Most "cybersecurity" advice online is either fear-mongering or a thinly disguised advert for a VPN you probably don't need. I've tried to write the opposite: a calm, honest ranking of what actually reduces the risk to your money and identity, from the single highest-impact change down to the nice-to-haves. If you do only the first section, you'll have closed the door most fraud walks through.
1. A password manager — the single biggest win
If you take one thing from this page, take this. Everything else is a distant second.
Almost every account takeover starts the same way: a password you used somewhere else leaks in a breach, and criminals simply try it on your email, your bank, your investment platform. A password manager kills this entirely — it generates a long, random, unique password for every site and remembers them all behind one strong master password. You stop reusing passwords without any effort, because the software does the remembering.
Bitwarden
Best free / best valueThe one I'd point most people to. It's open source (independently audited, nothing to hide), the free tier is genuinely enough for a single person across all their devices, and Premium costs about the price of a coffee per year. Not the prettiest, but rock solid and superb value — the sensible default.
1Password
Best polished / familiesThe most polished experience, and my pick if you want it to feel effortless or you're setting it up for a whole household. Excellent apps, brilliant sharing for couples and families, and thoughtful extras like travel mode. No free tier — but the paid plan is inexpensive for what it removes from your life.
Proton Pass
Best privacy bundleFrom the Swiss team behind Proton Mail. A strong choice if privacy is your priority or you already use (or fancy) their encrypted email and VPN, since it comes bundled. The standalone free tier is capable, and email-alias support is a neat bonus for cutting down spam and tracking.
NordPass
Easy · Nord bundleA straightforward, good-looking option from the team behind NordVPN — handy if you'd rather keep your password manager and VPN under one roof. The free tier covers one device; paid plans are inexpensive on longer terms (watch the renewal, as with all Nord products). Bitwarden is still my value pick, but NordPass is a solid, easy choice.
2. Two-factor authentication — the second lock
Turn it on for your email and money accounts today. It's free, and it stops a stolen password dead.
Two-factor authentication (2FA) means that even if someone has your password, they still can't get in without a second code from your phone or a physical key. Turn it on first for your email — because whoever controls your email can reset everything else — then your bank, your investment platform, and your password manager.
One important nuance: text-message (SMS) codes are the weakest form and can be defeated by "SIM-swap" fraud. Prefer an authenticator app, or better still a hardware key, wherever the account allows it.
An authenticator app
Free · do this nowA free app that generates a rotating six-digit code, far safer than SMS. Any of the well-known ones is fine; 2FAS and Authy make it easier to back up and move to a new phone. Whichever you pick, set it up for your email and financial accounts before anything else on this page.
YubiKey 5 (hardware key)
Strongest · phishing-proofThe gold standard. A small key that plugs into USB (or taps via NFC) and physically proves it's you — which makes it essentially immune to phishing, because there's no code for a fake site to steal. Overkill for some, but if you hold meaningful savings or crypto, a pair of these (one as a backup) is money very well spent. Buy direct from Yubico, or on Amazon below.
3. A VPN — useful, but oversold
The honest version: helpful in specific situations, not the magic shield the ads imply.
Here's the truth the sponsorships won't tell you: a VPN does not meaningfully "protect your bank account." Your banking connection is already encrypted, and a VPN can't stop you being phished or reusing a password. What a VPN genuinely does is hide your browsing from your internet provider and mask your location — useful on untrusted public Wi-Fi, for privacy from your ISP, or for reaching UK services while travelling. Worth having; just buy it for the right reasons.
Proton VPN
Best all-rounderIndependently audited, based in privacy-friendly Switzerland, and the only reputable name with a genuinely usable free tier (no ads, no data cap on the free plan's core use). If you want one VPN that balances trust, speed and price, start here.
Mullvad
Most privateThe privacy purist's choice. A flat €5 a month, no annual-plan gimmicks, and you can sign up with just a random account number — no email required. It won't nag you or run "80% off!" banners. If minimal data and maximum principle appeal, it's the one.
NordVPN
Most featuresThe big mainstream name for a reason — fast, easy, and packed with extras (threat protection, an included password tool, and so on). The catch is the pricing theatre: the cheap headline rate is a multi-year deal that renews far higher, so diarise the renewal and reassess.
4. The free habits that beat any purchase
No product required — just five minutes and a little discipline.
- Check if you've already been breached. Put your email into Have I Been Pwned — it's free and run by a respected security researcher. Any password tied to a breach should be changed today.
- Lock down your email first. It's the master key to your whole financial life. Strong unique password, 2FA on, recovery details current.
- Learn the one rule that stops most scams: a genuine bank will never ask you to "move money to a safe account" or read out a code. If someone rings and creates urgency, hang up and call back on the number from the back of your card.
- Consider a CIFAS Protective Registration (about £30 for two years) if you've been a fraud victim or lost documents — it flags your identity for extra checks when credit is applied for in your name.
- Freeze the impulse, not just the card. Most banking apps now let you lock a card instantly and set spending limits — a good habit for the account your day-to-day money sits in.
Do the free habits and set up a password manager with 2FA, and you're already safer than the overwhelming majority of people — hardware keys and VPNs are the refinements on top, not the foundation.
Protecting it is step one. Seeing it clearly is step two.
Once your accounts are locked down, WealthR gives you one honest picture of everything you've protected — accounts, pensions, investments and net worth in one place, with Scenarios to test the "what ifs." Free forever, and no bank linking, so there's no login to hand over in the first place.
See your whole picture free →Keep going
- Getting your affairs in order — where to keep the documents and passwords your family would need.
- The UK money reading list — the books worth your time.
- How WealthR keeps your data safe — our own security approach.