Protect an account separately from your VPN connection

Start with the account itself

A VPN changes a network connection, but an account can still be taken over through a stolen password, a deceptive sign-in page, or access to an unlocked device. If your concern is losing an email or shopping account, spend time on that account’s sign-in and recovery settings. A different network address does not replace those controls.

Choose one important account to review first. Your main email is often a sensible starting point because it may receive recovery messages for other services. Open the account through a trusted bookmark or its official application rather than a link in an unexpected message asking you to improve security.

Understand what a passkey adds

Where supported, a passkey provides a sign-in method designed to resist phishing by binding authentication to the intended service. Google’s account documentation explains how passkeys work for Google accounts and how device screen locks are involved. Other services may offer different setup and recovery choices, so use their own instructions.

Create a passkey only on a device you control and protect. Do not add one casually to a borrowed or shared computer. Before beginning, check that you know how the account can be recovered if the device is lost. A stronger sign-in method is most useful when you also understand how to regain access legitimately.

Review recovery before removing anything

Look at the recovery email address and phone number, where the service uses them. Make sure they are current and belong to you. If recovery codes are offered, store them somewhere appropriate and private. Do not send them to support or include them in a screenshot. Anyone requesting a one-time code or recovery secret should prompt you to stop and verify the request.

Avoid removing every existing sign-in method immediately after adding a new one. Follow the service’s guidance and confirm that the new method works in your normal environment. The aim is to reduce account risk without accidentally locking yourself out during a rushed settings cleanup.

Practice a safer response to urgent messages

Imagine receiving a message that your account will be suspended unless you sign in immediately. Instead of using its button, open the service through your normal route and look for an account notification there. If the message is genuine, you should be able to investigate through the service itself. A VPN connection cannot determine whether the message’s demand is honest.

Finish the review by checking your device lock and any unfamiliar signed-in sessions shown by the account. Sign out sessions you do not recognize using the service’s own tools, and follow its recovery process if you suspect compromise. These steps address account access directly. Keep using the connection tools that fit your needs, but give each tool a clear job. A short, careful account review is more useful than assuming a general privacy application has already protected passwords, recovery channels, and every future sign-in attempt.

Revisit recovery settings after replacing a phone or changing an email address. A configuration that was sensible last year can become difficult to use if its recovery route no longer exists.