Digital Account Security Audit: A Yearly Checklist for Email, Banking, and Social Media

Overview

Not every account deserves the same amount of attention. Start with accounts that can reset other passwords, move money, expose personal information, or reach a large audience. In most households, that means your primary email account first, followed by banking and payment accounts, then social media and shopping accounts.

Your account security audit should answer seven questions:

• Can you sign in using a strong, unique method?
• Is multifactor authentication enabled, and is the method still under your control?
• Are recovery email addresses and phone numbers accurate?
• Can you recognize every active session and trusted device?
• Do you still need every connected app, browser extension, and third-party service?
• Could you recover the account if you lost your phone or primary device?
• Would you notice an unusual sign-in, password change, payment, or profile change?

Use the provider’s official website or app rather than links in unexpected messages. Menu names change, but the relevant controls are usually grouped under sections such as Security, Privacy, Login, Account, Devices, or Notifications. If an option is unavailable, record what the service supports and strengthen the controls that are available.

Checklist by scenario

1. Primary email: protect the account that protects the others

Your main email account may receive password-reset messages for other services, so review it before the rest of your accounts.

• Change the password if it is reused, predictable, or known to have appeared in a credential leak. Use a unique password stored in a reputable password manager.
• Enable a phishing-resistant sign-in option, such as a passkey, where supported. Otherwise, use an authenticator app or another strong multifactor option rather than relying only on a password.
• Confirm the recovery email address and phone number. Remove old numbers, former work addresses, and accounts you can no longer access.
• Review recent sign-ins, active sessions, and trusted devices. Sign out of anything unfamiliar, shared, lost, or no longer needed.
• Inspect forwarding rules, filters, delegation, automatic replies, and mailbox access. An attacker may use these settings to hide security messages or copy incoming mail.
• Generate backup codes if the provider offers them. Store them offline or in a protected password-manager record, not in the same inbox they are meant to recover.
• Check security notifications and make sure alerts reach a channel you monitor.

2. Banking and payment accounts: reduce unauthorized access and delay

Use a known bookmark or type the institution’s address yourself. Never use a link from an unexpected text, email, or phone call to perform this review.

• Verify your password is unique and that multifactor authentication is enabled.
• Review account alerts for sign-ins, transfers, new payees, card activity, profile changes, and password or contact updates. Choose notifications you can act on promptly.
• Inspect linked external accounts, saved payment methods, authorized users, beneficiaries, and transfer destinations. Remove anything you do not recognize or no longer use.
• Review recent transactions and statements for unfamiliar activity. Contact the institution through its official channel if something does not match your records.
• Confirm your email address and phone number are current, but avoid treating text-message codes as your only protection when stronger options are available.
• Ask how the institution handles suspicious activity and account recovery, then save the official contact route separately from your login details.

3. Social media: limit takeover and impersonation damage

• Use a unique password and enable multifactor authentication or a passkey if supported.
• Review active sessions, logged-in devices, and recent login activity. End sessions you cannot identify.
• Remove unfamiliar connected apps, games, business tools, advertising accounts, and browser access.
• Check recovery contacts, profile email addresses, phone numbers, and account-recovery contacts.
• Review notification settings for sign-ins, password changes, direct messages, and profile edits.
• Inspect posts, messages, payment settings, administrator roles, and linked pages for changes you did not make.
• Confirm privacy settings separately from security settings. A privacy review can reduce exposure, but it does not replace login protection.

For a broader phone, browser, and social-app review, use this privacy settings audit checklist.

Quick comparison

What to double-check

Security settings can appear correct while recovery or access paths remain weak. Pay particular attention to these details:

• Recovery email: It should be an account you actively protect. Do not use an abandoned address or an inbox with a reused password.
• Authentication method: Make sure you can use the method today. If you changed phones, transfer or replace authenticator access before deleting the old device.
• Backup codes: Check that the saved copy is readable, current, and stored separately from the account. Regenerate codes if you believe the old set was exposed.
• Active sessions: A familiar device name does not always identify every browser session. When in doubt, sign out and log in again from devices you control.
• Connected services: Remove access for apps you no longer use. A service that was legitimate when authorized may still hold more access than you need.
• Account-recovery contacts: Confirm that trusted contacts or administrators are still appropriate. For shared or family accounts, document who is authorized to help.
• Alerts: Notifications should go to a monitored address or device. Treat unexpected security alerts as a reason to open the account directly, not as a reason to click immediately.

If you receive a warning about a sign-in or password change, follow a separate response process rather than waiting for the annual review. See security alert triage guidance for a practical sequence.

Common mistakes

• Auditing only passwords: A strong password cannot compensate for an exposed recovery address, unknown session, or malicious forwarding rule.
• Using the same recovery channel everywhere: If one email address or phone number is compromised, it may create a path into several accounts. Protect the recovery account first.
• Leaving old devices signed in: A sold, lost, shared, or repaired device may still have an active session. End sessions remotely when possible.
• Saving backup codes in the inbox: Anyone who gains access to the inbox may gain access to the recovery material as well.
• Approving unexpected login prompts: Reject prompts you did not initiate. Repeated prompts can indicate that someone knows your password or is testing your account.
• Trusting a message’s urgency: Verify alerts through the official app or website. For breach-related messages, use this guide on verifying a data breach notification.
• Making changes during a suspected takeover without documenting them: Note the time, alerts, devices, and actions taken. This record can help when contacting a bank or service provider.

When to revisit

Schedule a full digital security checkup at least annually, and consider a shorter quarterly review for your primary email and financial accounts. Revisit the checklist immediately after any of these events:

• You buy, lose, replace, or repair a phone or computer.
• You change your primary email address, phone number, password manager, or authenticator.
• You receive a suspicious sign-in, password-reset, breach, or payment notification.
• You discover a reused password or learn that a service you use experienced a data exposure.
• You add a bank, payment, social media, business, or recovery account.
• You remove a shared user, employee, family member, administrator, or third-party integration.
• A provider changes its login, recovery, passkey, or security-notification workflow.

Keep a simple audit record with the account name, review date, unresolved issues, and next action. Do not record passwords or full backup codes in that document. When an audit reveals exposed credentials, prioritize the email account that can reset other accounts, then financial accounts and any account using the same password. For additional steps, see credential leak check guidance and SIM-swap protection guidance.

Start with your primary email today, complete the three highest-risk accounts, and set a calendar reminder for the next review. A short, repeatable audit is more useful than a one-time attempt to change every setting at once.