The Lock Most Guys Leave Wide Open

A friend of mine got a call from his bank in March. Someone had tried to wire $14,000 out of his account. The bank caught it. But it took three weeks to sort out, and during those three weeks, he couldn’t access his own money.

How did it happen? His email password was the same one he used for a cooking website that got hacked two years earlier. The thieves got in through the email, found his bank statements, and went to work.

One reused password. $14,000.

That weekend, I sat down and did something I’d been putting off for years. I locked every door I’d left open online. It took one afternoon. Here’s what I did.

You have the same password on multiple sites. Maybe the same three or four passwords for everything. You know you shouldn’t. But remembering fifty different passwords is impossible, so you reuse them.

You’re not alone. A study of 19 billion leaked passwords found that 94% were reused. That means when one site gets breached, the thieves try those same passwords on your email, your bank, your brokerage, and your credit cards. It’s like losing one key that opens every lock in your house.

The FBI reported that adults over 60 lost $4.8 billion to fraud in 2025. Identity theft losses for that group jumped 70% in a single year. The most common way in? Stolen passwords and phishing emails.

You’d never use the same key for your house, your car, and your office. But that’s exactly what most of us do online.

A password manager is a vault on your phone and computer that creates, stores, and fills in passwords for every site you use. You remember one master password. The vault handles the rest.

It sounds complicated. It isn’t. You download an app. You set a master password. Then, every time you log in somewhere, the app fills in a long, random password that’s different for every site. You never type it. You never see it. You never need to remember it.

The good ones cost about $3 to $5 a month. Some have free versions that work fine for one person. I won’t tell you which brand to pick—there are half a dozen solid ones. Search “best password manager” and read two reviews. Pick the one that looks simplest. They all do the same basic job.

The setup takes about an hour. As you log into sites over the next week or two, the manager captures each password and replaces it with a strong one. Within a month, every account has its own unique key.

Two-factor authentication. You’ve seen it—you log in and the site sends a code to your phone. You type the code and you’re in. That second step means a thief can’t get into your account even if they have your password. They’d need your phone too.

Turn it on for these accounts first, in this order:

▸ Your email. This is the master key. If a thief controls your email, they can reset every other password you have. Lock this first.
▸ Your bank and brokerage. Where the money lives. Most financial sites offer two-factor. Turn it on.
▸ Your Social Security account. If you have an online account at ssa.gov, lock it down. If you don’t have one, create one. Otherwise someone else can create one in your name.

This takes about 20 minutes for all three. Go to the security settings in each account. It’ll walk you through it.

While you’re at it, pull your credit card or bank statement from last month. Look for subscriptions you forgot about. Trial periods that turned into charges. Apps you haven’t opened in a year.

Every subscription is a site with your payment info. Every site is a door. The fewer doors, the less there is to protect. Cancel what you don’t use. You’ll save money and shrink your attack surface at the same time.

He got his money back. The bank made it right. But those three weeks were miserable. He couldn’t pay bills. He spent hours on the phone with fraud departments. His wife couldn’t access their joint accounts. All because a cooking website got hacked and he’d used the same password somewhere that mattered.

He set up a password manager the week after it was over. Took him two hours.

He told me, “I wish I’d done it the week before.”

This isn’t hard. It isn’t expensive. It’s one afternoon that stands between you and the kind of phone call you don’t want to get.

Lock the doors. All of them.

— Walter