Fieldbook to AIThe plain-English guide to which AI to use

For everyone

What to do right now to stay safe

Start with your email. A person who gets into email can reset your other accounts. Later steps cover your devices, your credit, copied voices on the phone, and what you type into a chatbot. If you only use a free chatbot, skip the last step.

Last updated .

Checked on October 29, 2026. This is general guidance, not professional security advice.

This list is for people who use a phone, email, and maybe a free chatbot such as ChatGPT. You do not need to be technical. Do the steps in order. Times are planning estimates, so you can see what fits in an evening.

  1. Lock your email with a passkey or an authenticator app
  2. Give every account its own password
  3. Turn on automatic updates
  4. Pause when a message says you must act now
  5. Freeze your credit
  6. Agree on a family code word
  7. Keep secrets out of chatbots
  8. Decide whether chats train the model
  9. Only if you created an API key: replace it and cap spending

1. Lock your email with a passkey or an authenticator app

Your email is the account to protect first, because password resets for everything else arrive there.

A passkey is a sign-in stored on your phone or computer. You approve it with the same unlock you already use on that device. An authenticator app is a phone app that shows a code which keeps changing. A code sent by text message is easier for a scammer to intercept. The FTC says an authenticator app or a security key is the stronger choice when you have the option. On CISA's list, a text-message code sits at the bottom, below an authenticator app and a physical security key.

Plan on about 20 minutes for the email you use most. If your bank's app offers a passkey or an authenticator app, do the bank the same day.

Open the bank app you already installed, or type the bank's address yourself. Do not follow a link in a text or email to reach security settings. If someone calls and asks you to read them a code, hang up and sign in yourself.

How to do it:

Source: FTC, protect your personal information. CISA, why a strong password is not enough.

2. Give every account its own password

A password manager is a program that creates long passwords, stores them, and fills them in for you. You remember one passphrase for the manager. When one site is breached, your other accounts do not share that password.

CISA says a strong password is long (at least 16 characters), random, and used nowhere else. The FTC says that if you invent a password yourself, aim for at least 15 characters, and that letting the browser or phone create one is the easier path. Let the manager invent them.

Plan on about 15 minutes to turn a manager on and save your email password. Change the rest the next time you sign in somewhere.

The manager already on your phone or in your browser is enough to start. Some other managers cost money. CISA suggests reading reviews before you pay for one, and names Consumer Reports as one place to look.

How to do it: the FTC's password guide links the steps for Chrome, Edge, Firefox, iPhone, and Android.

Source: CISA, use strong passwords.

3. Turn on automatic updates

Companies ship fixes for holes that are already being used. The fix protects you only after it is installed. Automatic updates do that without waiting for you to remember.

Plan on about 10 minutes to check the phone, the computer, and the browser you actually use. When a device says a security update is ready, install it.

How to do it:

Source: CISA, update software. The FTC gives the same advice on the personal information page.

4. Pause when a message says you must act now

Phishing is a text, email, direct message, or call that pretends to be someone you trust, so you will open a link or hand over a password. CISA says urgent language is a common sign, especially a threat if you do not respond immediately. So is a request for personal or financial information. CISA also says perfect grammar is no longer a reliable sign, because AI now writes clean messages.

Do not tap the link or open the attachment. Delete the message. Skip any unsubscribe link in a message you were not expecting. If it might really be your bank, a shop, or a friend, type an address you already know, or open the app you already installed. You can also call or text that friend on a number you had before this message arrived.

You can forward an unwanted text to 7726. The FTC recommends that number, which spells SPAM on a keypad. To report a scam, use ReportFraud.ftc.gov.

This is a habit. It takes a few seconds whenever a message rushes you.

Source: CISA, recognize and report phishing. FTC, spam texts and emails.

5. Freeze your credit at the three bureaus

A credit freeze means a lender cannot open a new account in your name while the freeze is on. That includes you, until you lift it. The FTC says a freeze is free, it does not change your credit score, and it lasts until you lift it. You do not have to wait for a data breach. Anyone can place one.

You contact each bureau yourself. Equifax, Experian, and TransUnion keep separate freezes. When you need a lender to see your file, lift the freeze at the bureau that lender uses, then put it back. The FTC says you may need a lift to apply for credit, start a job, rent an apartment, or buy insurance.

Save each credit bureau's freeze PIN or login in your password manager. You'll need it to lift the freeze later.

USAGov says an online or phone request has to be finished by the bureau within one business day. A mailed request can take up to three business days. A fraud alert is a different tool, explained on the same FTC page. It asks a lender to check that it is you, and it does not stop the lender from seeing the report.

Plan on about 45 minutes the first time, because each bureau has its own form.

If a child is under 16, the FTC says you can request a freeze for them too, and the steps are different from an adult freeze. Use the bureau pages for those instructions.

How to do it:

Source: FTC, credit freezes and fraud alerts.

6. Agree on a family code word

The FBI says criminals can copy a relative's voice from a short recording, then call with a crisis and ask for money right away. Agree on a secret word or phrase that only your family knows. Pick something you can remember when you are worried. Keep it off social media.

If a call like that comes, do not trust the voice. Hang up and call the person back on the number already saved in your phone. The FTC says the same, and says not to use a number the caller gives you. If you cannot reach them, try another relative. Do not send gift cards, a wire transfer, or cryptocurrency because the caller is rushing you.

The same trick works at work. Agree on a check-back step for any urgent "boss needs gift cards" or wire request.

Plan on about 10 minutes to pick the word and tell the people who would get that call.

Source: FBI IC3, criminals using generative AI for fraud (published December 3, 2024; page still up when checked). FTC, fake emergency scams.

7. Keep secrets out of chatbots

Do not paste a password, a Social Security number, or a full card or bank number into a chatbot.

Anthropic's help page for Claude asks people to be careful with Social Security numbers, card and bank numbers, passwords, and medical records. OpenAI says not to enter a card number, the short security code, or a PIN into ChatGPT inputs, including chats, files, and custom bots. When ChatGPT is browsing the web for you, OpenAI also says not to paste passwords or payment details into the conversation.

Use that same care in Gemini and in any other chatbot. If you already pasted a password or a full card number, change the password or ask the bank for a new card.

Plan on a minute to make this a rule. Replacing a password you already pasted takes longer.

Source: Anthropic, sensitive data in Claude chats. OpenAI, card data in ChatGPT. OpenAI, cloud browser.

8. Decide whether your chats train the model

The company that runs the app can still store the chat. The switch decides whether new chats may be used to train future models. Each page below lists exceptions, so read the one for the app you use.

ChatGPT (personal Free, Plus, or Pro). Open Settings, then Data controls, and turn off "Improve the model for everyone." OpenAI says that sharing is on until you turn it off. New conversations are then left out of training, and your chat history stays. Voice mode has a separate control, described on that same page. A temporary chat is left out of training while it stays temporary. If you save it, your normal setting applies.

Claude (Claude Free, Pro, or Max). Open Settings, then Privacy. Under "Help Improve our AI models," turn the switch off if you do not want chats used for future training. Anthropic says a conversation that its safety checks flag can still be used to improve those checks. An incognito chat is not used to improve Claude, even if the switch is on.

Gemini. Open Settings and help, then Activity. Google says that if you are 18 or over, Keep Activity is on until you change it. Choose Turn off to stop new chats from being used to train Google's AI models, unless you send feedback. Choose Turn off and delete activity if you also want the saved activity removed. Either way, new chats do not appear in your Gemini activity. Google still keeps new chats for up to 72 hours so the app can answer you and handle safety.

Plan on about 10 minutes for each app you actually use. Skip the ones you do not have.

How to do it:

Source: those three help pages, checked on October 23, 2026. Work and school accounts can be locked by an administrator, so the switches above may be missing there.

9. Only if you created an API key: replace it and set a cap

Skip this if you only use the ChatGPT, Claude, or Gemini app or website.

An API key is a long secret that lets a program spend against an AI account. If a coding tool or a host told you a key may have leaked, replace the key at the company that issued it. A delete button inside the tool can leave the old key working at that company. Then set a monthly cap, so a copied key cannot keep running up a bill.

If you stored secrets on Railway, their notice of October 21, 2026 says an unauthorized party may have accessed customer environment variables, including some decrypted ones, and asks customers to replace those secrets. Railway's notice.

Plan on about 15 minutes if you already know where the keys are.

If you lost money, or you think someone opened an account in your name, report it at ReportFraud.ftc.gov and at the FBI's IC3. The FTC's recovery steps start at IdentityTheft.gov.

Short guides: AI scam calls and fake AI apps.

Spot a mistake? Email us. Say which step and which link. Fixes are recorded in the changelog.