Author: Thomas Campbell

Your phone pops up with yet another update notification. Didn’t you just do one last week? Here’s why updates happen so often—and which ones matter.

What is a software update?

An update is a new version of software that fixes problems, closes security weaknesses, or adds features. Think of it like taking your car in for maintenance: not every visit changes how it looks, but important things can be fixed under the hood.

Why are there so many?

• Security: Attackers discover vulnerabilities, and manufacturers patch them.
• Bug fixes: Updates can address freezing, battery drain, or app crashes.
• Compatibility: Apps and services change, so your phone sometimes needs to catch up.
• Features: Some updates add new controls or change how things look.

Should I install updates right away?

Install security updates promptly. Major operating-system upgrades can introduce bigger changes, so it is reasonable to confirm your backup and check available storage first. If you see an urgent security fix from your phone manufacturer, don’t postpone it just because you dislike the reminder.

How to update safely

1. Back up important photos and files. See our simple backup guide.
2. Connect to a trusted Wi-Fi network if the download is large, and charge your phone.
3. On iPhone, go to Settings → General → Software Update.
4. On Android, go to Settings → System → Software updates (exact wording varies by manufacturer). Also update your apps through the Play Store.
5. Read the update details, install it, and allow the phone to restart if needed.

What about text messages claiming I need an update?

Be suspicious of unsolicited links saying your phone is infected or needs an emergency update. Open the phone’s built-in Settings app or its official app store instead of tapping a message link. See how to spot a scam.

What if the update fails?

Check battery, storage, internet access, and the device’s date and time. Restart and try the update again through Settings. If your phone is too old to receive security updates, consider planning a replacement instead of relying on unsupported software indefinitely.

Bottom line: Updates can be annoying, but they’re one of the easiest ways to keep your phone secure and working properly.

Have you seen a website offer to let you “create a passkey” instead of using a password? It’s a newer, often easier way to sign in—and it can be safer, too.

What is a passkey?

A passkey is a secure digital sign-in credential stored on your device or in a compatible password manager. Instead of remembering a password, you usually unlock the passkey with the same fingerprint, face recognition, or PIN you use to unlock your phone or computer.

The important part: Your fingerprint or face isn’t sent to the website. Your device uses it to approve a secure sign-in. Behind the scenes, the site checks a cryptographic proof rather than receiving a shared password.

How is that different from a password?

Passwords are secrets that you type into websites. Criminals can steal them through fake sign-in pages, leaks, or reused passwords. With a passkey, the private credential stays protected on your device or within your passkey provider. A fake website cannot normally trick the passkey into signing in to the real website.

How do I create one?

1. Sign in to a website that offers passkeys.
2. Open its Account or Security settings.
3. Choose Create a passkey or Add passkey.
4. Follow your phone, computer, or password manager’s instructions.
5. Confirm it works before removing any old sign-in method.

Not every website supports passkeys yet, and menu names vary.

What if I get a new phone?

Many passkeys sync through a compatible password manager or phone ecosystem. Others stay on one device, including certain hardware security keys. Before replacing or wiping your old phone, make sure your passkeys are backed up or that you have another way into important accounts.

Are passkeys and two-factor authentication the same?

No. Two-factor authentication adds another sign-in check, often to a password. A passkey can replace the password entirely and still provide strong authentication. Read our plain-English guide to two-factor authentication for the difference.

Should I use passkeys?

Yes, for accounts that support them—especially your main email account. Keep your phone or computer protected with a strong screen lock, understand your recovery options, and never approve an unexpected sign-in request.

Bottom line: A passkey is usually easier to use than a password and far more resistant to phishing. You don’t have to switch everything at once: start with one important account.

Ever tried to sign in to an account and been asked for a six-digit code? That’s probably two-factor authentication, often shortened to 2FA. It can feel like an extra chore, but it helps stop someone from getting into your account even if they learn your password.

What is two-factor authentication?

Think of your password as the key to your front door. Two-factor authentication adds another check before the door opens. Usually you enter your password, then prove it’s really you using your phone, an authenticator app, a security key, or another method.

The two checks come from different kinds of proof: something you know (your password), something you have (a phone or security key), or something you are (such as a fingerprint). Some websites call this two-step verification or multi-factor authentication (MFA).

What does 2FA look like in real life?

1. You enter your email address and password.
2. The website asks for another verification step.
3. You enter a code from an authenticator app, approve a request, or use your security key.
4. You’re signed in.

Some accounts remember trusted devices, so you won’t necessarily have to repeat that second step every time.

Text messages, authenticator apps, and passkeys: what’s the difference?

• Text message code: A website sends a code to your phone number. It’s better than using only a password, but criminals can sometimes hijack phone numbers or trick you into handing over the code.
• Authenticator app: Apps such as Google Authenticator or Microsoft Authenticator generate changing codes. These generally avoid the phone-number weakness, although a fake login page can still trick you into typing the code.
• Security key: A small physical device you connect or tap to sign in. Modern FIDO security keys provide strong protection against phishing.
• Passkey: A newer way to sign in, often using your phone’s fingerprint, face unlock, or device PIN. A passkey can replace a password rather than simply adding another code, and is designed to resist fake sign-in sites.

Our practical advice: If passkeys or security keys are offered, they’re excellent choices. Otherwise, an authenticator app is a good default. If text messages are the only second-step option, enable them rather than leaving the account password-only.

How do I turn 2FA on?

1. Open the website or app for the account you want to protect.
2. Find Settings, then look for Security, Sign-in, Two-Step Verification, or Two-Factor Authentication.
3. Choose a verification method and follow the setup prompts.
4. Save any backup or recovery codes somewhere private and secure, preferably in a password manager or another protected place you can reach if you lose your phone.
5. Test a sign-in before you consider setup finished.

Menu names change, but the security section is almost always the right place to start. Begin with your main email account, then banking, shopping, social media, and any account that holds personal information.

What if I lose my phone?

That is why recovery matters. Depending on the service, you may be able to use a backup code, another registered device, a second security key, or the provider’s account-recovery process. Add more than one secure sign-in or recovery method when possible. Don’t store your only backup codes in a place you can access only through the account you’re trying to recover.

One scam warning you should remember

Never give someone a sign-in code just because they call, text, or email asking for it. A legitimate support representative should not need you to read them a verification code. If an approval notification arrives when you aren’t signing in, deny it and check your password and account security.

If something feels suspicious, read our guide to spotting scams and what to do after clicking a suspicious link.

The bottom line

Two-factor authentication means a stolen password alone is less likely to be enough to take over your account. Turn it on for important accounts, favor phishing-resistant options when available, and keep your recovery methods up to date. A minute or two of setup can save a lot of trouble later.

You tapped a link in a text or email, and now something feels wrong. Start by closing the page. What you did after opening it determines which steps matter most.

Quick answer: Stop interacting with the message. If you shared a password or code, protect that account through its official app or website. If you shared payment details, contact the provider immediately. If you installed software or allowed remote access, use another trusted device for sensitive accounts.

1. You only opened the page

Close the tab without pressing buttons inside the page. Do not call a number shown in a warning or install a suggested “fix.” Opening a page alone does not establish that your account was taken over, but do not assume the page was harmless. Check whether anything downloaded, whether you allowed notifications, and whether you entered information.

Update your browser and device. If you suspect a harmful download, update your security software and run a scan. On Windows, use our Windows Security scanning guide. Repeated browser alerts may need a separate check: fake virus warning pop-ups.

2. You typed a password or shared a sign-in code

Open the genuine service yourself, using its official app or a saved bookmark. Change the exposed password and any other accounts where you reused it. If the device may be compromised, do this from another trusted device.

Check recent account activity and sign out unfamiliar sessions. Review recovery details and enable multifactor authentication. A shared sign-in code can allow access even when the password stays private. Google provides instructions to review and sign out devices and strengthen account security. If you cannot sign in, use the provider’s official recovery process.

3. You entered card details or sent money

Call your bank, card issuer, or payment service immediately using the number on your card or its official app. Explain what happened, including any small “delivery fee.” Ask about securing the account and stopping or reversing the payment. Recovery is not guaranteed.

4. You installed something or allowed remote access

End the remote session and disconnect the affected device from Wi-Fi and Ethernet. Use a separate trusted device to secure sensitive accounts. Get trusted help checking the affected device before using it for banking or email again. A clean scan alone does not prove that remote-access changes were undone.

5. You shared identity information

Use IdentityTheft.gov for a plan suited to what you shared. If your Social Security number was exposed, review the FTC’s credit freeze and fraud alert guidance.

Think someone actually accessed your email? Follow our 10-step hacked-email recovery checklist to inspect inbox rules, forwarding, connected apps and deleted messages after resetting your password.

Keep a record and report it

Save the original message and relevant transaction details without reopening the suspicious link. Report suspected fraud at ReportFraud.ftc.gov. Be cautious of follow-up offers to recover money for an upfront fee.

Next time: pause and check independently

Reach the organization through a route you already trust. Read How to Spot a Scam and Unexpected Package Delivery Text? for examples you can check before responding.

Sources

FTC: Recognize and Avoid Phishing · FTC: What to Do if You Were Scammed · Google account guidance linked above.