Securing your account so that it is actually secure

Most accounts that get taken over aren't victims of technical brilliance — they're victims of a reused password. This guide is short because the things that actually work are few.

1. A unique password beats a complicated one

P@ssw0rd! looks complicated and appears in every attack list. three-random-words-together is both stronger and easier to remember.

But the real point isn't complexity, it's uniqueness. When some unrelated site gets breached, attackers take that email and password and try it on hundreds of other sites. It's called credential stuffing and it is the single most common way accounts are lost. A password used in exactly one place makes the attack useless.

2. Turn on two-factor sign-in

In Settings you can switch on two-factor sign-in by email. After that, knowing your password is no longer enough to get in. If your password ever does leak, this is the thing standing between an attacker and your account.

3. Take your email more seriously than your account

Every service you own is connected to your email by "forgot my password". If someone controls your email, they effectively control everything. Your email should have your strongest password and two-factor turned on without exception.

4. Learn what a scam looks like

• We will never ask for your password — not by email, not by message, not on a call.
• We will never tell you to send money somewhere to "verify" or "release" it.
• Before typing a password, look at the address bar. It must read exactly moneyharbor.net.
• Urgency is a warning sign. Scams are always urgent.

5. If you're ever unsure

Change your password. Changing it on Money Harbor signs you out of every device immediately — not whenever the session expires. If someone else was signed in at the same time, they are thrown out at that moment.

Then check Notifications to see what has happened on your account.