How to Protect Your Personal Information Online: A Senior's Step-by-Step Guide

Personal information is any detail about you that a criminal can use to pretend to be you — your Social Security number, bank account and card numbers, passwords, Medicare number, date of birth, even your home address. Protecting it comes down to a few habits: give every account its own passphrase, turn on the extra lock apps offer (two-step verification), never share sensitive details by text, email, or a cold call, and check any link before you tap it. If information ever slips through, there is a clear order of steps — bank first, passwords second, freeze third, family always — that limits the damage. This guide walks you through all of it, one step at a time.

What Counts as Personal Information (and Why Scammers Want Each Piece)

Think of your personal information as the keys to your life. A scammer rarely needs all of it — often one or two pieces are enough. Here is what each piece is, and what a criminal does with it:

• Your Social Security number (SSN). The master key in the United States: with it, a criminal can apply for credit cards, loans, or tax refunds in your name. It never changes, so protect it above all. No real bank or government office will ever ask for your full SSN by text, email, or an unexpected call.
• Bank account and card numbers. These give direct access to your money — including the small details like the three-digit code on the back of a card or the expiration date.
• Your Medicare number (if you have one). Criminals use stolen Medicare numbers to bill for services you never received. Guard it like a bank card.
• Passwords and PINs. The password that unlocks your email unlocks everything else, because password resets for all your accounts arrive there. This is why every account needs its own passphrase — the next section shows the easiest way.
• Your date of birth and home address. These seem harmless, but they are exactly the "security questions" many sites ask — combined with a name, they let a scammer pass verification checks.
• Your phone number and email address. These are how scammers reach you in the first place, and how they can pretend to be you. Be careful about publishing them publicly, for example in online profiles or comments.

Each piece alone is a puzzle fragment; together they complete the picture. Your job is to make sure criminals never collect enough fragments — the sections below show how.

Easy Passphrases That Are Strong

Forget the old advice about impossible passwords like Tr$7x!qZ9 — nobody can remember those, so everyone reuses one everywhere. There is a better way: the passphrase — just four or more random, ordinary words joined together. Long enough to defeat thieves, made of real words so you can actually remember it.

Here are two worked examples so the idea is clear — these are illustrations, not passwords to use; pick your own random words:

• garden-apple-train-bridge — picture a little scene: an apple growing in a garden, near a train crossing a bridge. Say the scene to yourself and you will remember the order.
• candle-rabbit-window-song — again, make a mental picture: a candle lighting a rabbit, looking out a window, while a song plays. The weirder the picture, the easier it sticks.

Rules for building your own:

1. Use at least four words, and make them random. Open a book, point at words, and take what you find. No famous phrases, song lyrics, or words connected to you (no street names, birthdays, grandchildren's names).
2. One passphrase per important account. Your email, your bank, and your phone carrier each get their own passphrase. If one is ever stolen, the others stay safe. This is the single most important rule in this guide.
3. Write them in a notebook you keep at home — that is allowed. Honest advice: a notebook in your desk drawer beats reusing one weak password everywhere. Just do not photograph it, store it on your phone, or carry it with you — home stays home.
4. Change a passphrase only when there is a reason. If a company tells you there was a breach, or if you suspect someone saw your notebook, change that account's passphrase. Otherwise, a good passphrase does not expire — "change it every month" is old advice that made people choose weaker passwords.

Turn On the Extra Lock: Two-Step Verification in Plain Words

Two-step verification (also called two-factor authentication or MFA) is a second lock on your accounts. You sign in with your passphrase — step one — and then the app asks for a second proof: a short code sent to your phone as a text, or your fingerprint. Even if a criminal learns your passphrase, they cannot get past the second step without your phone.

Think of it this way: your passphrase is the key to the front door; two-step verification adds a bolt on the inside. Most banks, email services, and social apps offer it for free — you just have to switch it on. Start with your email and your bank app, because those two accounts protect everything else. Menu names vary between services, so here is the general map:

1. Open the app and find your account or profile area. It is usually your name, initial, or a small picture in a corner of the screen. Tap it.
2. Look for words like "Security," "Sign-in," or "Privacy." The two-step option lives under one of these. It may be called "2-Step Verification," "Two-Factor Authentication," or "extra security."
3. Choose to receive codes by text message. For seniors this is the simplest: you sign in, a code arrives as a text, and you type it in.
4. Test it once, with a family member nearby if you like. Sign out and sign back in to see the second step in action. It adds about twenty seconds — and it makes your account enormously harder to steal.

The Never-Share Rules

This section is the shortest and the most powerful. Memorize these rules and you close the door on the most common attacks:

• Never share your Social Security number by text, email, or on a call you did not start. Real government offices and real banks do not ask for your full SSN this way — a text or call asking for it is a scam, full stop.
• Never give bank or card details to someone who contacted you first. Not the "fraud department" that called you, not the text about a frozen account. If you are worried, hang up and call the bank yourself on the number printed on your card.
• Never read back a code sent to your phone. If you get a verification code you did not request, and someone calls asking you to read it aloud, refuse. That code is the second lock from the previous section — reading it to a stranger hands them the key.
• Never share your Medicare number with anyone who calls, texts, or emails you first. Medicare fraud is a booming business precisely because people are polite on the phone. Being polite does not require answering questions.
• Share information only on sites and calls YOU started, at addresses YOU typed. If you typed your bank's real web address yourself, or called the number on your card, you are in the right place. If a link or caller brought you somewhere, you are not — until you verify.

A useful sentence to practice out loud, so it is ready when you need it: "I don't share personal information with people who contact me first. I'll call you back through the official number." Then hang up.

Spotting Phishing Links Before You Tap

A phishing link is a link in a text, email, or message that pretends to go somewhere trustworthy but really goes to a thief's fake website — which then asks for your passphrase, card number, or Social Security number. Here is how to catch these before you tap:

• Check the sender first. Is the text from an unknown number claiming to be your bank? Is the email from an address that is close to, but not exactly, the company's real name? Slight misspellings are the most common giveaway.
• Preview the link before touching it. On most phones, press and HOLD a link for a second — a small window pops up showing the real address it goes to. If that address does not match the real company, do not tap it.
• Go there yourself instead. If a message says your bank, delivery service, or account has a problem, do NOT use the message's link. Close the message and open the company's official app from your home screen, or type their address yourself. If the problem is real, you will see it there.
• Distrust urgency. "Your account will be locked in 24 hours!" "Act now or pay a fee!" Panic is the phisher's tool — real companies do not send security messages built on terror. Slow down, and the trick falls apart.

If Your Information Leaks: Exactly What to Do

First, do not panic — and do not feel ashamed. There is a proven order of steps that limits the damage. Work through them in this order:

1. Call your bank immediately — the number on your card. Turn your card over and call that number. Say this, plainly: "Hello, I think I shared my information with a scammer. Can you check for any activity I didn't make, and help me change my online access?" The person on the line handles this every day — you do not need special words. Ask them to watch the account for unusual activity.
2. Change the passwords that matter, in this order. First your email passphrase (remember — email is the key ring). Then your bank passphrase. Then any other account that shared the same passphrase. Make each new one unique using the passphrase method above.
3. Place a credit freeze (US readers). A credit freeze tells the three credit bureaus — Equifax, Experian, and TransUnion — not to open any new credit in your name without you lifting the freeze first. It is free in the United States, it does not hurt your credit score, and you can lift it temporarily whenever you need to. Search each bureau's official site (type the address yourself) for "security freeze." UK and Canada readers: check your bank and card statements for anything you did not do, call your bank, and ask about their fraud-protection options.
4. Tell a family member. Scammers count on silence and shame. Breaking the silence is the brave, correct move: a family member can sit with you while you make the calls, watch for follow-up scams (thieves often call back pretending to "help"), and make sure nothing is missed.
5. Report it. In the US, report to your local police and to ReportFraud.ftc.gov. Reports help investigators and create an official record of what happened.
6. Keep notes. Write down what was shared, when, and every call you made — who you spoke to, what they said, any case numbers. If anything comes of this later, your notes are gold.

One warning: after a leak, you may get calls or emails from "recovery services" promising to get your money or information back for a fee. These are almost always a second scam layered on the first — real authorities and real banks never charge you a fee to investigate fraud.

For Family Helpers

A Note on the Limits of This Guide

This guide gives general information only — not legal or financial advice. Every country's rules differ; for legal rights, identity-theft paperwork, or financial decisions, talk to your bank's fraud department or a licensed professional.

Quick answers

The 10-second version: your personal information — Social Security number, bank details, Medicare number, passwords — is what scammers actually want. Give every account its own passphrase, turn on two-step verification, and never share sensitive details with anyone who contacts you first.

The 3-minute setup: pick four random words as your email passphrase, store it in a notebook kept at home, and switch on two-step verification on your email and bank app.

The golden rule: share information only where YOU started the conversation — at an address you typed, or on a call to the number on your card.

The golden rule: share information only where YOU started the conversation — at an address you typed, or on a call to the number on your card. For spotting trick texts specifically, see how to recognize a fake delivery text; for suspicious calls, our family safe word plan and senior's scam checklist; for trusted outside help, see our directory of official safety resources. Browse all protection know-how in Online Safety.