Course Catalog / BMU 050 / Lesson 3 of 5
BMU 050
Lesson 3: Lock it down (passphrases and two step login)
Halfway review
1. What are the three sorting piles?
See the answer
Scam, check first, and likely safe.
2. A surprise text has a link to fix your account. What do you do?
See the answer
Skip the link. Log in the usual way or call a number you found yourself.
3. Which sign is a request for gift cards?
See the answer
Sign 4: they tell you to pay in a certain way.
Why this matters
Some scams try to get into your accounts, not your wallet. If someone gets into your email, they can reset your other passwords. Two tools stop most of this: a strong passphrase and two step login.
Start with what you already do
You already use two locks. Many people lock the door and also the screen door or the car and the steering wheel.
Common belief: A short password with a number at the end is strong enough.
What is actually true: CISA, the U.S. cyber safety agency, says strong passwords are long, random, and unique. It says at least 16 characters. Two step login adds a second lock.
In this lesson you will
- Make a passphrase of 4 to 7 random words
- Explain why each account needs its own password
- Turn on two step login for your email
- Explain why you never share a login code
Key words
- passphrase
- A password made of several random words.
- two step login
- A second check after your password, like a code sent to your phone. Also called two factor or multifactor authentication (MFA).
- login code
- A short number sent to you to prove it is you.
- password manager
- An app that makes and saves strong passwords for you.
Short explanation
Use a long passphrase. Use a different one for each important account. Then turn on two step login, starting with your email.
Make a passphrase
CISA gives three rules. Make it long: at least 16 characters. Make it random: 4 to 7 words that do not go together. Make it unique: a different one for each account. A made up example is Horse Purple Hat Run Bay. Do not use that one. Do not use names, birthdays, or pet names. People can guess those.
Text version of this figure
- Long. At least 16 characters.
- Random. 4 to 7 words that do not go together.
- Unique. A different one for each account.
- Made up example: Horse Purple Hat Run Bay. Do not use it.
- 1. Settings
- 2. Security
- 3. Turn on two step: Then save backup codes at home.
- Never share a login code. No real company will ask for it.
Keep them safe
It is hard to remember many passphrases. CISA suggests a password manager. Your phone or web browser may have one built in for free. If you write passphrases down, keep the paper at home in a safe place, not in your wallet.
Turn on two step login
CISA explains the steps. Every app looks a little different.
- Open the app or site and go to Settings.
- Find Security or Sign in and security.
- Turn on two step, two factor, or MFA.
- Pick how to get codes: a text, or an authenticator app. The FTC says an app is stronger, but a text code is still much better than nothing.
- Save the backup codes on paper at home.
Start with your email. Then do your bank and your social media.
Keep your software updated
CISA lists updates as one of its four core steps, next to strong passwords, two step login, and spotting phishing. Updates fix holes that scammers use. Turn on automatic updates for your phone, computer, and apps. When your phone asks to update, do it soon, on your home WiFi. Only update from the settings menu or the official app store, never from a pop up or a link in a message.
Never share a login code
A login code is a key. Your bank, your phone company, and the government will not call to ask for it. If someone asks for a code, it is a scam.
Worked example: Fix weak passwords
This is a made up person named Ray. Ray's passwords are made up.
| Part | Model | Why it works |
|---|---|---|
| Old: Ray1975. New: four random words, 20 characters | Long and random. No name or birth year. | |
| Bank | Old: same as email. New: its own passphrase | Unique. One leak does not open both. |
| Email two step | Turned on, codes by app, backup codes on paper | A stolen password is not enough now. |
| Phone call asking for a code | Ray hangs up | No real company asks for your code. |
Practice: Spot the weak one
Which of these made up passwords is strongest, and why? (1) Tasha2010 (2) river lamp cookie north glove (3) Password123!
Check your practice: feedback
(2) is strongest. It is five random words and over 16 characters.
(1) uses a name and a year that people can guess. (3) is one of the most common passwords, even with the symbol.
Common mistakes
- Using the same password everywhere. One leak then opens every account. Give each important account its own.
- Skipping two step login on email. Email resets your other passwords. Lock it first.
- Reading a code to a caller. Hang up. No real company asks for it.
Try it: Lock one account today
Pick your scenario:
- Your email account
- Your bank or payment app
- Your social media account
- Pick your email account.
- Make a new passphrase of 4 to 7 random words. Do not write it in this course.
- Change your email password to it.
- Turn on two step login in Settings and Security.
- Save the backup codes on paper at home.
- Next week, do the same for one more account.
Do it by: today
Reflect
Which account would hurt most if someone got into it? Lock that one next.
Check your understanding
1. Which is the strongest made up password?
- Max2019!
- table moon shovel violet
- Password1
See the answer and feedback
B is correct. Right. Four random words make it long and hard to guess.
A: A pet name and a year are easy to guess. Review Make a passphrase.
C: This is a very common password. Review Make a passphrase.
2. Why turn on two step login for email first?
- Email is used to reset your other passwords.
- Email is the only account scammers want.
- It makes your email load faster.
See the answer and feedback
A is correct. Right. Whoever controls your email can reset the rest.
B: Scammers want many accounts. Review Turn on two step login.
C: It is about safety, not speed. Review Turn on two step login.
3. A caller from "your phone company" asks you to read back the code they just texted you. What should you do?
- Read it, since they sent it.
- Read only the first half.
- Hang up, since no real company asks for it.
See the answer and feedback
C is correct. Right. A login code is a key. Keep it to yourself.
A: Sharing the code lets them into your account. Review Never share a login code.
B: Any part of the code is too much. Review Never share a login code.
Takeaway: lock it down
- Passphrase: 4 to 7 random words, 16 or more characters
- A different one for each important account
- Two step login on email first
- Backup codes on paper at home
- Never share a login code
Recap
- Long, random, and unique passwords.
- A password manager can help.
- Two step login adds a second lock.
- Never share a login code.
You now have: a stronger email account with two step login turned on.
Next up
Next you will learn the scams that target families, job seekers, and older adults. Go to Lesson 4: Scams that target families, job seekers, and older adults. BMU 050 is free. There is no paywall and no fee.
Sources
- CISA: Use strong passwords (long, random, unique; passphrase of 4 to 7 unrelated words; archived page, still posted) (current as of Oct 29, 2026)
- CISA: Turn on MFA (archived page, still posted) (current as of Oct 29, 2026)
- FTC Consumer Advice: Use two factor authentication to protect your accounts (current as of Oct 29, 2026)
- CISA: Secure Our World (four core steps: avoid and report phishing, strong passwords, multifactor authentication and a password manager, update software) (current as of Oct 29, 2026)
