Cyber fraud? Call 1930 · cybercrime.gov.in (opens in a new tab)

Search
Akshay Kumar Sharma

Password and Account Security

Practical habits for strong passwords, two-factor authentication and safe account recovery.

Download this guide with its diagrams as a PDF.

Download PDF (English)

What it is

A strong password is only one layer. The biggest risks are reusing the same password across sites and falling for phishing. When one website leaks passwords, attackers try the same combination on your email, banking and social accounts.

How it works - and where you can stop itRed boxes show what the attacker does. Green boxes show where you can break the chain.
  1. You use the same weak password on many sites
    Stop here: Use a long, unique password for every account. A password manager helps.
  2. One of those sites gets breached
    Stop here: Check whether your email appeared in a breach and change those passwords.
  3. Attackers try the leaked password on your other accounts
    Stop here: Two-step verification blocks the attacker even with the password.
  4. Your email or bank account is taken over
    Stop here: Secure your email first. It can reset everything else.
  5. Money, data and contacts are misused

Common warning signs

  • You use the same or a similar password on several websites.
  • Your password is short, a name, a date, or a common word.
  • You receive security alerts about logins from places or devices you do not recognise.
  • Your email or phone number appears in a known data breach.
  • You have never turned on two-factor authentication for email or banking.

Practical prevention tips

  • Use a long passphrase (several unrelated words) or a password manager to create and store unique passwords.
  • Never reuse passwords, especially for email, which can reset your other accounts.
  • Turn on two-factor authentication, preferably with an authenticator app rather than SMS where possible.
  • Keep recovery email and phone number up to date.
  • Do not store passwords in plain notes or share them over chat.
Risky habit vs safe habit
  • Use 'password123' or your birth date
    Use a long passphrase of random words
  • Reuse one password on every site
    Use a different password for each account
  • Skip two-step verification
    Turn it on, preferably with an authenticator app
  • Keep passwords in notes or chat apps
    Store them in a trusted password manager

What to do if it happens

  1. Change the password on the affected account at once and on every site where you reused it.
  2. Log out of all sessions and review connected apps and recovery details.
  3. Check whether your email appears in a known breach using a trusted checker.
  4. If money or identity misuse is involved, report at cybercrime.gov.in (and 1930 for financial fraud).

Official reporting resources

Related educational articles

Social Media Security

Read guide

Phishing and Fake Websites

Read guide

Digital Footprint and Privacy

Read guide

This website is an educational resource. It is not an official government reporting portal or an emergency response service. If you are a victim of cyber fraud, report it through the official channels listed on each page.