Protecting Accounts and Data

Security advice often sounds like a list of chores: use a long password, turn on this setting, avoid that link. What students need is a routine they can actually keep. The routine in this guide takes about an afternoon to set up and a few minutes a month to maintain, and it covers the habits that stop most real-world problems: stolen passwords, hijacked email, lost phones and leaked data. You do not need to be technical, and you do not need special tools beyond what many universities and devices already provide.

Services change their settings often, so use this guide as a checklist and follow each provider's current instructions. No products or prices are named.

Step one: know what you have

You cannot protect what you cannot list. Spend twenty minutes writing down your accounts.

• Email accounts: personal, university, old addresses.
• University systems: portal, learning platform, library, student finance.
• Money: bank, payment apps, student loans, budgeting apps.
• Cloud storage and backups.
• Social media and messaging.
• Shopping, food, transport and travel accounts.
• Streaming, music and gaming.
• Subscriptions and trials you forgot.
• Devices: phone, laptop, tablet, smart watch, headphones and any shared devices.

Your password manager can help build this list. Mark the accounts that hold money, personal documents or the ability to reset others, because they come first.

Step two: secure your email

Email is the master key, since password resets go there.

• Use a unique, long password and store it in a manager.
• Turn on two-factor authentication with an app, key or passkey.
• Check recovery details: phone number and backup email.
• Review sign-in activity and connected apps.
• Look for forwarding rules or filters you did not create, which attackers use to spy.
• Separate roles. Consider different addresses for important accounts, for sign-ups and for newsletters.
• Secure your university email the same way.

Step three: passwords that work

• Unique for every account. Reuse is the biggest avoidable risk.
• Long and random, generated by a manager.
• Memorable passphrase for the few you must type, such as your manager's master password.
• No personal details like birthdays, names or pet names.
• Change only when needed, such as after a breach, instead of on a regular schedule that leads to weaker choices.
• Never share passwords by message. Use sharing tools designed for it.
• Avoid saving passwords on shared computers.

Step four: two-factor authentication everywhere it matters

After email, protect:

1. University accounts
2. Banking, payments and student finance
3. Cloud storage and backups
4. Password manager
5. Social media and messaging
6. Shopping and delivery accounts with saved cards

Prefer authenticator apps, passkeys or security keys over text messages. Save backup codes safely.

Step five: keep devices and software updated

Updates fix security holes that attackers exploit.

• Turn on automatic updates for the operating system, browser and apps.
• Restart when prompted.
• Replace devices that no longer get updates.
• Install apps only from official stores.
• Remove apps and extensions you do not use.
• Use a screen lock and strong passcode.
• Enable device tracking and remote wipe.
• Encrypt your storage if your device offers it.

Step six: manage permissions and sharing

Apps often ask for more access than they need.

• Review permissions for location, camera, microphone, contacts, photos and files. Remove what is not needed.
• Check connected apps on your Google, Microsoft, Apple and social accounts, and remove old ones.
• Think before using "sign in with" buttons. They are convenient but link accounts together.
• Limit what you share publicly. Birth date, address, phone number, student ID and travel plans can help scammers.
• Share documents carefully. Use link sharing with restricted access, not public links, for sensitive files.
• Be careful with screenshots and photos that show private information.

Step seven: protect your identity documents and personal data

• Know what you need to carry. Leave spare cards, passport and documents locked at home.
• Store scans securely, with encryption or in a protected vault, not in an open camera roll.
• Shred or securely dispose of paper with personal details.
• Check statements and credit reports regularly where available.
• Use virtual cards or payment protections where offered for online shopping.
• Share your student ID number and date of birth only when necessary.

Step eight: back up your files

Security includes not losing data. Use cloud storage and an external drive, keep more than one copy of important work and test restoring.

Step nine: watch for breaches and unusual activity

• Use reputable breach-checking tools that tell you if your email appears in known leaks.
• Turn on login alerts for important accounts.
• Read notices from companies about security incidents, but verify them through official sites to avoid fake alerts.
• Check bank and card statements weekly.
• Review active sessions and devices in account settings, and sign out those you do not recognize.
• Set up transaction alerts for banking.

If an account appears in a breach, change its password, enable two-factor authentication, change the password anywhere you reused it, and watch for phishing that uses the leaked information.

Step ten: plan recovery

Things go wrong, so prepare.

• Keep recovery codes offline.
• Update recovery phone numbers and emails.
• Know the support routes for your key accounts.
• Have a trusted contact for emergency access where offered.
• Keep a list of what to do if your phone is lost: lock, locate, call your provider, change passwords and sign out sessions.
• Know your university IT contact for account problems.

Clean up old accounts

• Close accounts you no longer use, especially ones with saved payment details or personal data.
• Delete old apps and services.
• Unsubscribe from newsletters you do not read.
• Remove old devices from your accounts.
• Delete unneeded files and exports.
• Check old social media posts and remove those that expose personal details.

Fewer accounts mean fewer places to be breached.

A monthly security checkup

Set a reminder and spend ten minutes:

1. Review bank and card statements.
2. Check breach alerts and login notifications.
3. Install pending updates.
4. Review new apps and permissions.
5. Back up important files.
6. Delete or close one unused account.
7. Check that your phone and laptop backups worked.

Once a term, do a deeper review of passwords, recovery details and sharing settings.

If an account is hacked

1. Try to regain access using official recovery. Do not use links in suspicious messages.
2. Change the password and any reused passwords.
3. Sign out of all sessions and remove unknown devices and apps.
4. Check for changes: forwarding rules, recovery details and linked accounts.
5. Turn on two-factor authentication.
6. Scan your device for malware.
7. Warn contacts that messages from your account may be fraudulent.
8. Report the incident to the service and your university IT.
9. Tell your bank if financial details may be at risk.
10. Monitor for follow-up scams.

Teaching the habits to others

Once you have done the work, share it. Offer to help a friend set up two-factor authentication, or walk a family member through a password manager. Explaining something is one of the best ways to understand it, and it spreads good habits through your circle. Keep your tone friendly, since people resist advice that sounds like blame. Small wins, like a protected email account, are worth celebrating.

Keep your approach realistic. You do not need perfect security, only enough good habits to make you a harder target than the next person. Choose the steps that fit your life, do them consistently and improve over time.

Common mistakes

• Reusing passwords.
• Skipping two-factor authentication.
• Ignoring updates.
• Leaving old accounts open.
• Oversharing on social media.
• Having no backups.
• Not preparing for recovery.

A quick checklist

• Do I have a list of my accounts?
• Is my email secured with a strong, unique password and two-factor authentication?
• Do I use a password manager?
• Are my devices updated and locked?
• Do I have backups and recovery codes?
• Do I do a monthly checkup?

Final thoughts

Account security is mostly habit. Secure your email first, use unique passwords and two-factor authentication, keep devices updated and limit what you share. Back up your files and plan how you would recover from a problem. A short monthly checkup keeps the routine alive and turns a vague worry into a manageable task.