What are the best practices for creating and managing strong passwords for online transactions?

Online transactions are convenient and fast, but they also expose you to the risk of identity theft and fraud. To protect your personal and financial information, you need to create and manage strong passwords for your online accounts. In this article, you will learn the best practices for choosing, storing, and updating your passwords for online transactions.

1 Choose complex passwords

The first step to creating strong passwords is to make them complex and unpredictable. Avoid using common words, names, dates, or phrases that can be easily guessed or cracked by hackers. Instead, use a combination of uppercase and lowercase letters, numbers, and symbols. You can also use a password generator tool to create random and secure passwords. A good rule of thumb is to use at least 12 characters for your passwords.

Add your perspective

Olly Brough

Director AuthID Limited | Trusona | itSMF UK Member
Report contribution
On the face of it, complex passwords are better for security, but they make the usability and attritional impact of passwords even worse. Research now suggest a balanced approach - i.e., don't use the same password for multiple services, do use symbols and the like, but don't make it so complex it makes the management and use of the password even harder to use. And finally, however complex your password is, if it is hacked or phished, complexity is not going to provide protection. If anything, it provides a false sense of security.

Like

2 Store passwords securely

The second step to managing strong passwords is to store them securely. Do not write them down on paper, store them in plain text files, or share them with anyone. These methods can expose your passwords to unauthorized access or theft. Instead, use a password manager tool to store and encrypt your passwords. A password manager can also help you generate, autofill, and sync your passwords across different devices and platforms. Make sure you choose a reputable and reliable password manager and protect it with a master password.

Add your perspective

Olly Brough

Director AuthID Limited | Trusona | itSMF UK Member
Report contribution
Password managers are probably the best approach given the reality of passwords. Better still, lets get digital brands to migrate their customers away from passwords to passkeys, which cannot be hacked, stolen or phished and are easier to use. They are in all modern iPhones, Android phones and windows devices but brands are yet to adopt them.

Like

3 Update passwords regularly

The third step to maintaining strong passwords is to update them regularly. Do not use the same password for multiple accounts or keep using the same password for a long time. These habits can increase the chances of your passwords being compromised or breached. Instead, change your passwords every few months or whenever you suspect any suspicious activity on your accounts. You can also use a password manager tool to notify you when your passwords are due for a change or when they are weak or reused.

Add your perspective

4 Use two-factor authentication

The fourth step to enhancing your password security is to use two-factor authentication (2FA) whenever possible. 2FA is a feature that adds an extra layer of verification to your login process. It requires you to enter not only your password but also a code, a token, or a biometric factor that is sent to your phone, email, or device. 2FA can prevent hackers from accessing your accounts even if they have your password. You can enable 2FA on most online platforms and services that support it.

Add your perspective

Olly Brough

Director AuthID Limited | Trusona | itSMF UK Member
Report contribution
2FA does add security, but why are brands still using Authenticator App or SMS OTPs when there is a multi-factor capability natively available on our devices. It is called Passkey. Google it "passkey apple support" or if your an Android user "passkey android support". It is there, on your device but brands are yet to make the switch. Not only is passkey MFA but also removes the risk and frustration of passwords. Brands hate 2FA as it increase attrition in digital journeys in addition to all the password resets. Passkey has a 100% success rate (i can provide the source) and is twice as fast as entering a password and 3 times faster than a password + 2FA via SMS or Authenticator App.

Like

5 Avoid phishing and malware

The fifth step to protecting your passwords is to avoid phishing and malware attacks. Phishing is a technique that uses fake emails, websites, or messages to trick you into revealing your passwords or other sensitive information. Malware is a software that infects your device and steals or damages your data. To avoid phishing and malware, you should always check the sender, the URL, and the content of any communication you receive online. You should also use a reputable antivirus and firewall software to scan and block any malicious files or links.

Add your perspective

Olly Brough

Director AuthID Limited | Trusona | itSMF UK Member
Report contribution
This is exactly why passkey has been introduced by Apple, Google and Microsoft as it is an unphishable credential. Brands are spending big on Ai driven analytics to identify account take over risk when the problem can now be stopped at source. We can now fix the problem as opposed to treating the symptoms of phishing and credential theft via malware.

Like

6 Educate yourself and others

The sixth step to improving your password hygiene is to educate yourself and others about the importance and best practices of password security. You should keep yourself updated on the latest trends and threats in the online security landscape and learn how to prevent and respond to them. You should also share your knowledge and tips with your family, friends, and colleagues who may be unaware or careless about their password security. By educating yourself and others, you can create a safer and more secure online environment for everyone.

Add your perspective

7 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?

Add your perspective

Olly Brough

Director AuthID Limited | Trusona | itSMF UK Member
Report contribution
A good place to start learning about passkey is the blog here - https://www.trusona.com/blog/making-sense-of-passkeys I also recommend googling having a read about passkey on the FIDO Alliance website - see https://fidoalliance.org/passkeys/

Like

What are the best practices for creating and managing strong passwords for online transactions?

1

2

3

4

5

6

7

1 Choose complex passwords

2 Store passwords securely

3 Update passwords regularly

4 Use two-factor authentication

5 Avoid phishing and malware

6 Educate yourself and others

7 Here’s what else to consider

Electronic Payments

Rate this article

Thanks for your feedback

More articles on Electronic Payments

More relevant reading