10 Things Making You Easy to Hack (and How to Fix Each One)

Most people don’t get hacked by some hoodie-wearing genius pounding on a keyboard in a dark basement.

They get hacked because they reused the same password twelve times, clicked a link that practically screamed SCAM, and approved a security prompt without reading a single word.

And before you say “I’d never fall for that” — almost everybody who falls for it said exactly the same thing.

Prefer to watch instead of read? Here’s the full walkthrough — or skip it and keep reading below.

1. Reusing the Same Password Everywhere

You use one password for email, your Microsoft account, your bank, Amazon, and a wallpaper site you joined in 2017. Then that forgotten site gets breached, and your email and password land on a criminal’s list.

Nobody has to crack anything. A computer simply tries that combination on hundreds of other sites. It doesn’t get tired and it doesn’t stop for lunch. That’s called credential stuffing, and it’s almost entirely automated.

Fix: a unique password for every important account, stored in a password manager. One leaked password should cost you one account — not all of them.

2. Protecting Your Email With Only a Password

Your email isn’t just email. It’s the reset button for your bank, your Microsoft account, and your shopping accounts. Whoever owns your inbox can start collecting the rest.

Fix: turn on two-step verification (also called 2FA or MFA) on your email first, then everything else that matters. An authenticator app or a physical security key is stronger than text-message codes — but text codes still beat nothing.

3. Ignoring the Router That Runs Your Whole House

Plenty of people haven’t logged into their router since the technician installed it.

Fix: change the router’s admin password, update its firmware, confirm WPA2 or WPA3, and put smart gadgets on a guest network. Step by step: Lock Down Your Home Wi-Fi and Router.

4. Believing Caller ID

Caller ID isn’t identification. It’s a label, and criminals can make it say almost anything — including your bank’s name.

Fix: if someone calls about “fraud on your account,” hang up and call the number on the back of your card or on the company’s official website yourself. Nobody legitimate needs gift cards, the security code that just appeared on your phone, or remote access to your PC. If a stranger calls and asks to remote into your computer, the answer is no. Not maybe. No.

5. Letting a Random Message Choose Where You Log In

Your package couldn’t be delivered. There was an unusual sign-in. Your account closes in 24 hours. There’s always a crisis, because urgency stops you from thinking.

Fix: never sign in through a link in an unexpected message. Open the official app, use your own bookmark, or type the address yourself. And check the sender’s actual email address, not just the friendly name. Scammers have logos too. Copying Microsoft’s colors isn’t exactly an advanced technical achievement.

6. Using an Administrator Account for Everything

The first Windows account is usually an administrator, and most people use it forever. When everyday browsing happens in an admin account, handing a program full control can take one distracted click on Yes.

Fix: create a standard account for daily use (Settings → Accounts → Other users) and keep a separate admin account for installs and changes. The extra password prompt might be the moment you stop and ask why a PDF reader suddenly wants control of the whole computer.

7. Disabling Security Because Something Told You To

An installer says to turn off your antivirus. A forum says SmartScreen is annoying. A “technician” on the phone wants the firewall off for just a minute.

Fix: leave Windows Security, SmartScreen, and the firewall on. If a legitimate program gets flagged, verify the publisher and the download source before making an exception. Don’t rip the smoke detector off the ceiling because it’s beeping. Find out what’s burning first. (More layers here: How to Harden Windows Without Going Overboard.)

8. Leaving Your Phone Wide Open

Your phone holds your email, bank apps, photos, and the codes that approve logins everywhere else — often protected by 1-2-3-4.

Fix: use at least a six-digit passcode (longer is better), turn on Find My Device or Find My iPhone, and hide message previews on the lock screen so verification codes aren’t visible to whoever picks it up. Then set an account PIN with your mobile carrier and turn on a number lock or port-out protection if they offer one. If a criminal moves your number to their SIM, every text code goes to them.

9. Calling It a Backup When It’s Always Plugged In

If your backup drive stays connected all the time, ransomware can encrypt it right alongside your original files.

Fix: keep at least one copy disconnected or somewhere else entirely — an unplugged drive, another location, or a cloud backup service that keeps old versions. Then restore a few files to prove it works. A backup you’ve never restored from isn’t a backup. It’s a wish.

10. Having No Plan for When Something Goes Wrong

Eventually something happens: a password leaks, a card gets skimmed, an account gets taken over. The people who recover quickly aren’t luckier. They know the first moves.

Fix — if an account is compromised:

1. Work from a device you know is clean.
2. Secure your email first: change the password, sign out other sessions, remove devices you don’t recognize, and check the recovery email and phone.
3. Look for forwarding settings and inbox rules you didn’t create — attackers use them to hide password-reset and bank emails.
4. Change the password anywhere it was reused, and turn on two-step verification.
5. Call your bank at a number you know is real if money or card details may be involved.
6. In the US, freeze your credit with all three credit bureaus if your identity information was exposed. It’s free.

The Short Version

1. Unique passwords, in a password manager.
2. Two-step verification on your email first.
3. Lock down your router.
4. Don’t trust caller ID — call back yourself.
5. Never sign in through a link in an unexpected message.
6. Use a standard account day to day.
7. Don’t disable security because something told you to.
8. Lock your phone and your carrier account.
9. Keep one backup disconnected, and test it.
10. Know your first moves before something goes wrong.

Do the boring work now — or do the miserable cleanup later.

Stay grumpy.