Why Dennis Changed Six Passwords on a Quiet Sunday Afternoon

The message that started it

Dennis signed up for our Online Banking Security module after a notice from an email provider told him his address had appeared in a list of leaked login details. He is a retired machinist in his late sixties, comfortable with a smartphone but not with settings menus. He wrote to me first, a little embarrassed, asking whether he had already been robbed.

I told him what I tell every learner: a leaked address is a warning, not a loss. It means someone may try the same password elsewhere, so the useful question is where that password lives. Dennis admitted he had used one favourite phrase, with small changes, for his bank, his email, his phone plan and his pharmacy account. That answer shaped the whole afternoon we spent on it.

Finding where the old password lived

We started with a plain sheet of paper, not a screen. Dennis listed every account he could remember: banking, email, utilities, a streaming service, two shopping sites and his pharmacy. Next to each he wrote how he had last signed in. Six of them shared the same base phrase, including his email, which matters most because most password resets travel through the inbox.

I asked him to change the email password first, then the bank, then the rest in order of how much damage a stranger could do. Order matters. Fixing a streaming account while the email stays exposed is like locking the shed and leaving the front door open. Dennis found the exercise oddly calming because the problem finally had edges.

• Write the account list on paper before touching any setting
• Change email first, since resets arrive there
• Then bank accounts, then everything else

Building passwords he could actually remember

Dennis worried that long, unique passwords meant a notebook of gibberish. We talked about passphrases instead: four or five unrelated words strung together, long enough to resist guessing and easy to picture. He chose combinations built from odd images rather than personal facts, avoiding birthdays, pet names and his old shop's address, all of which a stranger could find.

For the six accounts that mattered, he wrote each new passphrase once, typed it in, and then we discussed storage. He decided on a password manager built into his phone, set behind his fingerprint and a long master passphrase. I do not push one tool over another; the point is that a single strong secret protects many unique ones, and he no longer had to carry them in his head.

Turning on two-step verification

The second half of the afternoon was two-step verification, which Dennis had always skipped because it sounded like extra work. I explained it as a second key: even if someone learns the password, they still need a code that arrives on his own phone. We switched it on for his email and his bank, choosing codes from an authenticator app on his phone rather than text messages where the option existed.

He tested it right there, signing out and back in, and saw the prompt arrive in seconds. We also saved the backup codes the bank offered and he put the printed page in the folder where he keeps his tax papers. That small step means a lost phone does not lock him out of his own money.

• Prefer an authenticator app to text messages where offered
• Store backup codes somewhere offline and safe
• Test the sign-in once while you are calm and unhurried

Device settings and the habits that stuck

Before we finished, we looked at the phone itself. Dennis set an automatic screen lock of one minute, turned on automatic updates, and removed two apps he had not opened in years. He also learned to check the lock icon and the full web address before typing a banking password, and to open the bank's app directly rather than through links in messages.

A week later he sent a short note: a text claiming to be from his bank had arrived, and instead of tapping the link he opened the app and found nothing wrong. That is the real result of the module. Nothing dramatic happened to Dennis, and that quiet outcome is exactly what good habits are meant to produce.

Dennis did not buy anything or install anything unusual. He listed his accounts, replaced one tired password with several strong ones, switched on a second check and tightened his phone. The afternoon took a few hours and gave him a routine he can repeat each autumn. If a leaked-password notice ever lands in your inbox, start with the paper list, work from email outward, and take the steps one account at a time.