which is free and lasts until they lift it.²¹ Share the family safe word with them, and agree that any request for money gets a call to you first.

   How you know it worked

   Call their phone from a number they haven't saved. The call is screened or labeled before it rings, and they can tell you the safe word.

10. 10

    Step 10: Tidy up your router and smart home

    Log in to your router, change the default admin password, use WPA3 encryption (or WPA2 if that's all it offers), and turn off remote management and the convenience features called WPS and UPnP. Put visitors on a guest network with its own password.⁸

    For an easy extra layer, set the router's DNS, the internet's address book, to a filtering service such as Quad9 at 9.9.9.9, which blocks known malware and phishing sites for every device.²² Give smart speakers, cameras and TVs strong passwords and MFA in their apps, and remove devices you no longer use.

    How you know it worked

    The router no longer accepts its default admin password, its firmware page shows the latest version, and its DNS settings show the filtering service you chose.

• No checklist stops every scam. The callback rule only works if you use it when you're rattled, which is exactly when a scammer calls.
• We don't know yet how much call screening reduces AI voice scams; we found no independent measurement of it.
• Parental controls and DNS filters can be worked around by a determined teenager. They support the conversation; they don't replace it.
• Settings move. The menu paths here were checked in October 2026, and phone makers rename things often.

• ThreatHomeBusiness

  Voice cloning and deepfake scams

  Criminals can copy a voice from a short clip and fake faces on a video call, then use them to ask for money in a hurry. In 2025 the FBI logged 22,364 complaints that mentioned AI, with losses near $893 million, most of it in investment scams; voice-cloned 'distress' calls alone cost victims more than $5 million. The defense is low-tech: pause, hang up, and confirm through a number or channel you already trust.

  Read
• ThreatHome

  AI-scaled romance and investment scams

  Organized scam operations now use AI to translate, script and run many online 'relationships' at once, usually steering people toward fake crypto investments. Investment fraud was the costliest crime reported to the FBI in 2025 at $8.6 billion, and people 60 and older reported $3.5 billion of it. Being targeted says nothing about your intelligence; these are professional operations. The rule that holds: never send money or crypto to someone you have only met online, and talk it over with someone you trust first.

  Read
• ThreatHomeBusiness

  AI chatbot data leaks and shadow AI

  Whatever you paste into an AI assistant can be stored, read by reviewers or used to train future models, depending on the app, the plan and your settings. In a 2025 survey of workers in 47 countries, 48% of those who use AI at work said they had uploaded sensitive company or customer information into public AI tools. The fix is mostly unglamorous: business accounts for work, the right settings at home, and a clear rule about what never goes in.

  Read
• ThreatHomeBusiness

  AI-powered phishing and business email compromise

  Criminals now use AI to write fluent, personalized phishing emails and payment requests, in any language and at volume. Business email compromise (BEC), where a scammer poses as a boss, vendor or title company to redirect a payment, drew $3.05 billion in reported losses to the FBI in 2025. Typos are no longer the tell; a request to move money or change bank details is. Confirm every one on a second channel you already trust.

  Read
• ThreatHomeBusiness

  Prompt injection and AI agent hijacking

  When an AI assistant reads your email, files or web pages, it can mistake text written by a stranger for instructions from you. That is prompt injection, and when the assistant can also send, buy or delete things, an attacker can steer it. The UK's National Cyber Security Centre (NCSC) says it may never be fully fixed, so the safe move is to limit what your AI can reach and keep yourself in the approval loop.

  Read
• GuideHome

  The family safe word and callback rule

  Pick a private word your family uses only to prove who's really calling, and agree that any urgent request for money gets a hang-up and a callback to a number you already have. The FBI recommends the secret word, and the FTC and FCC recommend the callback. Setting it up takes one family conversation.

  Read
• GuideHome

  Help an older relative stay ahead of AI phone scams

  Older adults report losing money to fraud less often than younger adults, but when a scam works it tends to cost them more, especially when it starts with a phone call. People 60 and older reported $7.7 billion in losses to the FBI in 2025, including $352 million in complaints that mentioned AI. This guide helps you set up call screening, bank alerts, and a trusted contact together, as partners, and plan what to do if something gets through.

  Read
• GuideHomeBusiness

  Lock down your AI assistants

  Each major AI assistant has a training setting, a memory setting, connected apps and a way to delete history, and the defaults favor the vendor. This guide walks through ChatGPT, Claude, Gemini, Microsoft Copilot and Meta AI one at a time, with notes for business accounts. Plan on about five minutes per assistant.

  Read
• GuideBusiness

  Digital hygiene for your business: the 1-50 person baseline

  A small business's security baseline fits on one page: passkeys or multi-factor authentication (MFA) on every account, email and banking first; a shared password manager; automatic updates and endpoint protection; and backups you've actually restored from. Add a second-channel check before any payment change, a one-page AI rule, same-day offboarding and a short incident plan. Business email compromise alone drew $3.05 billion in reported losses to the FBI in 2025.

  Read
• ExplainerHomeBusiness

  Who owns your AI conversations?

  In practice, the company that runs the assistant holds your conversations, and its terms decide who can read them, whether they train future models and how long they're kept. Some consumer plans, including ChatGPT's, use your chats for training unless you switch it off, while the major business plans say they don't by default. You can usually export or delete your chats, but deleting doesn't undo training that already happened, and legal holds can override deletion.

  Read
• ExplainerHomeBusiness

  Digital sovereignty, in plain English

  For governments, digital sovereignty means control over their own technology, data and online rules. For you, it means staying in charge of your own data, identity and choices: knowing who can read or train on your information, being able to leave a service with your data, holding the keys to your own accounts, and deciding what stays on your own devices.

  Read