Two Identifiers Hold Up the Rest
Two identifiers unlock almost everything else you own. Your mobile number, and your primary email address. They are the recovery path for every other account you hold. Take either one and you take the rest. So they get hardened first, before the bank login, before anything.
Drop the Calendar, Change the Factor
Start by dropping advice you were almost certainly given. Changing your password every 90 days is now contrary to the current federal standard, which says a password shall not expire on a schedule. You change it on evidence of compromise. Not on a calendar.
What earns the effort instead is a better second factor. Phishing-resistant authenticators, passkeys and hardware security keys, sit in the top tier of that same federal standard. A text-message code is better than nothing, and it is worse than a passkey. Both halves of that are true.
Lock the Number, Split the Email
Then deal with the number, because that is the weak end. In 2023 the FCC adopted rules on SIM swaps and port-outs: secure authentication before a change, notice to you when one is requested, and a free lock on your account against port-outs. Adopted is not the same as operating. A 2024 FCC order, DA 24-649, waived the compliance deadline for those rules pending review by the Office of Management and Budget. Do not wait on the rulemaking. The control you want is already sitting on your account.
Ask your carrier for its number lock or port freeze, and switch it on. It defeats the attack where somebody moves your number onto their device and harvests your reset codes. It does nothing about a password stolen from an account that never texts you.
Then split the email. The address on your banking should not be the address on your conference bio or your domain registration. During 2024 the Federal Trade Commission took 6.5 million consumer reports, unverified reports rather than a survey, and recorded 12.5 billion dollars in fraud losses for that year.
Lock the Number
Passkey the Email
Split the Addresses
None of these controls cost money. None of them are new. They are sitting switched off on accounts you already own. Two identifiers hold up everything else. Start there.
Twenty minutes, in this order: ask your carrier for its number lock or port freeze and switch it on, add a phishing-resistant second factor to your primary email, then stand up a second address that only your financial accounts know and stop publishing the first one anywhere new.