RickAI
Back to all resources
GuidesTool-agnostic

How to Stay Secure in the Age of AI: 9 Practical Steps

The full guide from my SAFE Reel: 9 practical steps to protect yourself from AI scams, voice cloning, phishing and data leaks, with exact setup instructions.

Your links

Why this matters now

AI made scams cheap, fast and convincing. A scammer can write a perfect phishing email in seconds, clone your voice from a few seconds of audio, and stitch leaked data together into a full profile of you: your email, address, phone number and the passwords you reused.

You don't need to become a security expert. These 9 steps close the biggest gaps. Most take 10 minutes, and you only do them once.

Start here: your first 30 minutes

If you only do a little today, do this, in this order:

  1. Check your email on Have I Been Pwned (2 minutes).
  2. Install a password manager and change the password of your main email account (10 minutes).
  3. Turn on an authenticator app for that email account and remove text message codes (5 minutes).
  4. Turn on automatic updates on your phone and computer (5 minutes).
  5. Pick a safe word with your family tonight (2 minutes).

Your email account is the master key: anyone who gets into it can reset every other password. Protect it first.

1. Use a password manager

Reusing a password means one leak opens all your accounts. A password manager makes a different strong password for every site and fills it in for you, so you only remember one.

Pick one:

  • Bitwarden: free, open source, syncs everywhere. The best default for most people.
  • 1Password: paid, very polished, great family sharing.
  • KeePassXC: free and local. Your vault is a file on your own computer, not on someone's server. Cloud password managers can get hacked too: in 2022, attackers stole encrypted customer vaults from LastPass. With a local manager there's no central server to steal from.

Set it up (Bitwarden as the example):

  1. Create an account at bitwarden.com.
  2. Choose a master password you'll never use anywhere else. Make it a passphrase of 4 or 5 random words, like . Write it on paper and keep it at home until you know it by heart.
  3. Turn on two-step login for Bitwarden itself (Settings → Security → Two-step login).
  4. Install the browser extension and the phone app, and turn on autofill on your phone.
  5. Import the passwords your browser saved. In Chrome: Settings → Autofill and passwords → Google Password Manager → Settings → Export passwords. Then follow Bitwarden's import guide. Delete the exported file afterwards, because it holds your passwords in plain text.
  6. Turn off password saving in your browser, so everything lives in one place.
  7. Change your most important passwords first, using the built-in generator (20+ characters): email, bank, Apple or Google account, phone carrier, and social media.

Going local with KeePassXC: install it from keepassxc.org, create a new database with a strong passphrase, and add the KeePassXC-Browser extension for autofill. On your phone, use a KeePass app like KeePassDX (Android) or KeePassium or Strongbox (iPhone). You sync the database file yourself, so back it up to a USB stick regularly. If you lose the file and the backup, your passwords are gone.

2. Pay online with single-use cards

When a shop gets hacked, your card number leaks with it. A single-use virtual card is worthless after one payment, so a leaked number can't be used again.

  • Revolut: in the app, go to Cards, tap + and add a Disposable virtual card. Its number changes after every payment. Which card types you get depends on your plan and country.
  • Privacy (US only): make a single-use card, or a card locked to one shop with a spending limit. Great for subscriptions, so a free trial can't quietly charge you more.

Use them for one-off purchases, new or unknown shops, and anything with a free trial. Keep your real card for the few places you fully trust.

3. Avoid PII

PII stands for Personally Identifiable Information: your full name, birth date, address, phone number. Every piece you share ends up in some database, and leaked databases get combined. The less that's out there, the less a scammer or an AI can piece together about you.

What to do:

  • Fix your email address. gives away your name and birth year. Use something neutral for new sign-ups, or better, aliases (tip 4).
  • Don't give your real address or phone number when you don't need to. Leave optional fields empty. Use a parcel locker or pickup point for deliveries where you can.
  • Don't post your birthday, address or kids' school on public profiles. Make old profiles private or delete them.
  • Clean up search results. Use Google's Results about you tool to ask Google to hide results showing your phone number, email or home address.

4. Use email aliases

An alias is a separate email address that forwards to your real inbox. Give every site its own. If one leaks or starts spamming you, you know exactly who leaked it, and you just switch that alias off.

iCloud Hide My Email (included with iCloud+):

  1. On iPhone: Settings → your name → iCloud → Hide My Email → Create New Address.
  2. Give it a label, like "Shopping - Zalando", and use it for that site.
  3. When you sign up with Sign in with Apple, choose Hide My Email and Apple makes one for you.
  4. To stop an alias, open it in the same menu and tap Deactivate Email Address.

Apple's full guide is in the links at the top. No iPhone? Use a throwaway email address for newsletters, free trials and one-time sign-ups, and keep your real address for people and important accounts.

5. Stop using text message two-factor authentication

Codes sent by text message feel safe, but they can be stolen with SIM swapping. Here's how it works: a scammer finds your name, address and phone number in a leak, calls your phone company pretending to be you, and asks for a new SIM card. Now your number, and every security code sent to it, goes to their phone.

What to do:

  1. Ask your phone company to add a PIN or SIM-swap lock to your account. Most carriers have one, called something like "port-out protection" or "number lock".
  2. Go through your important accounts (email, bank, Apple or Google, social media, crypto) and open Security → Two-step verification.
  3. Add an authenticator app or a security key (tips 6 and 7).
  4. Then remove your phone number as a two-factor method wherever the site allows it.
  5. Save the backup codes each site gives you in your password manager.

Check which sites support what on the 2FA Directory. If a site only offers text message codes, keep them on: they're still far better than nothing.

6. Get a YubiKey for your most important accounts

A YubiKey is a physical key you plug in or tap on your phone to log in. You can't get phished with it: even if you type your password into a perfect fake website, the key checks the real web address and refuses to log in to the fake one. A hacker would need the physical key in their hand.

Which one to buy:

  • YubiKey 5 NFC: USB-A, and you tap it on your phone. Good for most people.
  • YubiKey 5C NFC: the same with USB-C, for newer laptops and phones.

Buy two. Register both on every account, keep one on your keys and one somewhere safe at home. If you lose one, you're not locked out.

Where to use it first:

  1. Your Google account: Security → Passkeys and security keys.
  2. Your Apple Account: on iPhone, Settings → your name → Sign-In & Security → Security Keys. Apple requires at least two keys. See Apple's guide.
  3. Your Microsoft account, password manager and email.
  4. Banking and government accounts, where they support security keys. Many banks only offer their own app: use the strongest option they have.

For all your other accounts, use an authenticator app. Google Authenticator is free:

  1. Install it and sign in with your Google account, so your codes are backed up.
  2. On a website, open Security → Two-step verification → Authenticator app.
  3. Scan the QR code with the app and type in the 6-digit code to confirm.
  4. Save the backup codes in your password manager.

7. Check if you've been in a breach

Your email has probably leaked somewhere already. Most people's has. What matters is which passwords went with it.

  1. Go to Have I Been Pwned and type in your email.
  2. It lists every known breach your address was in and what leaked: passwords, phone numbers, addresses.
  3. For every breached site, change that password, and change it anywhere you reused it.
  4. Turn on free breach alerts, so you hear about new leaks right away.
  5. Check your family's email addresses too. Parents are scammers' favourite target.

Password managers can also flag reused and leaked passwords for you (1Password's Watchtower, Bitwarden's reports).

8. Agree on a safe word for AI voice cloning

AI can clone a voice from just a few seconds of audio, like a video you posted or a short phone call. Scammers use it to call parents and grandparents with a crying "it's me, I'm in trouble, send money now".

Set it up tonight:

  1. Pick a word or short phrase that's never been online and isn't guessable. Not your pet's name.
  2. Tell it to your family in person, not by text or email.
  3. Agree on the rule: anyone calling with an emergency that needs money, codes or secrecy has to say the word.
  4. If they can't, hang up and call that person back on the number saved in your phone.

Scammers create panic so you don't think. The safe word gives everyone permission to slow down.

9. Four quick ones

Turn on automatic updates. Most hacks use security holes that already have a fix. Updates install it.

  • iPhone: Settings → General → Software Update → Automatic Updates → turn everything on, including Security Responses.
  • Android: Settings → System → Software update, and in the Play Store turn on auto-update apps.
  • Mac: System Settings → General → Software Update → turn on automatic updates.
  • Windows: Settings → Windows Update → turn on "Get the latest updates as soon as they're available".
  • Chrome updates itself. Restart it when you see "Update" in the corner.

Never log in from an email link. AI writes phishing emails without typos now, so they look real. If an email says there's a problem with your account, close it and open the app or type the website address yourself. Your bank will never ask for a code or password by email, text or phone.

Delete browser extensions you don't need. Extensions can often read everything you do in your browser, and some get sold to people who add malware. In Chrome, type in the address bar and remove anything you don't use every week. For the rest, check the permissions: "Read and change all your data on all websites" is a lot of trust.

Lock your phone with a real passcode. Use 6 digits or more, plus Face ID or a fingerprint. Your phone opens your email, your bank and your authenticator app.

Your checklist

  • Checked my email on Have I Been Pwned and turned on alerts
  • Password manager installed, browser passwords imported
  • New unique passwords for email, bank, Apple or Google, phone carrier
  • Authenticator app or security key on my email and bank
  • Text message codes removed where possible, SIM lock with my carrier
  • Two YubiKeys on my most important accounts
  • Single-use cards for online shopping
  • Email aliases for new sign-ups
  • Automatic updates on, unused extensions deleted
  • Safe word agreed with my family

RickAI newsletter

Useful AI, twice a week.

Practical prompts, products, and workflows for building faster, finding customers, and turning AI skills into income.

By joining, you agree to receive Rick's AI notes every Wednesday and Sunday. Unsubscribe anytime. Your data is never sold. Privacy policy