Digital and information self-defence

The parent page is short and every line of it is correct. This is the layer underneath, starting with the thing that is not on the list and should be at the top of it.

The email account is the master key

Almost every account you own can be reset through your email, and that includes the bank, the utilities, the council and the government services. So the email account is not one account among many. It is the key to all of them, and it deserves protection accordingly.

Which means, in order:

1. A long unique password for email, not reused anywhere. This is the single most valuable password in your life.
2. Two-factor on email, before anything else gets it.
3. Printed recovery codes, in the document pouch, on paper. Not in the password manager, because the failure you are protecting against is losing access to the device the password manager is on.
4. Recovery phone number and recovery email kept current. These go stale silently, and a recovery route pointing at an old number is no recovery route.
5. Know what would happen if the phone were gone. Walk through it once, on paper, and fix whatever turns out to be circular.

The circularity is the thing to hunt for. The password manager is on the phone, the two-factor is on the phone, and the recovery code is in the password manager. That is one lost handset away from locking yourself out of everything you own, and it is the normal arrangement rather than an unusual one.

The code word, and how people get it wrong

The parent page's family code word against a distressed voice on the phone is a good measure, and it fails in three predictable ways.

• It is guessable, or it is public. A pet's name, a street, a school, a child's nickname. All of those are on social media, in a caption, or in a comment. Pick something arbitrary that appears nowhere.
• Nobody can remember it under stress. It has to be memorable enough to recall while frightened, which argues for something absurd rather than something clever.
• It was never actually shared with the people who need it. Grandparents especially, who are the most likely target of the call and the least likely to have been told.

Say it out loud together, once, and never write it in a message. Then practise the response, which is the part that matters: hang up, and ring the person back on the number you already have.

The pattern to teach, which works even with no code word: urgency, secrecy, and an unusual way to pay. Any two of those three means stop. A genuine emergency call from a relative survives being rung back two minutes later; a scam does not.

And the parent's other half applies to institutions too. Banks, the police and government departments do not ring and ask for passwords, codes or transfers. Hang up, wait a few minutes or use a different phone, and ring a number you found yourself.

Two-factor that survives the network

Text-message two-factor stops working in exactly the scenario this app is about, because it depends on the mobile network, and the network is what fades in a long power failure.

So the arrangement that works is an authenticator app for daily use and printed recovery codes for the disaster case. The paper is what makes it recoverable, and it is the step everybody skips.

Print them for the accounts that matter, which is a shorter list than it sounds: email, bank, phone provider, and anything holding your documents. Put them with the passports.

Checking a story before you act on it

The parent page says verify alarming news before acting, and the practical method is worth spelling out because in an emergency you will have very little signal and very little battery.

• Go to the source, not the screenshot. A screenshot of an announcement is a picture of text and anybody can make one.
• Check whether the official account or the local radio is saying it. If the council, the water company or the emergency services have not said it, treat it as a rumour, especially when it is specific and alarming.
• Old footage is the standard failure. Dramatic images circulating during an incident are frequently from a different event, sometimes years earlier and in another country.
• Ask what the message wants you to do. Rumours that tell you to rush somewhere, buy something or move money are the ones that cause harm, and that is the pattern to distrust.
• The radio is the calibration. It is a one-way, edited, accountable channel, which is exactly what a rumour is not. This is why it is the first item on the comms page.

And do not forward it. A household that passes on an unverified alarm to the street group has become part of the problem, and the correction never travels as far as the original.

The phone as a liability

The parent page treats the phone as an asset, which it is. It is also the largest single concentration of risk most households carry.

• A lock screen with a real code, not a four-digit year, and biometrics on top for convenience rather than instead.
• Know how to wipe it remotely, and know that this requires you to be able to log in from something else, which brings you back to the email account.
• Turn off lock-screen previews for messages, so codes and personal detail do not appear to somebody holding it.
• Think about what it says about where you live. Location history, home address saved in maps, photographs with coordinates. Not paranoia: it is what a stolen unlocked phone hands over.
• Have the numbers on paper, as the parent page says. This is the item people find hardest to believe they need until the phone is dead, and then nobody can ring anybody.

The battery drill is worth practising once, so it is real rather than theoretical: aeroplane mode on, screen at minimum, everything closed. That turns a day of standby into several, because the dominant drain in poor coverage is the handset hunting for a signal it cannot find.