Start with unique credentials
Use a long, unique password and enable multi-factor authentication whenever it is available. Never share verification codes.
Check where links lead
Open account pages from a trusted bookmark and verify the domain before entering personal information.