Two-step verification means that when you sign in, besides the password you confirm a second time that it is really you. Tapping "yes" on a pop-up on your phone blocks more than 90% of phishing-based account takeovers. The older method of answering questions like "where did you last sign in" or "what is your backup email" stops only about 10% of them.
A password stolen from another website gets used to log straight into your email. Once someone is in your email, every account that can reset its password by email goes down with it. So give your email its own password and use it nowhere else.
The SIM card is the small card inside your phone, and text-message codes arrive through it. If you lose your phone, whoever finds it can pull this card out, put it in another phone to receive the codes, and then reset your accounts one by one. If you set a PIN on the card, then once the card is moved to another phone it asks for this code as soon as the phone starts, and that route is closed.
The order matters more than speed. First report the SIM card lost, which cuts off the lifeline of verification codes. Next lock the phone remotely, then use a computer to change your email and payment passwords, then call the police and get a receipt, and finally freeze your bank cards if needed. If you don't have your phone, you can borrow someone else's to call the carrier's customer service and report the loss.
"Signed-in devices" are the phones and computers that can still use your account right now. If the list shows a device you don't recognize, or software you stopped using long ago is still connected to your account, change the password first, then sign out of all devices. In your email, also check for any automatic forwarding you didn't set up.
A relay sits between you and the model provider, and it can see and change what you send and the answers that come back. One study tested more than 400 relays: 9 injected malicious code into the answers, and 17 used cloud-service keys that the researchers had planted on purpose. If you let the AI run commands automatically, one altered command is enough to let someone install malicious code on your computer.
After a phone number is canceled, the carrier can reissue it to someone else after as little as 90 days. Accounts you haven't re-linked are still tied to this number, so verification codes go to the new owner's phone, and he may use a code to log in to your account. So before you switch numbers, change the number linked to your accounts, and the number your bank has on file, to the new one.
