How to secure your account in 10 minutes: what works and what is theatre

Most security guides are useless because they mix the critical with the decorative. They give you fifteen tips as if they all weighed the same, and they do not.

This list is ordered by real impact. If you only do the first three, you have already covered most of the risk and you can close the page.

1. Put a PIN on your phone line

Five minutes, and it is the step almost nobody takes.

Your phone number is the master key to your digital life. It receives codes, resets passwords, confirms transactions. And it is surprisingly easy to steal.

The attack is called a SIM swap. Someone shows up at your carrier with your details, says they lost their phone, asks for a new SIM with your number. From that moment your codes go to that person.

The defence is one phone call. You ask your carrier to add a PIN or security code for any change to the line, replacements in particular. Every carrier offers it and almost nobody switches it on.

And a warning sign: if your phone suddenly loses signal for no reason and does not recover within a few minutes, do not assume it is a fault. Call your carrier from another phone.

2. Turn on biometrics, and use them inside the app

A code can be extracted by deception. A fingerprint cannot.

When an app gives you the option to confirm a transaction with biometrics instead of a code, that is the safer route. Also enable the phone's own biometric lock, with a backup code of six digits or more. An unlocked phone is an open account.

3. Harden your email before your financial account

This sounds backwards and it is true: whoever controls your email can reset the password for almost everything else. Your email is more critical than any single app.

Four things there:

• A long, unique password you do not use anywhere else.
• Two-step verification, better with an authenticator app than with SMS.
• Open "recent activity" or "devices" and remove anything you do not recognise.
• Check there are no automatic forwarding rules you did not set. It is a common way to read your mail without logging back in, and almost nobody checks it.

4. Use a password manager

You do not need to pay for anything. Browsers and operating systems already ship with one.

The goal is not sophistication. It is that a leak at some random online shop does not end up opening your euro account. As a floor: your email, your bank and your money apps have three different passwords, and none of them resembles the one you use on social media.

5. Review your devices once a month

Set a reminder, seriously. Where that list lives in each app is covered in the FAQ. Once a month, open the active sessions list on your email, your social accounts and your money apps, and remove everything you do not recognise. The old phone you sold, the laptop from your previous job, that computer in an internet café.

6. Turn on alerts for everything, including the small stuff

How much damage fraud does depends mostly on how long it takes to spot.

Set notifications for every movement, including one-euro ones, and above all for recurring transfers such as the euro payroll you send home every month. The classic test before a large charge is a tiny charge, to see whether the account responds and whether anybody is watching. Currencies work the same way: a tiny euro to Argentine peso conversion outside your routine deserves a look.

7. The one rule with no exceptions

No legitimate party will ever ask you for a verification code, or a password, or to move your money to another account to protect it. Nobody needs to read you an IBAN or a SWIFT or BIC code over the phone either, because every institution publishes those. Not support, not your bank, not the police. Nobody, ever, for any reason.

If someone asks, the conversation is over right there. And it does not matter that they know your name, your ID number or your recent transactions: that data circulates in leaks and proves nothing. The vocabulary these messages use is broken down in the glossary.

What is pure theatre

To save you time, these deliver far less than they appear to:

If something already happened

The order matters. First you block the line with your carrier, because while the SIM is in someone else's hands everything else can be reopened. Then you change your email password and close every session. The sooner you report it, the more room there is to act on a payment in flight, because a SEPA or SWIFT transfer runs on concrete time windows. Only then do you notify your financial providers through their official channels, that same day. And you file a report, because without one almost no claim moves forward.

How those messages arrive and how to recognise them is in the scams that hit Latinos in Spain hardest. And if a transaction of yours has been held, your account is under review explains what is happening on our side.

Any specific question about your account, write to us from support.