COMMENTARY: Lately I’ve been getting the same question from grandparents, friends, and even tech-savvy business leaders: With everything I’m hearing about the dangers of AI, what should I actually be doing to protect myself?
The conversation about AI and security has become unnecessarily overwhelming. The headlines can make it sound as if ordinary people are powerless against technology they don’t understand. That’s not true.
[SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]
AI is making scams more polished, personal, and scalable. A phishing email may have perfect grammar. A fake website may look legitimate. A phone call may sound like someone you know. But the goal of most attacks hasn’t changed: get you to give up a password, a verification code, money, or access to an account.
I’ve seen firsthand how a compromised account or stolen identity can spill into every part of someone’s life — financially, professionally, and personally — and how long these knots can take to untangle.
But you don’t need to be a cybersecurity expert to protect yourself. You just need a few practical habits to make the most of the security tools that are already available to you.
Here are the 10 steps I’d prioritize.
1. Protect your email account like it’s the master key to your life
For most people, email is where password resets, bank alerts, travel confirmations, tax documents, and sensitive conversations land. If someone takes over your primary email account, they can often use it to take over everything else.
What to do now:
- Go to the security settings for your primary email account.
- Turn on phishing-resistant MFA (more on that below).
- Review the recovery email address and phone number attached to the account. Remove anything old or unfamiliar.
- Check recent sign-ins and devices. Sign out of devices you don’t recognize.
- Save any account-recovery codes somewhere secure — ideally in your password manager, not in a screenshot on your phone.
Do this review first; it offers the biggest security return for the time it takes to complete.
2. Use a password manager
You shouldn’t have to remember dozens of long, unique passwords. That’s what password managers are for.
A password manager creates and stores a different password for every account. If one company has a breach, an attacker can’t take that password and use it to get into your email, bank, or social-media accounts.
Several strong options include:
- Apple Passwords, if you primarily use Apple devices.
- Google Password Manager, if you primarily use Chrome and Android.
- Bitwarden, a strong cross-platform option with a free plan.
- 1Password, a polished cross-platform option for individuals and families.
- Dashlane, another established cross-platform choice.
The best password manager is one you’ll use consistently across all your devices.
What to do now:
- Pick one manager and install its browser extension and mobile app.
- Create a long, memorable master password: four or five unrelated words is a good starting point.
- Turn on phishing-resistant MFA for the password-manager account itself.
- Start by changing the passwords for your email, financial accounts, and social-media accounts.
- Let the password manager generate passwords for you. You don’t need to see or remember them.
Don’t save your password-manager master password in the password manager itself.
3. Use phishing-resistant MFA
MFA, or multi-factor authentication — also called two-step verification — ensures that a password alone won’t be enough to access your account. The strongest forms of MFA are phishing-resistant; they can’t be copied from a fake website or read over the phone to a scammer.
Passkeys are a simple form of phishing-resistant MFA that let you sign in with Face ID, Touch ID, Windows Hello, or your device PIN. In practice, they combine your device with the way you unlock it, so there’s no password to steal and no verification code to hand over. NIST describes correctly implemented passkeys as phishing-resistant authenticators.
What to do now:
- In the security settings for your email, bank, Apple, Google, Microsoft, and social-media accounts, look for “passkeys.”
- Set up a passkey when it’s offered, starting with your most important accounts.
- If passkeys aren’t available, use an authenticator app or physical security key.
- Use text-message codes if that’s the only option. They’re still much better than no MFA.
- Never share your verification code with someone who calls, texts, or emails you. Legitimate companies won’t ask you to read one to them.
4. Treat urgency as a warning sign
AI can make scams look more credible, but it hasn’t changed the psychology behind them. Scammers still want you to act before you have time to think: “Your account will be closed today.” “Your child needs help.” “Your boss needs this payment right now.” “This offer expires in ten minutes.”
What to do now:
- Pause when a message creates urgency, fear, or excitement.
- Don’t click a link in an unexpected email or text, even if it seems to come from a company you know.
- Open the company’s app directly or type the website into your browser yourself.
- Be especially cautious of requests that involve money, passwords, verification codes, or personal information.
A real company will give you a way to verify what’s happening. A scammer wants you to skip that step.
5. Verify unusual requests through a different channel
This is the habit I want every family, friend group, and workplace to adopt.
If someone asks you to send money, buy gift cards, share information, reset an account, or provide a login code, verify it through a separate channel. Don’t reply to the suspicious message. Don’t call the number in the email. Don’t trust the caller ID.
What to do now:
- Call the person on a number you already know.
- Use a company’s official app or a phone number you independently look up.
- For family members, consider agreeing on a simple verification question that only your family would know.
- For money transfers, make “call and confirm” a default rule.
As voice and video become easier to fake, “I saw it” or “I heard it” is no longer enough. You need to independently verify the message itself.
6. Protect your phone number – and the accounts that depend on it
Your phone number has become a backup key to your digital life. It’s often used to reset passwords and receive verification codes, which makes it a target.
In a SIM-swap or phone-number porting scam, a criminal convinces a mobile carrier to move your number to a phone they control. They can then receive your calls and text-message codes, including codes used to access your email, bank, and social-media accounts. The FTC’s guidance is clear: protect your carrier account and don’t rely on text messages alone for important accounts.
What to do now:
- Set a separate PIN or password on your mobile-carrier account. This is different from the PIN you use to unlock your phone.
- Ask your carrier to enable its phone-number protection. It may be called a Number Lock, port-out lock, account lock, or SIM-swap protection.
- Whenever possible, use passkeys, an authenticator app, or a physical security key — not text messages — for MFA on your email, bank, and other important accounts.
- Review the accounts that use your phone number for password recovery. Add stronger recovery options where available.
This risk isn’t far-fetched. Phone-number takeovers happen far more often than most people realize, and one stolen number can quickly give the thief access to much of your digital life.
7. Turn on automatic updates
Updates aren’t just new features and inconvenient notifications. They often fix security flaws that attackers know how to exploit.
What to do now:
- Turn on automatic updates for your phone, computer, browser, and apps.
- Restart your devices when you’re prompted to do so; an update that hasn’t been installed isn’t protecting you.
- Check that your home Wi-Fi router is still supported and receiving updates.
- Replace smart-home devices that no longer receive security updates, particularly internet-connected cameras, doorbells, garage door openers, and locks.
This is one of the rare security improvements that becomes easier once you set it up.
8. Be thoughtful about what you make public
You don’t need to disappear from the internet. But the more personal information you make publicly available, the easier it is for someone to create a convincing story about you by using that information to impersonate you, answer security questions, or make a scam feel unusually personal.
What to do now:
- Review the privacy settings on your social-media accounts.
- Limit who can see your birthday, phone number, family information, location, and travel plans.
- Avoid posting answers to common security questions, such as the name of your first pet or the street where you grew up.
- Be skeptical of quizzes and apps that ask for personal details they don’t need.
- Turn off location sharing for apps that have no reason to know where you are.
This isn’t about blame or fear. It’s about giving scammers less material to work with.
9. Be deliberate about every app you connect to your digital life
AI agents make this more visible, but the principle applies to any third-party app that’s connected to your email, calendar, files, social accounts, or financial information.
An app that can read your inbox, access cloud files, post on your behalf, or send messages is a party that has access to part of your digital life. AI agents raise these stakes because they can take actions based on what they read, and thus can be vulnerable to malicious instructions hidden in the emails, files, and websites they process. The risk becomes much greater when an agent, or any connected app, also has broad permission to send, delete, share, or change information. NIST and OWASP both emphasize limiting permissions and requiring human approval for consequential actions.
What to do now:
- Before clicking “Allow,” ask whether the app actually needs this access in order to do what you want.
- Read the permissions screen. Is it asking to see your entire inbox or only selected information? Can it just read files, or can it also send, delete, post, or make changes?
- Start with the narrowest available permission. Read-only access is safer than permission to send, delete, or change information.
- Be especially cautious about connecting AI agents to your primary email, financial accounts, or sensitive files.
- Don’t give any app your passwords, recovery codes, API keys, or financial-account numbers.
- Review your connected apps every few months and revoke access for anything that you no longer use.
- For meaningful actions like sending an email, making a payment, or deleting a file, keep yourself in the approval loop.
Convenience is valuable. Unlimited access is rarely necessary.
10. Freeze your credit before you need it
A credit freeze makes it much harder for someone to open a new credit account in your name. It’s free to place and lift, doesn’t affect your credit score, stays in place until you remove it, and is one of the most practical protections against identity theft and in the U.S. FTC guidance
What to do now:
- Place a freeze with all three credit bureaus: Equifax, Experian, and TransUnion.
- Keep the freeze in place by default.
- If you need to apply for a mortgage, loan, apartment, insurance, or new credit card, temporarily lift the freeze — ideally only at the bureau the lender will check — then turn it back on.
- Review your credit reports periodically for accounts you don’t recognize.
- Consider also freezing your children’s credit.
A freeze won’t prevent every kind of fraud or account takeover, which is why alerts, strong account security, and regular review still matter. But it can stop one of the most disruptive forms of identity theft before it starts.
If something does happen, act quickly
Even careful people can get caught by a convincing scam. The goal isn’t perfection; it’s making a bad day recoverable. If you think an account has been compromised, contact the affected company through its official website or app, change your password, review your recovery information, and sign out of unfamiliar devices. If you believe your identity has been used to open an account, report it at IdentityTheft.gov.
If you have 30 minutes, start here
You don’t need to take all the steps I’ve described here tonight.
Start with these four:
- Protect your primary email account.
- Set up a password manager.
- Turn on passkeys or other phishing-resistant MFA for your most important accounts.
- Freeze your credit.
AI will keep changing how attacks look, but it doesn’t change the fundamentals of protecting yourself. Pause. Verify. Use the security tools that are already in your pocket. And be deliberate about who — or what — you give access to your digital life.
Let’s stay safe out there!
