A shared project inbox can open the door to more than email. If its password is also used for a document portal, one stolen login could expose drawings, bids, client correspondence, or payment instructions. Start by identifying accounts that can access sensitive information, authorize spending, or reset other passwords. Secure those first.
For property owners and project teams, that list may include permit portals, cloud drawing folders, building-management systems, supplier portals, and utility accounts. The same precautions apply to personal email, banking, and shopping accounts. The goal is to make a stolen password insufficient, limit each account’s reach, and keep a way back in if a device is lost—not to make legitimate access needlessly difficult.
Start with the accounts that control everything else
Give primary email particular attention. Password-reset messages for other services often arrive there, so someone who takes it over may be able to reach those accounts too. The account used to manage a password manager is just as important. For a business, add domain administration, cloud storage, accounting software, and any service that lets users invite others or change permissions.
Make a short inventory instead of trying to remember every login. Record the service, who owns the account, whether it can authorize payments or open confidential files, and how recovery works. Leave passwords out. For organizational accounts, distinguish the person who uses a login from the organization that must retain control when that person leaves.
- Highest priority: primary email, password manager, financial accounts, administrator accounts, and services used to reset other logins.
- Next priority: cloud files, client and contractor portals, social media, shopping accounts with saved payment details, and connected-building services.
- Lower priority: accounts with limited personal data and no payment method or access to other systems.
This ranking helps you decide what to tackle first. It does not make old accounts harmless: one might still hold a reused password or enough personal information for someone to impersonate you.
Use a different, strong password for each account
Password reuse creates a chain reaction. Login details exposed at one service can be tried at unrelated services. A unique password breaks that connection, so one compromised account does not automatically provide access to another.
A reputable password manager can create and store long, unique passwords, leaving you with fewer to remember. Give the manager a strong master password used nowhere else, turn on its available multifactor authentication, and learn its recovery options before depending on it. A long passphrase made from several unrelated words can work for the master password; avoid familiar quotations and personal details. Let the manager generate passwords for individual sites.
If you cannot use a password manager, begin with unique passwords for your highest-risk accounts. Changing one digit at the end of the same base password is not enough. Do not post a password in a project group chat for convenience. Where a service supports them, use named accounts or a controlled sharing feature instead.
Change a password promptly if you think it has been exposed, entered on a fake site, or shared with someone who should no longer have access. Changing passwords on a schedule without a specific reason can encourage predictable patterns. Uniqueness and a quick response to suspected compromise matter more.
Add a second check at sign-in
Multifactor authentication, or MFA, requires something beyond a password. Depending on the service, that might be a passkey, hardware security key, authenticator-app code, device prompt, or text-message code. Enable it first on email, your password manager, administrator accounts, and financial services, then work through other accounts that offer it.
Choose the strongest practical method
Passkeys and hardware security keys can protect against common phishing attacks because sign-in is tied to the legitimate service, rather than a code typed into a lookalike page. Providers differ in what they offer and how recovery works, so check whether you can register a backup device or key. An authenticator app is generally useful when those methods are unavailable. Text-message codes are better than a password alone, but access to the phone number can be disrupted or transferred fraudulently.
Do not approve an MFA prompt just because it appears on your phone. An unexpected request may mean someone has your password and is trying to sign in. Deny it, open the service through your usual app or saved address, and review recent activity. Never give a one-time code to a caller or someone claiming to be support staff. A legitimate support process should not require a live sign-in code.
Plan for a lost phone or key
Before replacing a phone or changing numbers, check which accounts rely on it for sign-in. Save recovery codes where available, preferably somewhere secure and separate from the device you use for authentication. Register a backup method if the service allows it, and make sure you understand the recovery process. Treat recovery codes as spare keys, not as notes to leave in an unprotected document or shared folder.
Recognize messages designed to steal access
A phishing message may claim that a permit submission failed, a drawing share is about to expire, or a supplier changed bank details. Such claims can fit the work you are doing, which makes them harder to dismiss. Check unexpected attachments, sign-in links, payment requests, and requests for codes through a separate channel, even when the sender’s name looks familiar.
Open the relevant service using a known bookmark, its app, or an address you type yourself instead of following the message’s link. If a contractor appears to send new payment instructions, call a number already in your records—not the one in the message. This independent check is especially important before changing bank details or sending sensitive plans.
Inspect the actual sender address and link destination, not just the displayed name. Even a familiar-looking address is not proof: accounts can be compromised, and convincing domains can be registered. Take the same care with sign-in pages reached through search results or QR codes on unexpected documents. When a message asks you to sign in, go to the service independently.
If you entered a password on a suspicious page, go directly to the genuine service and change it. Change it anywhere else you reused it, review account activity and recovery settings, and tell the organization’s administrator if it is a work account. If you disclosed a one-time code or approved a prompt, act urgently; the attacker may already have an active session.
Keep devices and account recovery under control
Strong credentials offer less protection when an unlocked laptop gives someone direct access to email and saved sessions. Use screen locks on phones and computers, install operating-system and browser updates, and remove software you no longer use. Updates address security flaws as well as bugs. A device that no longer receives security updates should be replaced or given a restricted role, particularly if it handles financial or client information.
Review the recovery email addresses and phone numbers on important accounts. An old address you cannot access may block recovery; an unfamiliar one may point to unauthorized changes. Where available, turn on alerts for new sign-ins and changes to security settings, and send them to an inbox you monitor.
Shared devices need extra care. Signing out of a website may leave downloaded files or saved browser passwords behind. Avoid using computers you do not control for sensitive accounts. If you must use one, do not save credentials, sign out afterward, and review active sessions from your own device. Private-browsing mode may reduce local traces, but it does not make an untrusted computer safe.
Give people access without sharing identities
Architecture and property projects involve clients, consultants, contractors, and facility operators. A shared account may be convenient, but it is hard to tell who did what or to withdraw one person’s access. When a platform allows it, give each person a separate account with only the permissions their task requires. Someone reviewing drawings may need to view and comment, not delete folders or invite users.
Keep administrator numbers small. Where practical, separate everyday access from administrative access, and review who can add users, change payment settings, or alter sharing permissions. Set an end date for temporary access if the service allows it. When a consultant’s role ends, remove their access and check for shared links or connected applications that remain active.
Before sharing files with client details, site security information, or commercially sensitive bids, inspect the link settings. Invitations restricted to named recipients give you more control than a link anyone can open. Check whether recipients can download, edit, reshare, or invite others. A public presentation and an active tender package call for different settings.
Check for exposure without creating more of it
Many services have a security page showing recent sign-ins, connected devices, active sessions, and third-party applications. Check these periodically for important accounts and after a suspicious message. Remove unrecognized devices, revoke unused applications, and investigate unexpected changes to forwarding rules or recovery details. An unauthorized email forwarding rule can keep sending messages to an attacker even after you change the password.
A password manager or operating system may warn that a saved password appeared in a known data breach. That does not necessarily mean someone entered your account, but it is a reason to replace the password and check for reuse. Be wary of unfamiliar sites that ask you to submit your current password to check whether it is safe. Use security features in tools you already trust.
Organizations should keep a secure record of who owns each critical service, which administrator accounts exist, and how access is removed when staff or contractors leave. Review it as project responsibilities change. Access management is not just a technical task: a working password can outlast someone’s legitimate need for it.
Know what to do when an account may be compromised
Act quickly, but in a sensible order. On a device you trust, open the service through its usual app or address. If you still have access, change the password to a unique one and use the option to sign out of other sessions, where available. Review MFA methods, recovery contacts, connected apps, forwarding rules, and recent activity. Secure primary email too if it could have been used to reset the affected account.
If you cannot sign in, use the provider’s official recovery process. For a work account, notify the responsible administrator promptly rather than trying an improvised workaround. If payment details, client information, or confidential drawings may have been exposed, preserve relevant messages and activity records and follow the organization’s incident-reporting and notification procedures. Do not delete suspicious emails before the people handling the incident can examine them.
For a manageable first step, secure your primary email account today. Give it a unique password, enable the strongest MFA method you can reliably recover, check its recovery contacts, and inspect recent sign-ins. If you find an unfamiliar forwarding rule, record its details before removing it and treat the account as potentially compromised.