🔐
Password + Account Security Setup
Printable one-pager · Pakistan edition · maahir.io cheat sheets
MAAHIR
CHEAT SHEET
🔐 Password + Account Security Setup — one evening, done properly
✅ Core setup (do these in order)
- 1 password = 1 account. No exceptions — reused passwords are how one leak becomes 10 hacked accounts
- Use passphrases: 4 unrelated words + a number + symbol (e.g. Karachi-Mango-Tulip-Bus-42!) — long beats complicated
- Or use a password manager (any reputable one) and let it generate + remember everything
- Turn on 2-step verification (2FA) on: email first, then banking/wallets, then Facebook/Instagram/WhatsApp
- Prefer app-based 2FA codes (authenticator app) over SMS where offered
- Recovery email + phone set and VERIFIED on every important account
- Print your recovery codes and store them on paper at home — not in your email inbox
📱 SIM & phone (the most attacked link in Pakistan)
- Set a SIM PIN so a stolen phone can't be used to receive your OTPs
- Add biometric lock (fingerprint/face) + a 6+ digit passcode, not a pattern
- Check how many SIMs are registered on your CNIC via PTA's SIM Information System (SMS your CNIC number to the PTA check code — verify the current code on pta.gov.pk)
- Report SIMs you don't recognize to your operator immediately
🚫 Never, ever
- Share an OTP with anyone — banks, JazzCash, EasyPaisa staff NEVER ask for it
- Enter passwords on links received by SMS/WhatsApp — type the address yourself
- Use public charging points / free WiFi for banking apps
- Keep "remember me" on shared/family devices for money apps
- Post CNIC photos in WhatsApp groups (even for "forms")
🔁 Maintenance (2 minutes monthly)
| Done | Check |
|---|
| Password changed for email + banking if any breach news |
| Review "devices signed in" on Google/Facebook — log out unknown ones |
| Check bank statement for charges you don't recognize |
| Update phone apps + system (updates close security holes) |
If an account is compromised: change its password from a SAFE device first, then log out all sessions, then check recovery email/phone was not changed, then report. Order matters — cutting the attacker off comes before everything else.