Cyber Hygiene Checklist for Families That Actually Works

Your kid's school Chromebook has a camera. Your mom's bank still sends login codes by text. And the family iPad is signed into your Apple ID — the same one holding your credit card. That's three doors into your house, and odds are you haven't checked the locks on any of them since setup day.

The good news: you don't need a security team or a monthly subscription stack. You need an afternoon, two free apps, and one slightly awkward conversation. Here's the cyber hygiene checklist I hand to friends who ask, plus what the big trends in family online safety actually mean at your kitchen table.

What the trends actually mean for you

The headline numbers are ugly. The FBI's Internet Crime Complaint Center logged about $16.6 billion in reported losses for 2024, up from $12.5 billion the year before. But the pattern underneath the numbers is what matters: criminals mostly aren't breaking in anymore. They're logging in as you, using passwords that leaked from somebody else's breach.

Two 2024 breaches tell the story. Change Healthcare exposed data on roughly 190 million people. National Public Data leaked Social Security numbers on a scale that made freezes a mainstream conversation. Your family's information is almost certainly in one of those files already. That's not a reason to panic — it's a reason to make the leaked data useless.

Trend	What it means at home	Your move
Breaches are routine, not rare	Old passwords are already circulating	Unique logins via a password manager
Passkeys are going mainstream	Easier and safer sign-in exists now	Turn them on wherever offered
Scam texts beat scam emails	Every phone in the house is a target	Teach the "don't reply" rule
Voice cloning is cheap	A few seconds of audio is enough	Pick a family safe word

The family cyber hygiene checklist

1. Put everyone in a password manager

This is the single highest-return hour you'll spend. Bitwarden Families runs about $40 a year for six users; 1Password Families is roughly $5 a month for five. Both include shared vaults, which is genuinely useful — the Netflix login and the Wi-Fi password live in one place, and the bank logins stay private.

Then do the boring part. Sit down with each adult and run their saved logins through a breach check — Have I Been Pwned, or the built-in Password Checkup in Chrome and Edge. Anything flagged gets changed that day. Yes, it's tedious. Do it anyway. Reused passwords are the reason one breach turns into five.

2. Swap SMS two-factor for an app or a passkey

Texted codes are better than nothing and worse than almost everything else. SIM swapping is real, and so is "MFA fatigue" — where an attacker floods you with login prompts until someone taps Approve out of annoyance.

Install an authenticator app instead: Google Authenticator, Microsoft Authenticator, 2FAS, or Ente Auth. Better still, use passkeys where sites offer them — Apple, Google, and Microsoft all support them now, and they can't be phished because there's no code to steal. If you want to go further, a hardware key like the YubiKey 5 NFC (around $55) on your email account is money well spent. Your email is the master key to everything else. Guard it first.

3. Fix the router, then forget about it

Home network security gets skipped because it's invisible. Twenty minutes fixes that. Log into your router, change the admin password from whatever it shipped with, confirm WPA3 (or WPA2 if your gear is older), and turn on automatic firmware updates.

If you're on a mesh system — Eero, Nest Wifi, TP-Link Deco — auto-update is usually already on, so just verify it. Then set up a guest network and put the smart plugs, the robot vacuum, and your kids' friends' phones on it. Cheap IoT devices are the flimsiest things on your network; keep them away from the laptops that hold the tax returns. And if your router stopped getting firmware updates years ago, replace it. A dead router is a permanent open door.

4. Choose guardrails over surveillance

Apple's Screen Time and Google's Family Link are free and cover most of what parents actually need: app limits, downtime, approval for new installs, and content filters. Apple's "Ask to Buy" is the one I'd turn on first — it puts you between your kid and any purchase or free app with in-app spending.

Here's my opinion, and it's a firm one: monitoring apps that read your teenager's messages will cost you more trust than they buy you in safety. Guardrails scale. Spyware doesn't. Start tight with a seven-year-old and loosen as they earn it. One exception worth enabling for everyone: Stolen Device Protection on iPhone (iOS 17.3 and later), which makes a snatched, unlocked phone much less useful to a thief.

5. Rehearse the scam-text script

Package delivery. Unpaid toll. Bank fraud alert. "Hi Mom, this is my new number, can you text me back?" That last one is the setup for a scam that costs families real money, and it works because it feels normal.

Give everyone the same three rules: don't reply, don't tap the link, and never call the number in the message — call the number on the back of your card instead. Forward junk texts to 7726 (SPAM) so carriers can block the sender. Kids need a version of this for games, too. "Free Robux" and "free V-Bucks" offers on Roblox and Discord are almost always credential theft or worse, and anyone asking your kid to move the chat to another app is worth a hard no.

6. Lock down the kids' identities early

Children's credit files are attractive because nobody checks them for 18 years. Freezing a minor's credit is free at all three bureaus (Equifax, Experian, TransUnion) and takes maybe an hour total. It's a bit of paperwork, and you'll need to thaw it if they ever need a student loan. Worth it if your family has been through a breach involving Social Security numbers — which, statistically, you have.

While you're there: check the privacy settings on school-issued Google or Microsoft accounts. You probably can't install anything on a school device, but you can ask the district what filtering follows your kid home.

Where I'd spend money first

Free tools handle most of this. Then, in order: a family password manager (under $60 a year), a hardware key for the two accounts that hold money, and better parental controls if your kids are young.

What I'd skip is the $30-a-month "family protection" bundle. Identity monitoring mostly sends you alerts after something has already happened — it doesn't prevent much. If it comes bundled with something you'd buy anyway, like Eero Plus with your mesh router, fine. Just don't buy peace of mind you haven't actually configured.

Key Takeaways

• Most attacks now start with leaked passwords, not malware — unique logins matter more than antivirus.
• A family password manager is the highest-value purchase on this list, at roughly $40–60 a year.
• Replace SMS two-factor with an authenticator app or passkeys, starting with your email account.
• Update your router firmware and put smart devices on a guest network.
• Teach the "don't reply, don't tap, call the number on your card" rule to everyone, kids included.
• Freeze your children's credit — it's free and takes about an hour.

Frequently Asked Questions

Is a password manager safe for my whole family to use?

Yes, with a strong master password and two-factor turned on. Reputable managers like Bitwarden and 1Password store your vault encrypted so that even the company can't read it. The real risk isn't the software — it's a weak master password or skipping two-factor. Note that LastPass's 2022 breach is still a fair reason some people avoid that one specifically.

Should I freeze my kid's credit?

If your family's Social Security numbers have been exposed in a breach, it's a reasonable precaution, and it's free at all three bureaus. It blocks new credit applications in the child's name, which is exactly what identity thieves go after. You'll need to unfreeze it later for things like a first student credit card or an apartment application.

How do I stop scam texts on my family's phones?

You can't block them all, so focus on behavior. Don't reply — replying confirms a live number. Don't tap links. Forward the message to 7726 to report it, then delete and block. On iPhone and Android, enable the built-in "filter unknown senders" setting so unfamiliar numbers land in a separate folder instead of your main thread.