Clear Path step · Home · Solid ground for everyone
Lock the email account that resets everything
Your main email needs your passkey or code to open, so a stolen password alone can't reset the rest of your accounts.
Why it matters: Almost every other account resets through email, so whoever controls your inbox controls your bank, your photos and your social accounts. It is the one account worth ten minutes today.
Do it
- Open your email account's security page and add a passkey. If passkeys aren't offered, use an authenticator app instead of text-message codes.
- Check the recovery phone number and recovery email. Remove any you no longer own, such as an old work address or a previous number.
- Look at the list of signed-in devices and sign out of anything you don't recognize.
- Check settings for forwarding rules and filters you didn't create. Attackers add these to read your mail quietly; delete any you don't recognize.
- Save the backup or recovery codes in your password manager and on paper somewhere safe at home.
Say this: If a message tells me to secure my email, I close it and open my email the usual way.
Check it worked: Your main email account asks for a passkey, security key or authenticator code to sign in, its recovery phone and email are ones you control, and nothing is forwarding your mail somewhere else.
Simply put
Your email is like the master key at a hotel: whoever holds it can open every other room. A passkey only works at the real front desk, so a fake sign-in page can't trick it out of you.
In detail
Modern phishing kits sit between you and the real sign-in page and pass your code through in real time, so text and app codes can be relayed; a passkey is bound to the real site and can't be. The forwarding-rule check matters because a takeover often leaves a rule behind even after you change the password.
As a story
It's 6:52 a.m. A text says someone tried to sign in to your Google account and links to a page to 'secure it.' The page looks exactly right, and you're only half awake.
It asks for your password, but you sign in with a passkey now, and your phone only offers it on Google's real site. On this page it doesn't appear. That's your cue.
You close the tab, delete the text and open your email the usual way. The security page shows no new sign-ins, your recovery details are still yours, and there's no forwarding rule you didn't make. You make coffee.
If this is new to you: Will I get locked out? That's what the backup codes are for. Save them in your password manager and on paper, and you have a way back in.
Points toward the Long View: signing in to everything that matters without typing a password.