Cybersecurity basics for Canadians: passwords, MFA and updates
Quick summary
Get Cyber Safe, the Government of Canada's awareness program, breaks account security into four steps: strong passphrases, multi-factor authentication, updates and a safer home Wi-Fi. Many scams start with a phishing message, so learn those too in our fraud and scam protection hub.
Checked November 3, 2026. Main source: Get Cyber Safe: Take the Get Cyber Safe Challenge (updated November 3, 2021). See all 4 sources.
Step 1: unique passphrases and a password manager
- Use a passphrase: several words and a good length.
- Review every account, including rarely used ones, and replace weak or reused passwords with unique ones, one at a time if needed.
- Store them in a password manager, and protect the manager with its own strong passphrase.
Step 2: turn on multi-factor authentication (MFA)
- List your most important accounts first, especially those with personal or financial information, such as email, banking and cloud storage.
- Choose a method that suits you, such as a fingerprint or a text code.
- Turn MFA on wherever it is offered. It is often in privacy or security settings.
- Never share an MFA code with anyone who contacts you. The Canadian Anti-Fraud Centre lists sharing a security code as a way sellers and buyers get scammed.
Step 3: keep software updated
- Check for updates on every device that connects to the internet, including phones and smart appliances.
- Turn on automatic updates and schedule them for times you are not using the device, such as overnight.
- Uninstall apps and software you no longer use, since unused software can create risks.
Step 4: secure your home Wi-Fi
- Replace your router's default password with a unique one.
- Set up a guest network for visitors and smart devices.
- Place the router near the centre of your home so the signal reaches less outside.
- Optional: Canadian Shield is a free DNS firewall that blocks malware, according to Get Cyber Safe.
Steps 1 to 4 follow the Get Cyber Safe Challenge (page last modified November 3, 2021).
Spot phishing
The Canadian Anti-Fraud Centre says phishing messages pose as banks, streaming services, businesses or government agencies. They pressure you to act, offer refunds or money, ask you to click a link, download an attachment, fill out a form or scan a QR code, ask for personal or financial details, or are very short with only a link.
- Do not click links or open attachments in unsolicited messages.
- Do not trust a message just because the sender address looks real.
- Report it to the Canadian Anti-Fraud Centre, then delete it.
- Back up your data regularly. Ransomware often starts with a phishing email, and paying a ransom does not guarantee you get access back.
If an account was taken over
- Change the password from a clean device and turn on MFA.
- Tell your bank if money or cards are involved.
- Check your credit report for new accounts.
Questions people ask
What is multi-factor authentication?
It asks for a second proof that it is you, such as a fingerprint or a code sent to your phone, in addition to your password. Get Cyber Safe says to turn it on wherever it is available, starting with your most important accounts.
Why use a passphrase instead of a password?
Get Cyber Safe suggests several words and a good length, because length makes a passphrase harder to guess. Use a different one for every account and keep them in a password manager.
How do I know if a text or email is phishing?
According to the Canadian Anti-Fraud Centre, red flags include a message you did not ask for, pressure to act fast, links or attachments, requests for personal details and spelling mistakes. Do not click, report it and delete it.
Should I keep my devices updated?
Yes. Get Cyber Safe recommends checking updates on every connected device and turning on automatic updates.