Every year on the first Thursday of May, World Password Day serves as a timely reminder that one of the simplest tools we have to protect ourselves online is also one of the most overlooked: our passwords. In a world where we’re constantly connected, weak or reused passwords can act like an open door for cybercriminals.
From unsecured Wi-Fi networks to vulnerable Bluetooth connections, hackers are always looking for easy entry points to access personal information — and even your money. According to a recent study by Better Business Bureau, identity and information theft play a role in nearly half of all reported scams, underscoring just how critical it is to safeguard your digital life.
The good news? Small changes can make a big difference. As the Federal Communications Commission emphasizes, strong passwords are your first line of defense. Whether you’re shopping online, managing your bank account, working remotely or keeping up with loved ones on social media, your passwords serve as the gatekeepers to your digital identity.
That’s why it’s worth taking a few minutes to evaluate your current habits. Ideally, every account you use — especially those tied to personal or financial information — should have a unique, hard-to-guess password. If you’re still using the same login across multiple platforms or relying on simple variations, now is the perfect time to make a change and strengthen your defenses.
Recently, a password manager app reported that the most common online password remains “123456,” a code that is estimated to be in use 4.5 million times. Not far behind is the password “admin.”
It’s anticipated that accounts with these passwords can be hacked in seconds.
Another site reported that the average person uses the same password about 14 times. In those cases, if just one account is compromised, a hacker can easily gain access to many of your other accounts. You should at least take steps to ensure you’re not using duplicate passwords for accounts where you are consistently sharing sensitive data, such as bank accounts, credit cards, legal or tax records, or medically related files.
Think of your passwords as walls. A password or a passphrase should be considered a wall between free access to your personal information and the world. The stronger the wall, the more difficult it is for others to break down. The more walls, the more difficult it is to access the information. Encryption is the easiest way to protect communication between an electronic device and a website or server.
Your BBB recommends the following password-creation tips to stay safe:
— Avoid easy passwords. Try to avoid passwords that could be easy to guess, especially with information anyone can find about you on social media sites or through a phishing email or text. A strong password has at least 12 to 14 characters mixed with uppercase and lowercase letters, numbers and symbols.
Many people like to use passwords that include a pet’s name, mother’s maiden name, the town you grew up in, your birthday, your anniversary, etc. Surprisingly, these pieces of information can typically be found online if someone puts forth just a little effort. (This is why we discourage people from participating in social media surveys).
Even if you don’t consider yourself an active social media user, some of your information may be shared online. For passwords that require numbers and letters, some people stick to simple patterns like 0000, 1111, 1234, etc., but it’s very risky to make a password that is predictable.
— Make them creative. Need more creative ideas for different passwords? One option is to use a portion of a song’s lyrics. Not only is it impossible for hackers to guess what song you are using, it’s even harder for them to guess which lyrics you’re using. Just be sure not to mention your favorite songs on social media, especially by responding to an online quiz.
Another option is to use a passphrase. Your phrase should be around 20 characters long and include random words, numbers and symbols. Think of something you will be able to remember, but others need help to come close to guessing, such as PurpleMilk#367JeepDog$.
— Use multiple passwords. Using different passwords for different accounts is important. While it may be easier to remember one password for every account, it’s much easier for hackers to break down one wall rather than multiple walls. If hackers can figure out one password, they know the password to every account you own.
— Use multi-factor authentication. When it’s available and supported by accounts, use two-factor authentication. This requires both your password and additional information upon logging in. The second piece is generally a code sent to your phone or a random number generated by an app or token. This will protect your account even if your password is compromised. Many devices include fingerprint or facial recognition to unlock them, which helps protect any apps on the device if it becomes lost or stolen.
— Consider a password manager. A written list works, but if you’re worried about losing it, type up an electronic list and label it something other than “PASSWORDS.” Keep the list updated, organized and secretive. Avoid keeping the list on the device, as it will make it easier for the thief to access the apps and personal data.
You can also use a reputable password manager to store your information. These easy-to-access apps store all your password information and security question answers in case you ever need to remember. However, don’t forget to use a strong password to secure the information within your password manager.
— Select security questions only you know the answer to. Many security questions ask for answers to information available in public records or online, like your zip code, mother’s maiden name and birthplace. A motivated attacker can easily obtain that information. Don’t use questions with a limited number of responses that attackers can easily guess — like the color of your first car.
— Check your device Wi-Fi settings before surfing the web.
Check the validity of available Wi-Fi hotspots. Hackers will set up fake hotspots with the names of stores or institutions you might trust.
Make sure all websites you use have “https” at the beginning of the web address.
Install an app add-on that forces your web browsers to use encryption when connecting to websites.
If you receive a notification from a company about a possible data breach, it is always best practice to immediately change that password and any similar passwords.
BBB also offers additional information on cybersecurity and you can find tools from the Federal Trade Commission to help you recover from ID theft at ftc.gov/identitytheft.
Your BBB’s team is available at 423-266-6144 or by email at tngaBBB@chattanooga.bbb.org. BBB also offers speakers who can share tips on fraud prevention for both business and consumer groups. Please reach out to BBB if you’d like to secure a speaker for an upcoming meeting.
Michele Mason is president of the Better Business Bureau in Chattanooga.