Without a PIN, hackers can hijack your mobile, take control of your phone number, and use that number to gain access to your online accounts.

It’s fairly easy for a hacker to hijack your mobile, take control of your phone number, and use it to bypass two-factor authentication you have set up and break into your online accounts.

Your phone number is how a number of companies, including your bank, email provider, and social media services, verify it’s actually *you* when you log in. It’s also how many of those companies recover your account (using a text message or phone call) when you forget your password.

This vulnerability is very scary — but it’s easy to protect yourself: by making your passwords better.But before we get into how to lock down your digital life, here’s some background on why you should.

You might have heard a lot about “two-factor authentication,” “2FA,” or “two-step verification.”

It’s a type of account login that requires two factors, typically a password and an additional verification code.

You also might have heard that two-factor is important, because passwords alone aren’t good enough.

Because a lot of people reuse passwords, one company’s security breach can affect multiple accounts. And there are a lot of security breaches. In fact, cyber crime happens more often now than ever, in part because so much of our stuff (our finances, communication, bills, etc.) lives online.

But if you’ve set up SMS-based two-factor authentication, it can be bypassed.

Hacks are becoming increasingly sophisticated.

If a hacker can get control of your mobile account, that can leave your accounts vulnerable in another way because some services use SMS or a phone call for account recovery when you forget your password.

So, here’s what you can do about protecting your online accounts right now.

1. Everyone who has a cell phone Adding a PIN or passcode to your cell phone  (that you change regularly!) As long as you can create your own PIN,

2. Review your online accounts. Make a list of all of your online accounts.

There are several other methods you can use as your second “factor” that are safer than text message-based verification.

Using security keys, like the ones from Yubico called Yubikeys. It’s a physical thumb drive-shaped accessory that fits on your keychain. To use it as a second factor, you plug the key into a USB port on your computer, or, if it has an NFC wireless chip in it, hold the key up to your NFC-enabled Android phone. People with iPhones will need to use an authenticator app These keys are much safer because hackers have to have your physical key, and have your correct password, in order to breach your account. I will note that security keys won’t work for people who use the Safari browser, but they will work for those who surf the web on Chrome.

You can use security keys as secure logins on sites like Google, Facebook, Dropbox;

3. That brings us to the next best method: third-party authenticator apps.

An authenticator app, like Authy (for iOS and Android) and Google Authenticator (for iOS and Android), can serve as a backup for your security key or a standalone second factor for an account. Some apps don’t support security keys, but they DO support authenticator apps, like Twitter.

Here's how to setup the Google Authenticator App or Authy app for your Google account. You can set up your app with Facebook, Amazon , Dropbox, and Twitter as well.

“Authenticators are great because they do quite a few things well: They can be used to authenticate into an account if you’re on a plane and the device is offline, or if you’re traveling and you can’t receive SMS messages,”

Adding a PIN to your mobile account and making sure you have some form of two-factor authentication set up is this best way you can take your online security into your own hands. No protection method is a 100% guarantee that you won’t be hacked, but having some protection rather than nothing at all is a much better place to be.