Mitigating Digital Risks (VPNs, Password Management)

Your instinct is right, and the VPN line in particular should go. A VPN hides your traffic from the network you are on and from your internet provider. It does not stop an account being taken over, it does not protect you from someone with access to your device, and the sites you sign into still know exactly who you are. Free VPN services are often worse than none, because the traffic goes to a company you know nothing about.

The two changes that would have made a difference are simpler. Turn on two-step verification on the email account, which is the account that can reset all the others. ENISA puts this first as well, and suggests a passkey, a security key or an authentication app in preference to a code by text message.

And stop reusing passwords, which is the way most accounts are actually lost. That means a password manager, because remembering a different long password for every service is not a thing people do. Long and unique matters more than adding symbols to something short.

Password managers are the part I struggle to get people to adopt. It feels like a big change to ask for.

Do not ask for the big change. Set it up together in the session for one account, the email account, and stop there. Someone who leaves with a manager holding a single strong password will add the next one herself. Someone told to migrate thirty passwords will not start.

Two cautions worth writing into the sheet. On a shared device a password manager can make things worse, not better, because it puts every account behind one unlock that someone else may be able to reach. Check who else uses the phone before recommending it.

And write down what happens if she forgets the master password, which is usually that the contents are gone. Say it before she starts rather than when it happens. Also worth adding: recovery details matter as much as the password itself. An account whose recovery phone number belongs to somebody else is not really hers.

One more failure mode that hits this group specifically and almost nobody else: changing the phone number. A woman who arrives, sets up accounts on a temporary SIM and later moves to a permanent number can be locked out of everything at once, because the recovery code goes to a number she no longer has.

So when you set up two-step verification with someone, use an authentication app rather than text messages where the service allows it, save the recovery codes somewhere she can actually reach, and put changing the recovery number on the list of things to do before she gives up an old SIM.