The quiet collapse of the basics.

For twenty years the security advice barely changed. Use long, different passwords. Turn on the second step. Slow down before you click. The advice was good, and it worked, and by 2022 most people were actually doing it. Then something strange happened. People kept hearing the advice, agreed it was right, and quietly stopped doing it. The basics did not fail. We let go of them.

The clearest single measure is the second step, the one-time code or prompt that stops a stolen password from being enough. A long-running survey of more than 25,000 adults found that regular use of it fell off a cliff in three years.

Regular use of the second login step is falling

Share of surveyed adults who regularly use multi-factor authentication.

In plain terms: regular use of multi-factor authentication fell from 94% in 2022 to 53% in 2025. Over the same period, people who always check messages for signs of phishing fell from 51% to 36%. Source: National Cybersecurity Alliance five-year survey, February 2026.

It would be easy to read that as people getting lazy. The data suggests something sadder and more human. Over the same years, the share of people who feel that protecting themselves online is simply hopeless rose from 22% to 34%. More than a third of adults have decided the effort is futile. When you believe the lock cannot hold, you stop turning the key.

The fatalism is not irrational

People feel surrounded because, in a sense, they are. In a 2025 survey, 73% of US adults said a scam or online attack had happened to them, and nearly a third said it had happened in the past year. Almost three in ten had an account taken over. Separately, 41% of adults told pollsters that scammers target them every single day, and most said they would not even know where to report a $5,000 loss.

So the exhaustion makes sense. The mistake is the conclusion. Feeling targeted constantly is an argument for a few strong habits, not for giving up on all of them. The attackers are counting on the surrender, because the surrender is what makes the old, simple tricks keep working.

The gap is no longer what people know. It is the quiet distance between knowing and doing, and that is where almost all the losses live.

The few habits that actually carry the weight

Here is the part that should lift the mood. You do not need to do everything, and the fantasy that you must is part of what produces the paralysis. A small number of habits stop the large majority of real attacks. If fatalism has crept in, do only these, and do them well.

Use a password manager, and let it do the work. The reason unique passwords collapsed is that no human can remember a hundred of them, and a recent survey found 41% of people never use a manager and only 62% regularly create unique passwords. A password manager removes the memory problem entirely. You remember one strong phrase; it handles the rest, and it will not be fooled by a convincing fake of a login page, because it checks the real web address before it fills anything in.

Protect the few accounts that unlock the others. Not every account deserves the same care. Your email, your phone account, and your main bank are the master keys, because whoever controls your email can reset the password on nearly everything else. Put the strongest protection you have on those three first. If you do nothing else this month, do this.

Take the upgrade when the platform offers it. The good news that rarely makes headlines is that the defenses are getting easier. Passkeys, which replace passwords with something built into your phone or laptop, are now recognized by 90% of consumers, and three-quarters of people have enabled at least one. They resist the fake-login trick by design. When your bank or email offers one, say yes; it is less effort than the password it replaces, not more.

Keep one human pause. The single habit that survives every new kind of attack is the decision to slow down when money or urgency appears. You do not have to detect the fraud. You have to refuse to be hurried, and to verify through a channel you chose, not the one the message gives you.

Why testing beats lecturing

There is a reason knowing has stopped producing doing. Advice is abstract, and abstract things are easy to agree with and easy to postpone. A test is concrete. When a household actually tries to log in and discovers that its second step was never turned on, the gap stops being a statistic and becomes a five-minute fix.

That is the entire premise of what we do, and it is why our lowest tier is built to prove something real on your own accounts in the first week, rather than hand you another list. The advice in this piece is free and sufficient for most people. The value is not in hearing it again. It is in the afternoon you spend turning it into settings that are actually on.

The basics did not stop working. We drifted from them, understandably, under a steady rain of bad news. The repair is not heroic. It is a password manager, three protected accounts, one upgrade when offered, and one habit of pausing. Do those, and you have quietly rejoined the 53%, with most of your risk already behind you.

What to look out for

The honest self-check

1. Reused passwords. If you are typing the same password into more than one site, one leak opens all of them.
2. No password manager. Relying on memory is why unique passwords fail; a manager also blocks fake login pages.
3. Your email without strong protection. Email resets everything else, so it needs your best defense first.
4. A passkey offer you skipped. These are easier than passwords and resist fakes; accept them when offered.
5. The feeling that it is hopeless. Fatalism is the attacker's best friend; narrow your effort to the few habits above.
6. Advice you agree with but never acted on. Pick one item today and change the actual setting, not the intention.

Sources

1. National Cybersecurity Alliance, five-year behaviors and attitudes findings, 2026-02-25.
2. Pew Research Center, on online scams and account takeovers, 2025-11-19.
3. National Cybersecurity Alliance / CybSafe, Oh Behave 2025–2026, 2025-09-30.
4. Stop Scams Alliance / Gallup, 2026-06-30.
5. FIDO Alliance, State of Passkeys 2026, 2026-05.