In short: each account should have its own long password stored in a password manager, a second factor stronger than SMS (app, passkey, or hardware key), and a phone number secured against SIM swap. In Poland, this is done through PESEL restriction, while in the USA, a free block can be set with the carrier. If an account was just compromised, start with the plan What to do in the first hour.
This guide is part of a plan for individuals whose account has been compromised: what to do in the first hour and how to recover an account on a specific platform. Here we describe how to secure accounts and phone numbers to prevent a recurrence.
Passwords, Password Managers, Passkeys, and MFA
How to Change Your Password Safely
From a clean device and by manually entering the service's website, never from a link in an email. Changing your password from an infected computer is a waste of time, as the new one will leak just like the old one.
How to Create a Good Password
- Length is more important than complexity. The FTC recommends at least 15 characters, CERT Polska suggests a minimum of 14.
- The simplest method: passphrase, which is a few random words, e.g.,
green Tuesday barrel lamp. Easy to remember, hard to crack. - Each account has its own password. One password for everything means that one leak results in losing everything.
- Do not force yourself to change passwords every month. CERT Polska states that we change passwords only when we suspect someone has learned them.
Password Manager
An application that remembers all your passwords for you; you only need to remember one main password. You don't have to buy an expensive one; built-in managers in browsers and systems are fine today. For non-technical users, this is the biggest leap in security with the least effort.
What is a Passkey
A passkey allows passwordless login: instead of typing it in, you confirm your identity with a fingerprint, face, or device PIN. It cannot be phished because there is nothing to enter on a fake site. Google and Microsoft actively promote it.
Authenticator App vs. SMS
SMS is better than nothing, but it is the weakest second factor because it can be intercepted through SIM swap or phished. The FTC states that SMS verification may not prevent SIM card swapping, and given this risk, it's better to use an authenticator app or security key. From weakest to strongest: SMS → authenticator app → passkey → hardware security key.
Never give anyone the code from an SMS or app. No tech support, no bank, and no friend has the right to ask for it. "I'll send you a code, read it to me" is always a scam.
More about passwords, password managers, and two-step login: 2FA and password manager: how to secure email, banking, and social media and Passwords, password managers, and passkeys: how to secure accounts without remembering everything.
Protecting Your Number from SIM Swap
SIM swap is the takeover of your number: a scammer creates a duplicate SIM card or transfers the number to another carrier, then receives your SMS codes and resets passwords.
Only in Poland. The main tool for defense is PESEL restriction on the gov.pl website or in the mObywatel app, free of charge and effective immediately. According to the Electronic Communications Law, the carrier is required to check the restriction register before issuing a duplicate SIM card or eSIM and must refuse if the PESEL is restricted; this is also confirmed by UKE. Note: this obligation applies to duplicate SIM and eSIM, it does not cover transferring the number to another carrier.
Polish carriers do not currently offer a separate "block my number" option that customers can activate themselves. Play informs that SIM card replacement is intentionally delayed, and the customer receives an SMS and email during the process, allowing them to interrupt it. Plus states that before activating a new SIM card or eSIM profile, it checks the PESEL restriction register. Orange's procedures could not be confirmed on official websites.
Only in the USA. Here you have real, self-service blocks, and it's worth enabling them right away. FCC regulations require carriers to provide a free option to block accounts before changing SIM cards and before transferring numbers. The names vary among carriers:
| Carrier | Function | What it blocks |
|---|---|---|
| Verizon | Number Lock | Transfer of the number to another carrier |
| Verizon | SIM Protection | Transfer of the number to another device |
| AT&T | Wireless Account Lock | Account changes, only through the AT&T app |
| T-Mobile | SIM Protection | Change of SIM card (postpaid accounts) |
| T-Mobile | Account Takeover Protection | Transfer of the line to another carrier |
| Google Fi | Number Lock | Transfer of the number to another device and to another carrier |
Four practical notes:
- In Verizon, enable both functions. Number Lock does not protect against SIM card swapping, and SIM Protection does not protect against number transfer.
- T-Mobile states that SIM Protection does not block eSIM transfers on Apple devices. The block does not close all doors.
- Google Fi warns that after enabling Number Lock and losing access to your Google account, it will not provide you with data to transfer the number. Ensure you have recovery contact for your Google account beforehand.
- A PIN for your account is not the same as a block. The FCC has explicitly rejected the argument that a PIN is sufficient.
Common Mistakes
- Changing the password from an infected computer. The new password leaks immediately.
- Rescuing Facebook first instead of email. Email is the key to everything.
- Changing the password without logging out of sessions. An attacker with a stolen cookie remains inside.
- Deleting evidence. Suddenly, you have nothing to document the issue with the bank.
- Giving someone the SMS code. The most common single cause of losing WhatsApp.
- Clicking on a link in an email saying "we detected suspicious login." Always enter the site manually.
- Leaving the same password on other services. One leak triggers an avalanche.
- Forgetting about apps with access. You change the password, but a malicious OAuth app still gets in.
- Paying for "account recovery" and creating a new account instead of going through the procedure.
Myths and Facts
Myth: "I have nothing interesting, no one will hack me." Fact: Your account itself is a commodity: it provides access to a list of friends to whom you can send a credible request for money.
Myth: "I have antivirus, so I'm safe." Fact: Most breaches start not with a virus, but with a leaked password or a fake login page.
Myth: "Changing the password is always enough." Fact: It is not enough if the attacker has an active session, added their own MFA, passkey, or access app.
Myth: "SMS codes are secure." Fact: Better than nothing, but vulnerable to SIM swap and phishing. Microsoft has announced the phasing out of SMS for personal accounts.
Myth: "Facebook will help me, just write to them. And with Meta Verified, it will go faster." Fact: Contact with a live person at Meta is very limited; forms are the basis. Meta explicitly states that when recovering a page, the form is the fastest route even for Meta Verified users.
Myth: "I must report the breach to UODO." Fact (only in Poland): The obligation to report within 72 hours lies with the data administrator, i.e., the company or institution. It does not apply to private individuals.
Myth: "PESEL restriction will block my life." Fact: You can still register with a doctor, withdraw cash, make a transfer, and travel abroad. You can lift the restriction temporarily when needed.
Frequently Asked Questions
Will PESEL restriction protect me from SIM swap?
Only in Poland: it protects against issuing a duplicate SIM and eSIM because the carrier is required to check the register. However, it does not cover transferring the number to another carrier.
Is blocking a number in the USA paid?
No. FCC regulations require carriers to offer such a block for free, including to prepaid customers.
Is an SMS code sufficient as a second security measure?
It is better than nothing, but it is the weakest second factor because SMS can be intercepted through SIM swap or phished. The FTC advises using an authenticator app or security key given this risk.
Is a PIN for the account with the carrier sufficient instead of a block?
Only in the USA: no. The FCC has explicitly rejected the argument that a PIN is sufficient. Enable number and SIM card blocking with your carrier.
Sources
As of October 24, 2026. This guide is for informational purposes only and does not constitute legal or financial advice. Account recovery procedures, setting names, and help page addresses change frequently, especially in Meta, Google, and Microsoft services, so check the provider's current help page before taking action. No platform guarantees account recovery or refunds. For legal obligations (e.g., reports to UODO) and financial losses, consult a lawyer, bank, or relevant authority.
Comments (0)
No comments yet. Be the first!