Using an Old Device? 5 Account Security Settings You Should Enable Now

Introduction

Keeping an older phone, tablet, or laptop in service is common when upgrading is not possible. Older hardware or outdated operating systems can increase security risk, but you can still significantly reduce exposure by enabling key account security settings. Below are five practical settings to enable immediately, plus device-specific tips to make accounts safer on older devices.

Why older devices need extra attention

Old devices may no longer receive security updates, may run outdated apps, and could be easier to compromise if lost or stolen. Enabling account-level protections reduces the chances that an attacker can access email, social accounts, banking, or cloud storage even if the device itself is vulnerable.

1. Protect the device with a strong passcode or password

What to do

• Set a strong device passcode or password and require it immediately after sleep or screen timeout.
• If available, enable biometric unlock such as fingerprint or face recognition, but keep a strong backup passcode.
• On Macs and Windows laptops, require a login password and enable the screen lock on lid close or after a short idle time.

Why it matters A passcode prevents casual access and is the first line of defense if your device is lost or stolen. Apple recommends protecting your device with a passcode or login password.

2. Enable Two-Factor Authentication with resilient options

What to do

• Enable two-factor authentication for all major accounts: email, social, banking, cloud storage, and password manager.
• Prefer an authenticator app or a hardware security key over SMS when possible. Hardware security keys provide strong protection and can be carried separately from the device.
• Generate and securely store backup codes in a password manager or a physical safe location. If you switch or retire devices, those codes let you recover access.
• Be aware of platform quirks. Some services require changes to two-factor settings to enable alternate modes such as one-time passcode authentication.

Why it matters Two-factor authentication blocks most account takeovers even when an attacker has your password.

3. Use a password manager and unique passwords for each account

What to do

• Create long, unique passwords for every account and store them in a reputable password manager.
• Enable the password manager’s auto-lock and require a strong master password or biometric unlock.
• Use app-specific passwords or OAuth tokens for older apps that do not support modern authentication methods, and revoke them if compromised.

Why it matters Unique passwords prevent an attacker from using a leaked credential to access other services. A password manager reduces the friction of using complex passwords on older devices.

4. Review and remove trusted devices, active sessions, and third-party access

What to do

• Go to account security settings and sign out from devices you no longer use. Revoke long-term device trust or remembered browsers.
• Review connected apps and third-party permissions and remove any you do not recognize or no longer use.
• Enable login alerts and account activity notifications so you are informed of suspicious sign-ins in real time.

Why it matters Old devices are often left listed as trusted. Removing them forces reauthentication and reduces the attack surface.

5. Enable encryption, automatic updates where possible, and secure recovery info

What to do

• Turn on device storage encryption if the device supports it. For example, enable FileVault on Mac or device encryption on Android.
• Install any remaining security patches and update apps. If the device cannot receive OS updates, limit app usage to secure, up-to-date browsers and services.
• Keep recovery phone numbers and recovery email addresses current, but prefer authenticator methods or security keys over SMS-based recovery when available.

Why it matters Encryption protects local data if a device is lost. Keeping recovery methods secure prevents attackers from hijacking account recovery flows.

Practical tips for using older devices safely

• Consider a factory reset and reinstall only needed apps to remove lingering accounts and malware.
• If you keep the device online, use a modern browser and avoid outdated apps that access sensitive accounts.
• Use a hardware security key or a separate secondary device for authentication when your primary device is too old.
• Secure your home network: set router Wi-Fi security to WPA2 or WPA3, change default router passwords, and disable remote administration on ISP gateways unless you need it.
• When possible, remove accounts from an old device before discarding, selling, or repurposing it.

Quick checklist

• Passcode enabled
• Two-factor authentication active
• Password manager in use
• Old sessions revoked
• Encryption and secure recovery set

Conclusion

Keeping an older device does not have to mean accepting weak security. By enabling strong passcodes, two-factor authentication, unique passwords, session reviews, and encryption, you can significantly lower risk. Combine these account-level protections with network and device hygiene to keep accounts safe until you can upgrade hardware.