Make your family harder to hack, starting today

You are helping me run a security check for my household after a week of news about AI tools finding serious flaws in widely used software. Act like a patient, careful family IT helper: someone who knows that a missed update, a reused password or a code read out to a stranger is how ordinary families actually get hurt, and who never pretends to know something they cannot see. You cannot see my devices or accounts, so everything you say about them comes only from what I tell you here. If you guess, I may believe a device is safe when it is not, so say "not sure" whenever you are not sure.

ABOUT MY HOUSEHOLD (I fill this in once; any line can say "not stated")
- Country I live in: [e.g. "United States", "Canada", "South Africa", "Malaysia"]
- People, with age and how confident they are with tech: [e.g. "me, 44, confident", "my partner, 46, uses the phone for banking only", "my mum, 78, lives alone, has an iPad", "my adult daughter, 24"]
- Who looks after whose devices and accounts: [e.g. "I set up mum's iPad and know her Apple Account email", "my partner manages their own", "nobody looks after the router"]
- Phones and tablets, with make, model and owner: [e.g. "iPhone 13, mine", "Samsung Galaxy A52, partner", "iPad 7th generation, mum"]
- Computers, with operating system and owner: [e.g. "Windows 10 laptop, shared family computer", "MacBook Air 2020, mine", "Chromebook, daughter"]
- Browsers each person uses: [e.g. "Chrome on the laptop", "Safari on the phones", "not sure"]
- Internet router, and who supplied it: [e.g. "box from my internet provider, model on the label is ABC123", "bought it myself, brand and model on the label", "not sure"]
- Other connected things: [e.g. "smart TV, video doorbell, baby monitor", "a tablet nobody uses any more", "none"]
- Shared accounts: [e.g. "one streaming login for the whole family", "a family email used for utility bills", "mum's bank password is written in her diary"]
- What my household already uses:[e.g. "password manager: none", "two-step sign-in on my bank only", "family code word: no"]
- What worries me most: [e.g. "mum answers every call", "the old laptop", "my daughter downloads browser add-ons from random sites"]

WORK IN STAGES

Stage 1. Check what is missing. Read my set-up back to me as a short table: person, device or account, owner, who looks after it. Mark any line I left as "not stated", or that is too vague to act on (for example "Samsung phone" with no model), as [NEED DETAIL] and ask me for all the missing details in one list. If the country, the list of people or the list of devices is missing, stop here and ask before going on.

Stage 2. Updates, device by device. For each device give me: where to check for updates on that device, how to turn on automatic updates, and what "up to date" should look like on the screen. If you are not sure of the exact menu name for that model or version, write [CHECK ON DEVICE] and describe what to look for. Never tell me a device is up to date or still supported: tell me to open the update screen on the device itself, read what it says, and report back to you with both the version number and the date of the last security update where the screen shows one.
- If a security update date I report looks old, flag that device as possibly no longer supported and tell me to check the maker's support page, because on an old device "up to date" can simply mean no more updates are coming.
- If a device may no longer get security updates (an older operating system, an old phone or tablet, or a maker that may have stopped updates), raise it as a question to check, never as a fact, and tell me where to check: the device's own update screen or the maker's support page. Then give me the options in order of safety: replace it; keep it only for jobs with no logins, banking or shopping; or take it off the internet.
- If a computer is shared by the family, put it first in the list, because everyone's logins pass through it.
- If the router came from my internet provider, tell me to ask the provider whether it updates itself and whether a newer model is available. If I bought it, tell me to look for a firmware update and an automatic update option in its app or its admin page (the address is often printed on the label).
- Browsers: tell me how to check each browser I listed is on its latest version and has been restarted to finish updating.
- Other connected things: for each, ask whether it is still in use. If not, tell me to unplug it and remove it from the home Wi-Fi. If it is, tell me to look for updates in its app.

Stage 3. Accounts, person by person. For each person, list their most important accounts in this order: main email, phone account, bank and payment apps, then shared accounts. For each account give one next step: move the password into a password manager, add a passkey where the service offers one, or turn on two-step sign-in. Only suggest a passkey on a device that only that person uses, because anyone who can unlock the device can then reach the account; on a shared computer or tablet, suggest two-step sign-in. Before any two-step step, tell me to check the account's recovery email and phone number are current, and to save the backup codes (if the service offers them) somewhere safe away from the phone. Explain in one line why email comes first: it is where password resets for every other account land. Never ask me for a password, code, PIN or recovery key, and tell me to stop if I start typing one into this chat.
- If a person is older or less confident: write their steps as a short numbered script I can do with them in person or on a video call, one action per line, including checking their recovery email and phone number, and add a plan for who they call before acting on any call, text or email that asks for money, a code or a login.
- If an account is shared: say who should own it, suggest a separate login for each person where the service allows it, and tell me to change the shared password after anyone who no longer needs it has been removed.
- If a password is written down somewhere others can see: suggest a safer place, kindly, without making anyone feel foolish.

Stage 4. Household rules. Draft three short rules my household can agree on, in plain words that both the youngest and the oldest person I listed would follow: what to do with any call or message that asks for money or a code; using a family code word to check any urgent call that sounds like a family member; and who to tell straight away after clicking something odd or giving out a detail. Leave the code word blank for my household to choose together; never suggest one.

Stage 5. One page to keep. Give me the whole plan as a checklist grouped by person, with a tick box on each line, the device or account it belongs to, and who does it. Put the three highest-risk items at the top, each with one line on why it comes first. Where reporting fraud depends on my country, name the type of place to contact (for example "your bank's fraud line" or "your national cyber security agency") and mark it [CHECK LOCALLY]; do not name an agency or phone number you are not sure of.

SELF-CHECK BEFORE YOU ANSWER
- Every person, device and account I listed appears in the plan, or is marked [NEED DETAIL].
- You did not state that any device is up to date or still supported; every update line tells me to confirm on the device itself.
- Every menu name you were unsure of carries [CHECK ON DEVICE].
- You asked for no password, code, PIN or recovery key.
- No passkey is suggested on a shared device.
- Each older or less confident person has a script for in person or a video call.
- Every device has a version and a security update date to report, or a note on where to find them.
- Every agency, law or phone number you mention is one you are sure of for my country, or is marked [CHECK LOCALLY].