Course Catalog / BMU 010 / Lesson 1 of 5

New to BMU? Read Getting Started first. It takes about 3 minutes.

BMU 010

Warm up

1. Think of one thing you need email for, like a job, a bill, or your child's school.

See the answer

This course helps you do those things with less stress.

Why this matters

Jobs, landlords, schools, and doctors all use email. Your email is also the key to your other accounts. If someone gets into it, they can reset your other passwords.

CISA, the federal agency for cyber safety, gives three simple steps: use strong passwords, turn on a second login step, and keep your phone updated. You will do all three in this lesson.

Start with what you already do

You already lock your front door. A strong password is a lock for your email.

Common belief: A short password with my birthday is fine because no one cares about my email.

What is actually true: CISA says simple passwords and personal facts like birthdays and pet names are not safe. Scammers try them first.

Key words

passphrase

A password made of 4 to 7 random words strung together.

two step login

A second check after your password, like a code sent to your phone. CISA calls it MFA.

update

A fix from the maker of your phone or app. Many fix safety problems.

Step 1: A strong passphrase

CISA says strong passwords are long, random, and unique.

• Long: at least 16 characters.
• Random: one easy way is a passphrase of 4 to 7 words that do not go together.
• Unique: a different one for each account.
• A password manager app can make and store them for you.

Here is a made up sample: lamp river pickle seven. Do not use this one. Make your own.

Step 2: Two step login

CISA says a second login step, called multifactor authentication or MFA, makes you much safer. After your password, you also enter a code.

Look for it in your email account's security settings. It may be called 2 Step Verification or two factor.

Step 3: Updates on

CISA says many updates fix safety risks. Do not tap Remind me later. Turn on automatic updates in your phone's settings.

Text version of this figure

Lock your email. Three steps from CISA.

1. Step 1, Strong passphrase: 16 or more characters, random words, one per account.
2. Step 2, Two step login: A code by text, email, or app.
3. Step 3, Updates on: Turn on automatic updates.
4. Never share: No real company asks for your password or code.
5. Email you can trust: Ready for jobs, bills, and school.

Source: CISA Secure Our World (Oct 29, 2026).

Worked example: Rita locks her email

1. Rita's password was her dog's name and her birth year.
2. She makes a new passphrase of five random words and writes it in a safe place at home.
3. She opens her email security settings and turns on 2 Step Verification with a text code.
4. She turns on automatic updates on her phone.

Rita is a made up example.

Worked example 2: Ben fixes a reused password

Ben used Ben2024! for his email and his bank. It is short, it has his name, and it is the same on two accounts. CISA says each account needs its own long, random password.

He makes a new passphrase of five random words for his email, and a different one for his bank. He turns on two step login with an authenticator app. Then he adds a recovery phone number to his email. Google says recovery info helps you get back in if you forget your password or get locked out, and you cannot add it once you are locked out.

Two days later, a text says: Your account is locked. Reply with the code we just sent. Ben did not ask for a code, so he does not reply.

Ben is a made up example.

Practice: Strong or weak

Use the CISA rules: long (16 or more characters), random, and unique. Decide for each one.

1. Maria1985
2. pickle lantern hockey ocean, used only for email
3. lamp river pickle seven, copied from this lesson
4. A text asks you to reply with the login code you did not ask for.

Check your practice: feedback

1. Weak. Short, and it uses a name and a year.
2. Strong. Four random words, long, and used for one account.
3. Weak now. It is printed in a lesson, so anyone can see it. Make your own.
4. Do not reply. Never share a code. Real companies do not ask for it.

Common mistakes

• Using the same password everywhere. Use a different one for each account.
• Giving a login code to someone who calls you. Never share it. Hang up.
• Putting off updates. Turn on automatic updates.

Check your understanding

Take it as many times as you like. Pick an answer, then open the feedback.

1. Which password is strongest?

1. fish
2. Rex1990
3. cloud tiger spoon brick

See the answer and feedback

C is correct. Yes. It is long and uses random words.

A: Too short. Review Step 1.

B: Pet names and years are easy to guess. Review Step 1.

2. Someone calls and asks for the code your email just sent you. What do you do?

1. Do not share it
2. Read it if they know your name and address
3. Share it if they say they are from the company

See the answer and feedback

A is correct. Yes. Never share a login code.

B: Scammers often know your name and address. Never share a code. Review the figure.

C: Real companies do not ask for the code. Never share it. Review the figure.

3. Your phone says an update is ready. What does CISA suggest?

1. Wait until the phone starts to run slow
2. Install it
3. Turn off updates to save data

See the answer and feedback

B is correct. Yes. Many updates fix safety risks.

A: Updates fix security holes. CISA says to install them soon. Review Step 3.

C: Updates fix security holes. CISA says to install them, and you can use WiFi to save data. Review Step 3.

Next up

Next you will scan a paper page with your phone. Go to Lesson 2: Scan, save, and find your files.

Stuck or have a question? Ask BMU Learner Support.

Progress is saved on this device and browser only. To save a copy or move it to another device, turn on JavaScript and use Save my progress.