AI-powered bots are testing millions of leaked passwords against bank and email accounts right now, and they cost crooks next to nothing to run. You don’t need to panic, buy fancy software, or empty your bank account. You just need less than an hour to make your online information more secure. Start by locking down your email, then your bank, with a fresh three-word password and two-step verification. Next, freeze your credit for free at Equifax, Experian, and TransUnion. Unplug any gadgets you don’t use, and only update devices through Settings, never a pop-up. Set a family scam rule and a safe word so nobody gets talked into handing over a code or cash. Finally, check your home buffer: a few days of cash in small bills, food, and prescriptions.
Spend ten minutes online during any big wave of cyberattacks and you’ll see headlines warning that “The Internet Is Under Attack.” Between bots probing websites, outages disrupting pharmacy counters and grocery deliveries at Stop & Shop, and rumors about bank hackers, any sensible person might feel tempted to unplug the router and hide all their savings under a mattress.
Before you do anything, take a breath. Hurricane in the Gulf, ice storm in the forecast, or scary cyberattack headlines, my rule never changes: prepare more, panic less. And for something like this current cybersecurity event, that’s what you’re going to do.
In fact, one of these exact traps landed in my own inbox recently. I got an email from a real, legitimate Texas nonprofit saying I had been awarded a grant I never applied for, with a PDF attached and a button inside to fill out a form to claim the money. Everything about the email felt both odd and real at the same time. When I asked ChatGPT to review the message and check the sender, it pointed out wording details that looked sketchy, yet confirmed the Texas nonprofit and email address were 100% genuine.
Bots had likely hijacked the nonprofit’s older, un-updated website, so the sender looked genuine. Instead of downloading the PDF or clicking the button inside, I previewed it on screen, right-clicked the button to copy the link address, and pasted it into ChatGPT. Within seconds, it confirmed the link went to a completely unrelated, sketchy website.
If I had been in a hurry, or if that email had landed in the inbox of someone too busy or unaware of email fraud, one click could have handed a hacker the keys to everything. And right now, if reports are to be believed, this is happening on an unprecedented scale.
Here’s what makes a cyberattack so sneaky: everything looks normal.
When an ice storm knocks out the power, you know what’s happening. The house goes dark, it’s eerily quiet, and you’re looking for flashlights. During a cyberattack, the kitchen lights stay on, your phone still rings, and you’re reading this article.
Everything seems perfectly normal, right up until someone clicks a link, or reads that 6-digit login code out loud to a friendly “bank rep” who isn’t from the bank at all.
Some of the links in this post may contain affiliate links for your convenience. As an Amazon Associate, I may earn a small commission from qualifying purchases without any increase in price to you.
Why “Too Boring to Hack” Stopped Working This Year
For decades, ordinary families like yours and mine had an invisible shield online. We were too boring to hack.
A human crook wasn’t going to spend an afternoon breaking into a regular family’s email account and read about plans for Thanksgiving, but that has changed. Today’s crooks let cheap AI bots do the work, like an invisible thief walking down every street in America at once, jiggling millions of door handles a minute to see which ones are unlocked.
Just a few recent examples:
- A flaw in the software behind more than 70% of all websites on the internet (including mine, again!) was discovered, and within hours, automated AI bots were hammering millions of websites to break in (which is almost certainly how that Texas nonprofit’s website got hijacked before emailing me).
- Major U.S. banks, including JPMorgan Chase, Bank of America, and Wells Fargo, are scrambling to block AI “assistants” from customer accounts. Customers handed these AI helpers their own bank passwords, and some of the bots started doing things nobody asked for, like calling the bank on their own. Here’s the scary part. If you hand over your password and something goes wrong, the bank may treat it as if you did it.
- Ransomware attacks jumped 41% in a single month, and Cloudflare has had to fight off record-shattering waves of automated traffic (over 128,000 attacks a day).
- One security researcher who set up a single blank test computer online watched automated AI bots try to break into it 14,000 times in six hours, with almost zero humans at the keyboard.
Those bots never sleep and don’t care if your checking account holds $400 or $400,000. They take email addresses and passwords leaked years ago from store or airline breaches and test them across hundreds of banks and email accounts at once.
Fortunately, automated bots are lazy. They’re after easy access, and the moment they hit a fresh three-word password, a two-step login code, or a frozen credit file, they move on to the next sucker. That laziness works in our favor, so let’s put a few locks on the doors.
Your 30-Minute Family Cyber Lockdown (Step by Step)
NOTE: If any of these seems complicated or overwhelming, take it one small step at a time.
Step 1: Lock Down Your ‘Skeleton Key’ First: Your Primary Email (Then Your Bank).
Most of us rush to change the bank password first. Start with your email instead, because whoever owns your inbox can get into nearly everything else.
Before going to your bank account settings, instead, start with your primary email account (Gmail, Yahoo, Outlook, or iCloud Mail).
Think about it. Every “Forgot Password” reset link for your bank, mortgage, or Amazon goes straight to your email. If a thief gets into your inbox first, they can reset your bank password and delete the warning emails while you sleep. So right now, spend ten minutes doing two simple things on your email and bank:
- Give your primary email (and your bank) a brand-new 3-word password you haven’t used anywhere else. Automated bots already know old leaked passwords and know exactly what to test in order to break into accounts. Instead, combine three random everyday words plus a number and symbol, like
BlueCoffeePorch42!It is easy to picture and type, practically impossible for a computer to guess, and safe to write on paper in your home binder. Turns out having a record of passwords in a simple logbook isn’t such a bad idea, after all. Because that logbook or binder now holds the keys to your credit, keep it in a small fireproof box like this SentrySafe, and the Step 5 cash buffer fits in there, too. - Turn on Two-Factor Authentication (2FA), and skip SMS text codes whenever a Passkey or Authenticator App is offered. Any 2FA is miles safer than a password alone, and most non-tech people would be a lot safer just by never approving a login code they didn’t ask for. Better yet, whenever an account, especially your primary email, gives you a choice, do not use SMS text-message codes (which thieves can intercept if they hijack your cell number). Instead:
- Best choice (easiest): Turn on a Passkey if your phone or email offers it. This is just using your face, fingerprint, or normal phone unlock code instead of typing a password or waiting on a text.
- Want to go one step further on your email security? Along with all the dire cyberattack warnings, I also read numerous recommendations for the YubiKey. It works like a real house key for your account. You plug it in or tap it on your phone, and a scammer anywhere in the world can’t get in without it. I recommend buying two, and keeping one in your safe or a safe deposit box. If you lose the only one you have, getting back into your accounts can be a real headache.
- Second-best choice: Use a free Authenticator App (like Google Authenticator, Microsoft Authenticator, or the built-in Passwords app on your iPhone), which generates the 6-digit code right on your phone screen so it never travels in a text message.
- If your bank only offers SMS text codes: Keep text codes turned on (never leave a bank account with just a password!), and follow one rule — never read a texted code out loud to anyone on the phone, even if caller ID says it’s your bank.
Two quick phone security checks: Open the Passwords app on an iPhone/iPad (Security Recommendations) or Settings → Password Manager → Password Checkup on Android to replace saved passwords leaked in old breaches. Also, never type bank logins into third-party “money-saving” apps, and turn on your phone’s theft lock using my guide on what to do if your phone is stolen.
Step 2: Put a Free Deadbolt on Your Identity (3-Bureau Credit Freeze)
Skip the $20-a-month “credit monitoring” commercials. Paying for credit monitoring while your credit file sits wide open is like paying someone to text you after a burglar has walked out your back door with the silverware.
A free Credit Freeze (or Security Freeze) is the real deadbolt, and it’s easy to set up. When you freeze your credit at Equifax, Experian, and TransUnion, lenders cannot pull your report to open new accounts, so even if a thief has your Social Security number, any new loan or card application in your name is blocked.
Credit bureau websites might try to lure you into purchasing one of their security products, but keep this in mind:
- 100% free by federal law: As the Federal Trade Commission (FTC) confirms, placing, temporarily lifting, and removing a credit freeze is free at all three bureaus for you, your spouse, and your kids under 16.
- Skip the paid “Credit Lock” pitch. Bureau websites often steer you toward a paid monthly subscription called a “Credit Lock” or “Lock & Alert.” Skip the paid “Lock” and choose the free Security Freeze.
- Zero impact on your credit score or current cards. Freezing your credit never lowers your score, and your existing cards and mortgage keep working normally. You only log in or call to temporarily lift your freeze for a day or two when applying for new credit yourself.
Freeze all three bureaus online or by phone in ten minutes using these official links and toll-free numbers:
| Credit Bureau | Direct Free Security Freeze Page | Toll-Free Freeze Phone Line |
|---|---|---|
| Equifax | equifax.com/personal/credit-report-services/credit-freeze/ | 1-888-298-0045 |
| Experian | experian.com/help/credit-freeze/ | 1-888-397-3742 |
| TransUnion | transunion.com/credit-freeze | 1-800-916-8800 |
Survival Mom tip: Keep your bureau passwords or confirmation numbers on paper in your Grab-and-Go Binder so you can lift your freeze whenever needed, and help kids, parents and elderly friends freeze their credit, too.
Step 3: Simple Home Wi-Fi & Device Habits
Beyond your phone and computer, most homes have Smart TVs, streaming sticks, robot vacuums, indoor cameras, and smart plugs on Wi-Fi. Phones and computers get regular updates, but an $8 smart plug or older Smart TV often stops getting safety updates after a year or two, making it an easy window for bots.
Start with low-tech wins that take just a few minutes:
- Unplug any smart speaker, camera, or gadget you don’t actually use. If an old indoor camera, voice speaker, or Wi-Fi gadget is plugged into an outlet and nobody uses it anymore, unplug it. A gadget with no power cannot be hacked.
- Only install updates from your phone or computer’s regular Settings menu, never by clicking an “Update Now!” pop-up window on a website. Criminals flood websites with urgent pop-ups claiming “Your computer or browser is infected or out of date! Click here to update now!” Never click an update button inside a website pop-up or email. Close the window and check your device’s real Settings menu (Settings → General → Software Update on iPhone, iPad, or Mac; Settings → System → Software Update on Android; or Settings → Windows Update on a PC).
- Put your Smart TV and gadgets on “Guest Wi-Fi” (or make it a 5-minute job for a tech-savvy relative!): As the U.S. Cybersecurity and Infrastructure Security Agency (CISA) recommends, putting your Smart TV, cameras, and smart plugs on Guest Wi-Fi fences them into their own separate area, away from the phone or laptop you use for banking. Guest Wi-Fi is usually a simple on/off toggle right inside the same phone app where you pay your internet bill (like Xfinity, Spectrum, or AT&T). If Wi-Fi menus make your eyes glaze over, write “Put Smart TV and gadgets on Guest Wi-Fi” on a sticky note as a 5-minute job to hand your tech-savvy spouse, adult child, or grandkid the next time they come over.
- Delete Old Apps & Saved Cards Instead of Just Signing Out. Signing out of a shopping, restaurant, or travel app helps if someone snatches your unlocked phone out of your hand, but deleting the app completely (and deleting any saved credit card inside the app before you remove it) is better. Even when you are signed out on your phone, an old retail or fast-food account with a saved card is still on that company’s servers, vulnerable to the next data breach, and many apps quietly track your location or run in the background until you uninstall them.
Step 4: Set the 2-Sentence Family Bank-Scam Rule (Plus a Family Safe Word)
Once your email, two-step verification, and credit freeze are set, bots usually can’t break into your bank on their own, so scammers try to trick you into opening the door.
Using leaked data and cheap caller-ID spoofing, a scammer already knows your address and bank name, and can make your phone screen say Chase Fraud Dept or Wells Fargo Security.
The family version is simple. If a text makes you panic and hands you a link to click, it’s a scam until you call them back on a number you already had. Share these two household rules with your spouse, kids, and aging parents:
- Rule #1 (The Bank-Code & Hang-Up Rule): No real bank, credit union, government office, or tech company will ever call or text you and ask you to read back a 6-digit code, tap “Approve” on a login alert you didn’t start, share a password, or move money to a “safe” account. If anyone calls claiming fraud on your account, don’t respond. Hang up immediately, and dial the number on the back of your credit or debit card. Check with that official source before taking any action.
- Rule #2 (The Family Safe Word for AI Voice Scams): As the FTC warns in its alert on fake emergency scams, scammers need only a few seconds of audio from voicemail or social media to imitate a loved one’s voice, calling a parent or grandparent crying for bail or crash money via wire, Zelle, or gift cards. Pick a simple Family Safe Word that is nowhere on social media, like a pet’s nickname from decades ago, and require it before acting on any emergency call asking for money.
Our family has a safe sentence that always makes us laugh and is so ridiculous no one would ever guess.
If you’d like to understand how these crooks actually think, former FBI agent Eric O’Neill’s book, Spies, Lies, and Cybercrime reads like a page-turning spy story but you’ll learn simple security habits the whole family can use.
My 3-Step “Don’t Click, Inspect” Trick for Suspicious Emails & PDFs. As I saw with that Texas nonprofit grant email, bots that compromise an outdated charity or business website can send trap buttons inside PDF attachments from a real email address. Whenever an email looks real but offers unexpected money or demands urgent action:
- Pause on surprise money or panic. If you never applied for the grant or ordered the item, stop—even when the sender’s name and address are real.
- Preview or screenshot. Never download or click. View the attachment on your screen without downloading it, and never click a button inside an unexpected PDF.
- Right-click and ask ChatGPT or another AI. Hover over the button, right-click (don’t left-click!), click “Copy Link Address,” and paste the URL into ChatGPT to see if it goes to a sketchy site.
See my guide on how to avoid scams and fraud in the aftermath of disasters for more examples, and write your safe word on your Family Emergency Communication Plan.
Step 5: Check Your 3-to-5-Day Home Cash Buffer
Whenever a scary cyber headline trends, someone shouts: “Pull all your money out of the bank today!” Do not empty your bank account in a panic. Pulling your savings out of an insured bank or credit union might strip away your strongest protections.
- FDIC & NCUA insurance plus federal banking protections: Money in an FDIC-insured bank (or NCUA-insured credit union) is federally insured up to $250,000 per depositor, per insured bank, for each account ownership category. Even better, federal banking laws protect you when a hacker steals from your account, as long as you report unauthorized charges promptly. Money you willingly wire or send yourself is much harder to get back.
- What happens if you pull your cash out or send it yourself? Once you withdraw your savings in cash, or let a scammer talk you into wiring money, sending Zelle, or buying gold bars to “keep it safe”, cash at home isn’t insured against fires, storms, or theft.
Instead of emptying the bank, keep a sensible 3-to-5-Day At-Home Buffer of cash. As shoppers saw when outages hit Stop & Shop, Hannaford, and Food Lion, a cyber incident can knock local card readers, ATMs, or pharmacy computers offline for a few days. A few tips for that cash on hand:
- 3 to 5 days of emergency cash in small bills. Keep enough cash at home to cover gas and groceries for a few days. When registers are down, cashiers often cannot make change for
$50or$100bills. - 1 to 2 weeks of familiar pantry staples. If you’ve been reading my blog for more than a few weeks, you know all about this one! Two weeks or more of everyday meals lets you stay comfortably home while everyone else rushes to the store.
- A 7-day cushion on critical prescriptions. Refill critical daily medications a few days early each month until you have a one-week buffer.
Keep my guides on how to prepare for an internet outage and how to survive a power outage handy alongside your binder.
Get the Free Printable 30-Minute Family Digital Lockdown Card
Frequently Asked Questions
No. Emptying your bank account in a panic is one of the riskiest moves you can make. Deposits at FDIC-insured banks and NCUA-insured credit unions are federally insured up to $250,000 per depositor, per institution, per ownership category, so your money is safe even if the bank itself goes under. If a hacker drains your account, a federal law called Regulation E limits how much you can lose, but only if you report it fast. Speak up within two business days and you’re on the hook for $50, tops. Wait too long and you could lose it all. Money you willingly wire or send yourself is a different story, and it’s much harder to get back. And that stash of cash at home? Most homeowners policies cover only about $200 of it if there’s a fire or a break-in. Keep your savings in the bank, and keep enough cash at home to cover 3 to 5 days of essentials, in small bills ($1s, $5s, $10s, and $20s).
A credit freeze (or security freeze) is a free federal right that stops lenders from pulling your credit report to open new loans or cards in your name. A “credit lock” is a marketing name credit bureaus attach to paid monthly memberships. Always choose the free Security Freeze at Equifax, Experian, and TransUnion. Freezing your credit never hurts your credit score, doesn’t affect current cards or your mortgage, and can be lifted temporarily online or by phone for free.
Cheap smart plugs, indoor cameras, robot vacuums, and older Smart TVs often stop getting safety updates a year or two after you buy them, making them an easy target for automated bots scanning home Wi-Fi. Unplugging gadgets you don’t use removes the risk completely, and having a tech-savvy relative move your Smart TV and gadgets onto your internet app’s Guest Wi-Fi fences them off from the phone or computer you use for banking.
Follow two household rules that require zero technical skill. First, never approve a login code or read back a 6-digit text code you didn’t ask for. If anyone calls claiming fraud on your bank account, hang up, even if caller ID shows your bank’s name, and dial the number on the back of your bank card. Second, pick an offline Family Safe Word that is nowhere on social media, and require it before acting on any emergency call asking for money.
The Final Word
The bots are here to stay, and so are we. A mom with a fresh password, a frozen credit file, and a family safe word is a lousy target. You don’t even have to do all 30 minutes at once: update your email password and two-step verification over your morning coffee, freeze your credit files tonight while the TV is on, and pick your Family Safe Word at dinner.
Great info! Took a few minutes to make sure we took care of anything on this list we hadn’t gotten around to!
Kathy from Bunkerise here. I appreciate that you end the cyber lockdown with a home buffer of cash in small bills, food and prescriptions. Pharmacy and grocery outages show how quickly a digital problem becomes a household one. The family safe word idea is one we are adding to our own plan, since it costs nothing and protects relatives who answer unknown calls.