“Turn on two-step verification” keeps appearing. You keep postponing it. The backup codes are saved somewhere, probably.
Why it matters
With multifactor authentication, a stolen password alone is less likely to be enough. But without a recovery option, losing your device can lock you out too.
A step you can take yourself
Pick your most important account and look in its settings: is multifactor authentication on, and where do recovery messages go?
With COMPASS
We sort out the types of authentication and how to keep a way back in. You make the settings changes yourself.
Not to add to your worry— to show you how to check.
You don’t need to spot every fake. One habit—pause, then verify through a separate route—helps in many situations.
Illustrative, fictional exampleAn urgent “verify now or be suspended” message arrives.
From sample-bank-alert@notice.example
[Important] Within 24 hours, you must verify your identity. Otherwise your account will be suspended.
https://sample-bank.verify-login.example/…
To confirm, enter the code sent to you by SMS.
A deadline pushes you to hurry.
A frightening consequence is threatened.
The link does not match the official site you normally use.
It asks for an authentication code or PIN.
Verify through a separate route
Close the message.
Open the official app or your own bookmark.
Check notices and recent activity there yourself.
If still unsure, call the number on your card or the official site.
Never give an authentication code to anyone.
“Sample Bank” is fictional. Some fakes show none of these signals, and some genuine messages show a few. That is why you verify through a separate route instead of judging by appearance.
Three habits
01
Notice
Pause at pressure tactics or unusual requests.
02
Verify separately
Find the official service through a separate route.
03
Prepare
Review accounts, authentication and recovery options.
What the sources say
IPA’s “10 Major Security Threats 2026” lists, for individuals, threats including phishing for personal information and unauthorised logins to online services (unranked).
Japan’s Council of Anti-Phishing received 190,500 phishing reports in December 2025 alone. The most impersonated brands were familiar names such as Amazon and Apple. This counts reports, not victims.
NIST’s guidelines require service providers not to impose character-mix rules, not to require periodic password changes, and to allow password managers. The emphasis is on length.
Password management, multifactor authentication, recovery options and how to review account settings.
Suspicious messages
Check senders, URLs and requested actions, and pause when a message pressures you to act.
Data & device preparation
Understand updates, backups and loss preparation in the context of your own devices.
Keep secrets private
Keep passwords, authentication codes and recovery information private, and operate your own devices.
Scope & pricing
Tell us which devices and services you use and what concerns you. We confirm suitable topics and scope. Any paid support starts only after agreement on content, cost and timing. You do not need to send login credentials or secrets.
What’s included—and what isn’t
You can ask about
Password management
Multifactor authentication and recovery options
Recognising and verifying suspicious messages
Backups and preparing for a lost or broken device
What information to keep private
Outside the scope
Penetration testing or professional security audits
Continuous monitoring or emergency incident response
Incident investigation or fund recovery
Guaranteed account or asset recovery, or complete security
Service boundaries
We do not guarantee complete security, scam prevention or recovery of accounts or assets. This is not penetration testing, a professional security audit, 24/7 monitoring, emergency response, incident investigation or a fund-recovery service. Suspected incidents may require the service’s official support or an appropriate specialist.