Your codeis your key.

Account takeover: how it happens and how to stop it

Your email is the master key. Whoever controls it can reset your social, school, banking and application accounts. Attackers get in through a few predictable routes:

• Password reuse. One site leaks, and the same password is tried everywhere.
• Fake sign-in pages reached from links in DMs, texts and emails.
• Code-forwarding scams like Jaylen's Sunday text. The FTC is clear: never give a verification code to anyone, and anyone who asks is a scammer. The code on your phone is for your account.
• SIM swaps. A scammer convinces a mobile carrier to move your phone number to their SIM card. Your texts, including sign-in codes, go to them. Federal Communications Commission (FCC) rules require carriers to use secure ways to verify customers before moving a number and to notify customers about SIM change and port-out requests.

Your lock-down routine:

• Step 1 — Unique passphrases. At least 16 characters, such as 4 to 7 random words (CISA's guidance), different for every account. Start with email.
• Step 2 — Stronger MFA. An authenticator app or a passkey is stronger than text codes, which a SIM swap can intercept.
• Step 3 — Recovery settings. Make sure the recovery email and phone are yours and current. Save backup codes somewhere safe offline.
• Step 4 — Carrier PIN. Ask your family's carrier about an account PIN or lock for SIM changes and number transfers, and keep alerts on.
• Step 5 — Review sign-ins. Check the "devices" or "where you're signed in" list and remove anything you don't recognize.

Warning signs: codes you didn't request, "new sign-in" alerts, password-reset emails you didn't start, or your phone suddenly showing no service. Act immediately: change the passphrase from the real app, sign out all sessions, contact the carrier if service dropped and tell a trusted adult. For a school account, contact your district help desk.