Most people are not targeted personally. They are caught by attacks that try leaked passwords or send fake messages to everyone.
Longer is stronger
A long passphrase of several random words is both stronger and easier to remember than a short complicated one.
One account, one password
A password manager remembers them for you, so that one leak cannot open everything.
Turn on two-step sign-in
Start with your email, because it can reset all your other accounts.
Pause before you click
Urgent messages are a warning sign. Open the real site yourself, and never share a sign-in code.
