Somewhere out there is an account you opened in 2009 to buy a printer cartridge. It still has your email address, probably your home address, and almost certainly the same password you use for three other things. You’ve forgotten it exists. A criminal with a leaked password list hasn’t.
This is your digital loft: years of signups, free trials and forum logins you’ve stopped thinking about. Most of it is harmless clutter. Some of it is a way in. Give it an hour, ideally before the run-up to Christmas, when the scam texts start arriving faster than the cards.
Why do old accounts matter if I never use them?
Because criminals don’t need to hack your bank. They only need a password you’ve used before. When a website is breached, the stolen email addresses and passwords end up in huge lists that are traded and tried, automatically, against other sites. This is called credential stuffing: a bot tries your old password on your email, your Amazon account and your bank to see which door opens.
If you’ve reused that password, it works. If the account that leaked was a long-dead hobby forum, you may never have been told.
Your email account is the one to worry about most. Whoever controls it can press “forgot password” on almost everything else you own. Treat it as the front door key, not just one more login.
Minutes 0–15: find out what has already leaked
Start with Have I Been Pwned, a free and well-respected service run by the security researcher Troy Hunt. Type in your email address and it tells you which known data breaches it has turned up in. Do it for every address you’ve used, including the old Hotmail or BT Internet one you keep for junk.
Don’t panic at the results. Most people who’ve been online for twenty years will see a list. What matters is what was taken. If a breach included passwords, any account still using that password, anywhere, needs changing today. You can also sign up for free alerts so you hear about future breaches.
While you’re at it, check your browser’s built-in password checker. Chrome, Edge, Firefox and Apple’s Passwords app all flag saved passwords that are weak, reused or known to be compromised. It’s a ready-made to-do list.
Minutes 15–35: get a password manager and fix the big five
A password manager is an encrypted vault that remembers your passwords for you, fills them in and generates new ones. You remember one strong master password; it remembers the rest. The NCSC, the UK’s National Cyber Security Centre, recommends using one, and it’s the single change that makes the rest of this clean-up stick.
Bitwarden is the obvious place to start: it’s open source, its free plan covers unlimited passwords across all your devices, and the paid tier is cheap. 1Password is the polished alternative and has no free plan, but it’s very good, particularly if you want to share a vault with a partner. If you live entirely in Apple’s or Google’s world, their built-in password managers are perfectly decent and cost nothing.
For the master password, use the NCSC’s advice: three random words strung together, something like a mental picture only you would come up with. Long beats clever.
Then don’t try to fix everything at once. Change the passwords on the five accounts that would hurt most: your main email, your bank, your mobile network account, Amazon or wherever your card is saved, and your Apple or Google account. Make each one unique, and let the manager generate them.
Your email is the master key to your whole digital life. Protect it first, and properly.
Minutes 35–50: switch on 2-step verification and close what you don’t need
2-step verification (2SV) means that logging in needs something more than your password, usually a code from an app or a text, or a tap on your phone. The NCSC calls it one of the most effective things you can do, because a stolen password on its own is no longer enough. Turn it on for those same five accounts. An authenticator app is better than text messages if you’re happy to use one.
Where a site offers passkeys, consider them. A passkey replaces the password with your phone’s fingerprint or face unlock, and there’s nothing for a fraudster to phish.
Now the actual clear-out. Scroll through your password manager or your browser’s saved logins and ask of each one: do I still use this? If not, log in and delete the account rather than just abandoning it. Under UK GDPR you have the right to ask a company to erase your personal data, so if there’s no delete button, an email to their support team asking for erasure should do it. Old shopping accounts with a saved card are the priority.
Finally, check what’s connected to your Google, Apple, Facebook or Microsoft accounts. Years of “sign in with Google” leave a trail of apps with access you’ve forgotten about. Revoke anything you don’t recognise.
How do I spot a fake HMRC or bank text before Christmas?
The last ten minutes are about the attacks that don’t need a breach at all. The run-up to Christmas brings a predictable wave of messages: a parcel you supposedly missed, a bank warning of a suspicious payment, or HMRC offering a tax refund. HMRC says it will never text or email you about a refund. Banks won’t text a link asking you to log in, and won’t ask you to move money to a “safe account”.
The rule is simple: never use the link or number in the message. Open your banking app or type the address yourself. If a caller claims to be from your bank, hang up and ring the number on the back of your card, ideally from a different phone.
Report what you get, because it helps get scam sites taken down. Forward scam texts to 7726, a free service run by the mobile networks. Forward suspicious emails to report@phishing.gov.uk, which goes to the NCSC. HMRC-themed texts can also go to 60599, and emails to phishing@hmrc.gov.uk.
If you’ve already lost money, call your bank straight away, then report it to Action Fraud, the national reporting centre for fraud and cybercrime in England, Wales and Northern Ireland. In Scotland, report it to Police Scotland on 101.
In short
Your biggest online risk is probably an account you’ve forgotten about, protected by a password you’ve reused. Spend an hour checking your email addresses on Have I Been Pwned, setting up a password manager such as Bitwarden or 1Password, making the passwords on your five most important accounts unique and turning on 2-step verification. Delete what you don’t use, and never trust a link in a bank or HMRC text.
Sources
Midcent Tech
Alex Innes explains technology for men 45 and over who have seen every gadget since the ZX Spectrum and are not easily impressed. AI and ChatGPT, phones, cars, the smart home, the subscriptions worth keeping and staying safe online – what it does, whether it's worth the money, and whether you need it at all.
One of Midcent's writers. Spotted something? Write to alex@midcent.uk.
