Passwords, Passkeys and AI: Protecting Your Accounts

AI makes phishing and password guessing more effective. The good news is that better sign-in methods are becoming common.

• Convincing phishing: well-written, personalised messages in any language.
• Voice and video fakes used to pressure people into sharing codes.
• Faster credential attacks using leaked passwords and common patterns.
• Fake login pages generated at scale.

Generate long, unique passwords for every account, and let the manager fill them in. It also helps you spot fake sites, since it won't autofill on the wrong domain.

Prefer authenticator apps or hardware keys over SMS where possible.

Passkeys replace passwords with cryptographic keys tied to your device and the real website. They're resistant to phishing, because there's no password to type into a fake page. Many major services now support them.

No legitimate company, bank or "colleague" needs your one-time code.

Contact the organisation through an official route, not the link or number in the message.

• Check the address before signing in.
• Be suspicious of urgency.
• Keep devices and apps updated.
• Use a separate email for important accounts.
• Check breach alerts and change affected passwords.

Don't paste passwords, recovery codes or API keys into AI chats. Limit what agents can access, and require approval for sensitive actions.

Use a password manager, enable two-factor authentication and adopt passkeys where offered. They blunt most AI-powered attacks.