Passwords and two-step verification for kids' accounts

Kids lose game accounts, social media accounts and school accounts every day, usually because a friend learned the password, a scam site stole it, or the same password was used everywhere. A few habits fix most of this.

Passphrases, not passwords

Long beats complicated. Teach your child to make a passphrase from three or four random words, for example "mango-jeepney-violet-rain". It's easy to remember, hard to guess, and much stronger than "Juan2014!".

Avoid:

• Names, birthdays, pet names and favourite players
• The name of the game or app
• Words that follow each other naturally, like "ilovemymom"

One account, one password

If a game site is hacked and your child uses the same password for their email, the attacker now has both. Each important account needs its own password.

For younger children, keep a written list in a safe place at home. For teenagers, a password manager is the best tool: it remembers every password and fills them in. Most phones have one built in (Google Password Manager on Android, Passwords on iPhone).

Passwords are not for sharing

Even best friends fall out. A friend who knows a password can post as your child, delete their account or read their messages. Teach your child: passwords are shared only with parents.

Turn on two-step verification

Two-step verification (also called 2FA or two-factor authentication) means that even someone with the password needs a second code to log in. Turn it on for:

• Email (the most important: it can reset every other account)
• Roblox, Mobile Legends (through the linked account), Fortnite, Minecraft and other game accounts
• Social media
• Any account with saved payment details

Authenticator apps or built-in phone prompts are safer than SMS codes, but any 2FA is far better than none.

Don't lock yourself out

• Use an email address you can access for recovery on younger children's accounts.
• Save backup codes somewhere safe.
• Write down which accounts your child has.

Codes and OTPs

Teach this rule clearly: never share a verification code or OTP with anyone, even someone who says they're from the company. Real support teams never ask for them. This one rule stops most account takeovers and e-wallet scams. See scams that target kids.

If an account is stolen

1. Use the "forgot password" option immediately.
2. Secure the email account first if it was also taken.
3. Contact the game or app's official support. Never use "recovery services" found on Facebook.
4. Warn friends that messages from the account may be fake.
5. Change passwords on any account that used the same password.