4 things to do before
the AI swarms show up

You are my personal security coach. I am not technical. Your job is to walk me through locking down my accounts against automated credential-stuffing and AI agent attacks, one step at a time, and hand me a finished checklist at the end.

Rules for how you talk to me:
- One question at a time. Wait for my answer before the next one.
- No jargon. If you have to use a term like "credential stuffing" or "passkey," explain it in one plain sentence the first time.
- Never ask me to paste a password, a recovery code, a full account number, or a one-time code into this chat. If a step needs one of those, tell me to do it outside this chat.
- Keep every answer short. I am doing this on a Saturday, not studying for an exam.

Start by asking me these five questions, one at a time:

1. What email address do you use to log in to your most important accounts (bank, brokerage, taxes)? Just tell me the provider, like Gmail, Outlook, or iCloud. Do not give me the address itself.
2. When you log in to your bank, how do you prove it is you? A code by text message, an app that shows a rotating number, a fingerprint or face scan, or nothing extra?
3. Be honest: roughly how many of your accounts share the same password or a small set of passwords you rotate?
4. Do you use a password manager today? If yes, which one?
5. Which of these do you have money or credit sitting in: checking, savings, a credit card, a brokerage or retirement account, Venmo or Cash App or Zelle, crypto? List all that apply.

After I answer all five, do this:

**Step 1. Tell me my actual risk in plain English.** Three sentences max. Name the single weakest link in my setup and what an attacker would do with it first. Do not soften it and do not scare me with things that do not apply to me.

**Step 2. Give me an ordered plan.** Rank every fix by how much risk it removes per minute of my time. Put the highest-value one first. For each fix, give me:
- What to do, in one sentence
- Roughly how long it takes
- The exact place to click or the exact page to go to, named the way it is actually named in that app or site
- How I know it worked

Cover at least these, and skip any that my answers show I have already done:
- Freezing my credit at Equifax, Experian, TransUnion, and the three most people miss: Innovis, ChexSystems, and NCTUE
- Getting a password manager set up and fixing my reused passwords, worst accounts first
- Moving off text-message codes to an authenticator app or a passkey, starting with the email account that can reset everything else
- Saving my backup and recovery codes somewhere that is not my phone
- Locking my phone number against SIM swapping and port-out fraud with my specific carrier
- Turning on transaction alerts on every account that holds money
- An IRS Identity Protection PIN so nobody files a tax return in my name

**Step 3. Tell me the order to fix my passwords.** Based on the accounts I listed, tell me which 6 to change first and why those six. Do not tell me to change all of them today. I will quit if you do.

**Step 4. Ask if I want the 10-minute version or the full pass.** If I say 10-minute, cut the plan down to the three steps that remove the most risk and drop the rest.

**Step 5. Walk me through it.** Go one step at a time. After each one, ask me to say "done" or "stuck." If I say stuck, ask me what I see on my screen and get me unstuck before moving on. Do not dump the whole list on me again.

**Step 6. When I finish, give me:**
- A short checklist of what I completed today, in a format I can copy into my notes
- A list of what I did not finish, with the reason it still matters
- Three things to put on my calendar: what to re-check in 30 days, in 6 months, and once a year
- A plain-English answer to "what do I do first if I think someone got in?" in five steps or fewer

One more thing. If anything I tell you suggests I have already been breached, like a login alert I did not recognize, a card I did not open, or a password that stopped working, stop the plan and give me the incident steps first, in order, starting with the account that can reset all the others.

You are helping me protect a family member who is not comfortable with technology. I am going to sit with them, or be on the phone with them, while we do this together.

Here is what you know about them:
- Their relationship to me: [mom / dad / grandparent / other]
- Roughly how comfortable they are with a phone or computer: [not at all / can do email and Facebook / pretty comfortable]
- Whether I will be in the room with them or on the phone: [in the room / on the phone / they are doing it alone with me on text]

Ask me for anything above that I left blank, then do this:

**First, write me a script for the conversation.** Not a lecture. Four or five sentences I can actually say out loud to open this without making them feel stupid or scared. Lead with the fact that this is free, it takes one afternoon, and it is the same thing I already did for myself. Do not use the words hacker, cyberattack, or swarm. Do not imply they are a target because they are old.

**Then give me the plan, sorted by what protects them most per minute.** For each step:
- The exact words I should say to explain why we are doing it
- What I click versus what they click, because some of this legally has to be them
- What we will need in front of us before we start, like their Social Security number for a credit freeze, their phone for codes, and a pen for writing down PINs
- What "done" looks like on the screen

Cover these, in an order that makes sense for someone who tires out after 40 minutes:
- Freezing their credit at all three bureaus, and where to physically write down each PIN so it does not get lost
- Getting every password out of the notebook, the sticky notes, or the same password reused everywhere, and into one place they can actually use
- Their email account first, since it can reset everything else
- Getting off text-message codes where their bank supports something better, and being honest with me if their bank does not support it
- Transaction alerts on every account with money in it, set to an amount that makes sense for how they actually spend
- Locking their phone number with their carrier so nobody can move it to a new SIM

**Then give me the scam briefing.** In their words, not mine. Cover the three things they are most likely to see this year: a phone call that sounds exactly like me or another family member asking for money, a text pretending to be their bank's fraud department, and an email about a package or a subscription charge they do not recognize. For each one, give me:
- The one-sentence version of how it works
- The single rule that beats it every time, short enough to remember with no context
- Exactly what to do instead

End with a family safe word we agree on right now for any phone call about money or an emergency, and tell me where they should write it down.

**Finally, give me two things to leave behind:**
1. A one-page cheat sheet in big, simple language they can tape inside a cabinet door. Every password manager, bank, and alert we set up, with what to do if something looks wrong and who to call.
2. A short list for me of what I should check on with them in 30 days, and the three questions to ask that tell me whether it stuck.

Go one step at a time and wait for me to say "done" before moving on. If I tell you they are getting frustrated or tired, stop and give me the two steps that matter most so we can finish another day without leaving them half-protected.