A family sits down after a bad news story and decides to take security seriously, which usually means buying something. An hour later there is a subscription to an identity monitoring service, an antivirus suite renewed for three years, and a general sense that the matter has been handled. Very little has changed. The measures that actually close the paths people are attacked through are a short list, two of them cost nothing at all, and the products that sell most easily are largely the ones that sell a feeling of having acted.
A Password Manager, Which Changes More Than Anything Else
Almost every account compromise a household will experience traces back to a password used in more than one place. One service is breached, the credentials circulate, and somebody tries them everywhere automatically. A password manager ends that permanently by making every password unique and long, which is impossible to do by memory and trivial to do with software. This is the one purchase in this article that changes the shape of the risk rather than reducing it slightly. Everything else on this list is worth doing after this one, and very little of it is worth doing instead.
The cost is modest annually and there are competent free options, so the barrier is habit rather than money. The transition is easier than people fear: install it, let it capture credentials as they are used over a few weeks, then go back and change the ones that matter most, which are the email account, anything financial, and anything holding a stored card. Nobody needs to convert two hundred accounts in an afternoon, and treating it as a project rather than a switch is what makes it stick.
A Hardware Key, and Who Actually Needs One
A hardware security key is a small device that plugs in or taps, and it is the strongest second factor available because it cannot be phished. A convincing fake login page can capture a password and a texted code, and it cannot capture a key, which verifies the site's identity before it responds. For anybody whose email account controls access to substantial assets, that difference is worth the price of two of them. For everybody else it is a reasonable purchase that will spend most of its life in a drawer, which is not an argument against it so much as a note about priority.
Two is the operative number, since the failure mode of a hardware key is losing it. Register a spare, keep it somewhere entirely separate, and confirm that a recovery method exists before relying on the arrangement. For most households this sits below the password manager and the free measures in priority, and for anybody running a business from the same email account, or holding anything that could not be replaced, it moves considerably higher up the list than the price alone would suggest.
A Backup Service Somebody Actually Tests
Backups are the only measure on this list that addresses loss rather than intrusion, and they cover the ordinary disasters as well as the dramatic ones: a failed drive, a stolen laptop, a phone in a lake, and the entire category of software that encrypts files and demands payment. Automatic offsite backup costs little per month and removes an entire class of problem that money cannot otherwise solve, since photographs and records that exist in exactly one place cannot be bought back at any price once that place is gone.
The condition attached is the one people skip. A backup that has never been restored from is an assumption, and the failure modes are quiet: a folder that stopped being included, an expired payment method, an account that has been reporting success while copying nothing. Restoring one recent file every few months and confirming that it opens is the whole of the test, and it is the difference between having a backup service and having a subscription to one. Households that put the test in a calendar do it, and households that intend to do it when they think of it do not.
The Two Free Measures That Beat Most Purchases
An authenticator application is free, takes ten minutes, and defeats the most common attack there is, which is somebody in possession of a password. Codes are generated on the device rather than sent to it, which matters because a text message can be redirected and a code produced locally cannot. Turning it on for email before anything else is the right order, since email is the account that can reset every other account a household owns and is therefore the one worth defending first. Everything else can be recovered through email, which is precisely why email is the account an intruder wants.
The second is a credit freeze, which is free by law at each of the three major bureaus and prevents new accounts being opened in a person's name. It is not a monitoring service and that is precisely its advantage: monitoring reports what has happened while a freeze prevents it. A bureau that refuses to place one, or drags out lifting it, is exactly the sort of conduct somebody complains about to the Federal Trade Commission rather than into an unanswered support queue.
Three Purchases That Mostly Sell Comfort
Identity theft monitoring is the first. It watches and reports, which is useful, and it is being sold as protection, which it is not, and it is invariably more expensive than the freeze that would have prevented the event it notifies you about. Anybody paying for both is buying an alarm on a door that is already locked, and of the two the freeze is the half worth keeping, since it is free and it stops the thing the monitoring service would have telephoned about.
The second is a heavy antivirus suite on a current operating system that already includes competent protection, where the main practical effect is a slower machine and an annual renewal nobody remembers agreeing to. The third is a consumer virtual private network sold on a general promise of privacy, which is genuinely useful on untrusted public networks and does very little on a home connection. None of the three is a scam. They are simply the easiest things to sell to somebody who has decided to act, which is why they end up in the basket while the free measures that would have mattered stay unopened.