Most accounts are not broken into by clever attacks. They are opened with a reused password, a fake sign-in page or a device that was never updated. A few habits close most of those doors.

Install system updates when they arrive. Phone and laptop updates fix security holes that are already being used, and turning on automatic updates means you do not have to remember.

Use a password manager and a different password for every account. Turn on two-step verification for email, banking and shopping accounts, preferably with an authenticator app or a passkey rather than text messages.

Be suspicious of links that ask you to sign in. Open the app or type the address yourself instead, and never read a one-time code back to someone who asks for it.

Lock every device with a PIN, password or fingerprint, turn on the built-in find-my-device feature, and back up photos and documents so a lost phone is an inconvenience rather than a disaster.