Digital Security Hardening: Protect Yourself in Layers

The mindset: trust no one, verify everything

This is the one habit that outperforms almost every technical fix, because it catches the attacks that skip the technology entirely and go straight for you. Practically, it means:

• Don't act on a link or number someone else gave you. If your bank, an exchange, or “support” contacts you, close the message and find their number or site yourself, through a bookmark you set or a search you ran independently. Real support can wait for you to call back on a channel you found.
• Read URLs like they might be lying to you, because sometimes they are. A fake site only needs one swapped letter or an extra word to fool a quick glance. Slow down and read the actual domain before you type anything into it.
• Urgency is a red flag, not a reason to hurry. “Your account will be suspended,” “act now,” “this offer expires in 10 minutes” — these phrases exist to stop you from thinking. Real problems and real opportunities can survive you taking twenty minutes to verify them.
• Nobody legitimate ever needs your seed phrase, password, or 2FA code read aloud. Not a wallet company, not an exchange, not law enforcement, not a friend claiming their account is locked. If someone asks for any of these, the conversation is the scam.

Layer one: passwords

Reusing a password means a breach at any one site, even an unimportant one, can hand an attacker the keys to every other account using that same password. A password manager generating a long, random, unique password per site closes this off entirely; you only have to remember one strong password, for the manager itself.

Length beats cleverness. A long random string is harder to guess than a short one with a symbol swapped in, no matter how clever the swap feels.

Layer two: two-factor authentication

A password alone is one layer. Two-factor authentication (2FA) adds a second: something you have, in addition to something you know. An authenticator app or a physical security key is meaningfully stronger than SMS codes, which can be intercepted if someone convinces your phone carrier to move your number to their SIM card, an attack called a SIM swap.

Secure your email account first. Almost every other account resets its password through email, so whoever controls your email can often work their way into everything else, one “forgot password” link at a time.

Layer three: your devices

• Keep your phone and computer's operating system updated; security fixes ship in those updates.
• Use a lock screen with a real passcode, not nothing.
• Be wary of installing apps or browser extensions you haven't verified are legitimate, using the same checks as any wallet or exchange app.
• Never install remote-access software because someone on the phone asked you to, no matter who they claim to be.

Layer four: how you use Bitcoin specifically

The same layered thinking applies once digital security is handled. Start with an amount that wouldn't hurt to lose, and actually use it: send it, receive it, restore a backup. Once you're holding an amount that matters, move to a hardware wallet so your keys live offline. Once it's an amount that would genuinely hurt to lose, add multisig, spreading keys across more than one device or vendor so no single point of failure, digital or physical, can take everything at once.

For more on that progression, see Self-Custody: Holding Your Own Keys, Entropy and Bitcoin Security, and How to Verify a Wallet or Exchange Is Legitimate.

This changes, and that's the point

New scams, new fake apps, and new tricks will keep showing up, because the people running them adapt too. The specific threats will change. The habits above, verifying independently, thinking in layers, and never trusting an unexpected message just because it sounds official, don't expire. Build those, and you're equipped for whatever comes next, not just what exists today.

Common questions