1. When on phone to support
2. test
3. could be used by attacker to 'validate' a request to change another account
4. not to allow phone requests to change account
5. All that's needed to get into this:
5.1. email address, billing address and the last four digits of a credit card number
6. If you must
6.1. use a bank that has both
6.1.1. 2-factor identification
6.1.2. partial password entry
6.1.2.1. where the parts vary
7. free
7.1. gmail
7.1.1. mobile phone
7.1.1.1. 2-factor authentication
7.2. yahoo
7.3. etc.
8. not to allow phone requests to change account
8.1. AntiVirus
9. PayPal
9.1. ask support
9.1.1. not to release any data by phone
10. Amazon
10.1. AWS account
10.1.1. if you have one
10.1.1.1. separate it from Amazon personal account
10.2. Amazon personal account
11. as soon as new version released
12. namecheap.com; enom.com
13. Apple
13.1. iCloud/ iTunes/ AppleID
14. Ask iCloud support
15. Ask Amazon support:
15.1. lock account
16. use a password manager
16.1. that doesn't store passwords online
17. use more secure ones
18. use a private WHOIS to hide personal info
19. double check that they have your name right
19.1. on own domain
19.1.1. easier for you to control
20. attacker can
20.1. change password on all websites using a known email
20.2. or personal details checked won't match
21. if compromised
22. Facebook
23. email addresses
24. domains
24.1. registrar
24.2. host
25. e-commerce accounts
26. social media
26.1. Twitter
26.1.1. Settings: security & privacy
26.1.1.1. <= activate
26.1.1.1.1. Require personal information to reset my password
26.1.1.1.2. send login verification requests to my phone
26.1.2. attack attempted
26.1.2.1. new email address
26.2. Instagram
26.3. Wiki
26.3.1. update
26.4. blog
26.4.1. update
26.4.1.1. platform (e.g. WordPress)
26.4.1.2. plugins
26.4.1.3. theme
26.4.2. harden with
26.4.2.1. security plugins
26.4.2.1.1. WordPress file monitor
26.4.2.1.2. Limit login attempts
26.4.2.1.3. WP security
26.4.3. admin account
26.4.3.1. don't call it 'admin'!
26.4.3.2. don't post under this
26.4.3.3. post with an editor account instead
26.4.4. account name
26.4.4.1. should be different from publicly visible name
27. banking
27.1. Don't!
28. Sources: http://thenextweb.com/socialmedia/2014/01/29/lost-50000-twitter-username/ http://d.pr/n/KUMK http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-honan-hacking/all/ Initiated by Roy Grubb of The Visual Thinking Center http://www.mind-mapping.org/Visual-Thinking-Center.html
29. passwords
29.1. use strong ones
29.2. Don't re-use
29.3. Don't save in a spreadsheet or word document on your computer
29.4. Use a program like 1Password
30. Keep good backups
30.1. or you could lose everything
30.1.1. see how here: