Sorting your accounts by what they unlock

Advice that treats all accounts identically fails for a practical reason: nobody has the patience to apply maximum effort two hundred times. So it gets applied nowhere. The alternative is to sort accounts by how much damage losing one would do, and spend your attention accordingly. Note that account tiering is our framing rather than a published requirement — but every control listed below comes from NIST, CISA or NCSC.

If you cannot name all your accounts

Anyone who has more accounts than they can name, has half-heartedly meant to sort them out, and does not have a weekend to give it.

It is also useful for a household or a very small business, where several people share some logins and nobody is quite sure which ones matter. The sorting step is the part that makes the rest tractable.

Working out which accounts sit at the top

The test is not how much money is behind an account. It is what an attacker could reach next from inside it.

By that test your email account outranks your bank, because the email account can reset the bank. The password manager outranks both. Your phone account matters more than most people assume, because control of a phone number is what makes SIM-swap attacks on SMS codes worth doing.

Work through it in three groups. Tier one: email, password manager, device logins, mobile carrier account. Tier two: money and identity — banking, tax, health, anything holding a payment card on file. Tier three: everything else, which is most of it.

Sorting the accounts, tier by tier

1. List your tier-one accounts. There should be four or five. If there are twenty, you have not applied the ‘what does it unlock’ test strictly enough.
2. Give each tier-one account a passkey or security key if the service supports one — CISA names FIDO/WebAuthn as the only widely available phishing-resistant option.
3. Give each tier-one account a password of 16 characters or more, unique, and not derived from any other password you use.
4. For tier two, enable the best second factor available, preferring an authenticator app over text messages, and generate a unique password in your manager.
5. For tier three, generate and store a unique password each. Do not memorise them, do not reuse them, and do not spend further effort on them.
6. Remove weak fallbacks from tier one where the service allows it: delete stored password hints, clear security questions, and drop SMS as a recovery method once a stronger factor works.
7. Check that recovery routes point somewhere you control. An old work address listed as the recovery email on your personal account is a tier-one problem hiding in plain sight.

When to go through it again

Not on a schedule for its own sake, and specifically not by rotating passwords every ninety days — NIST prohibits verifiers from requiring that, on the evidence that it makes people choose weaker passwords and apply predictable transformations.

Redo the sorting when the facts change: a new job, a new phone number, a new bank, or a breach notification naming a service you use. That last one is the case where NIST does say a forced change is appropriate, because there is evidence of compromise.

What tiering does not fix

It does not make any individual password phishing-resistant. NIST states plainly that passwords are ‘not phishing-resistant’, and NCSC UK finds that all traditional second factors are vulnerable to adversary-in-the-middle phishing while no FIDO2 credential type is. Tiering tells you where to spend a passkey; it does not substitute for one.

It also does nothing about a breach at the service itself. If a company loses its password database, your effort determined whether the damage stayed contained to that account — which is the whole argument for uniqueness — but not whether it happened.

It does nothing for accounts you have forgotten you hold. Dormant accounts at services you last used a decade ago still carry your email address, and often a password you were using at the time. The sorting exercise only covers what you can remember; a password manager’s import from your browser will usually surface a few more.

And it does not remove the need to act when something goes wrong. If credentials of yours are used for fraud, report it at ReportFraud.ftc.gov; if it has progressed to identity theft, IdentityTheft.gov produces a personalised recovery plan and pre-filled letters rather than just logging a complaint.

Sources: NIST SP 800-63B-4, Digital Identity Guidelines · CISA — implementing phishing-resistant MFA · CISA — four easy steps to stay safe online · NCSC UK — traditional credentials and FIDO2 for personal use · FTC IdentityTheft.gov

Reviewed 27 August 2026 by the CyberArtical editorial team against primary guidance from NIST, CISA, NCSC UK and the FTC. Security guidance changes over time; where our earlier version of this page said something different, we say so in the article rather than editing it out quietly.