Security steps you can take

Basic steps recommended by public bodies. You don't have to do everything at once — start with what you can.

1. Keep your operating system and apps up to date

   Install updates soon after they arrive. Turning on automatic updates helps you not miss them.

   Based on: National Police Agency of Japan: Basic security measures (Japanese) / CISA: Secure Our World tip sheet

2. Use long passwords, different for each service

   Change default passwords and use long passwords that are hard to guess, a different one for each service. A password manager can store them safely (CISA).

   Based on: National Police Agency of Japan: Basic security measures (Japanese) / CISA: Secure Our World tip sheet

3. Turn on two-factor (multi-factor) authentication

   This checks it is really you with something in addition to your password, such as a code sent to your phone. Turn it on wherever it is offered.

   Based on: National Police Agency of Japan: Basic security measures (Japanese) / CISA: Secure Our World tip sheet

4. Be careful with suspicious emails, texts and links

   Do not respond to alarming messages or offers that seem too good to be true; report and delete suspicious ones.

   Based on: CISA: Secure Our World tip sheet

5. Use security software and keep it updated

   Install antivirus software and keep its definition files up to date.

   Based on: National Police Agency of Japan: Basic security measures (Japanese)

6. Back up important data

   Keeping copies of photos and documents somewhere else makes it easier to recover after a breakdown or an attack.

   Based on: UK NCSC, "Backing up your data" (Small organisations guide)

7. Use login alerts and login history

   If a service can alert you to logins from an unusual time or place, or show your login history, turn these on. They help you notice a hijacked account early.

   Source: National Police Agency of Japan, "Basic security measures" (Japanese)

8. Use passkeys where a service offers them

   A passkey lets you log in with a key kept on your phone or computer instead of a password. Each site gets its own key, so it helps stop phishing (being tricked into logging in to a fake site), and there is nothing to remember.

   Source: UK NCSC, password managers and passkeys (June 2025)

9. When shopping and paying online

   Go to the shop by typing or searching for its address yourself, not through links in messages. For one-off purchases, use guest checkout and don't let your browser remember your payment details. The UK NCSC advises never paying by direct bank transfer and using a credit card or another protected method where you can.

   Source: UK NCSC, "Shopping and paying safely online"

10. If you think a password has leaked

    First, find out what was leaked from the service's own notice or official website. If a password leaked, change it on that service straight away to a long, complex one, and also change it on any other service where you reused it. If you can't log in, contact the service. If card details leaked, ask your card company to check for unauthorised use and about stopping or reissuing the card. Don't open links in unexpected emails or text messages.

    Sources: IPA (Japan), "What to do when your personal information has leaked" (26 October 2026, Japanese); National Police Agency of Japan, "Basic security measures" (Japanese)