Scope: money and personal information. When someone gets into your account, money is often the first thing lost. They may also use your account to scam people in your contacts. In effect, they have taken your identity too.
English, Russian and Spanish use dlgrv’s unofficial translations. Newly revised entries appear in the Chinese original until a checked translation is available. The author’s latest Chinese text is authoritative. Translation revision: dlgrv/HowToLiveBetter · b25fa8a
Two-step verification means confirming that it is really you in addition to entering a password. A prompt on your phone that you tap to confirm blocked more than 90% of phishing-related account takeovers; SMS codes were easier to steal than phone prompts. Older methods that ask where you last signed in or what your backup email is blocked as little as 10% of phishing attempts.
Cost
No cost involved. Each account takes just two to three min…
Benefit
Google studied 350,000 real account-takeover attempts, also called account hijacking. One category used a devi…
If a password you use elsewhere gets stolen, attackers can use it to log straight into your email account. Once they gain access to your email, they can reset passwords for any other accounts linked to it. Therefore, your email password must be unique and never reused anywhere else.
Cost
No cost involved. Storing it in a password manager elimina…
Benefit
Trying account names and passwords leaked elsewhere against other services is called credential stuffing;
The SIM is the small card in your phone that receives SMS verification codes. If you lose your phone, someone may remove the card, insert it into another phone, receive your codes and reset your accounts one by one. A SIM PIN requires that code when the card is powered on in another phone, blocking this route.
Cost
No cost at all. You only need to set the screen lock and t…
Benefit
After a phone is lost, one of the quickest routes for the finder is to put its SIM into another phone and rece…
The order of actions matters more than speed. First, block the SIM card to cut off access to verification codes. Next, remotely lock the phone. Then, use a computer to change your email and payment passwords. After that, file a police report to obtain a receipt. Finally, freeze your bank cards as needed. Even if you’re using someone else’s phone, you can still call your carrier to block the SIM card.
Cost
No cost involved. Completing all steps takes just a few mi…
Benefit
Following the correct sequence is more important than acting quickly. Step one is blocking the SIM card, which…
If your card is used fraudulently, first provide evidence such as police-report and loss-report records. If the bank says you personally made the transaction, it must provide evidence; if it cannot, it must reimburse you. This assumes you promptly report the loss and freeze the card when you discover it. If you delay reporting, you bear the additional losses caused by that delay.
Cost
No cost at all. As soon as you notice anything suspicious…
Benefit
Supreme Court rulings clearly define who must provide evidence. If you claim the transaction resulted from cou…
‘Logged-in devices’ are phones and computers that can still use your account. If you see an unfamiliar device, or unused software still connected to the account, change your password first, then sign out all sessions. Also check email for automatic forwarding you did not set up.
Cost
No cost at all. It only takes a few minutes each time. The…
Benefit
The account's device list records phones and computers that can still use it. The authorized-app list records…
Apps request your data. If that data isn’t strictly necessary to deliver the service, the app can’t deny you access just because you refuse to share it. It may only collect what it actually needs. For instance, a map app needs your location, but a flashlight app has no business asking for your contacts list.
Cost
No cost involved. The hard part is resisting the urge to t…
Benefit
Two key legal points apply here. First, providers may not deny products or services on the grounds that a user…
You have the right to demand that a company let you view, copy, correct, and delete your personal information. When a service is discontinued, its retention period expires, or you withdraw consent, the company is obligated to delete that data on its own. If it refuses your request, it must provide a valid reason; otherwise, you can take it to court. Deactivating an account and deleting personal information are two separate actions — after deactivating, you must separately request deletion.
Cost
There is no cost involved. Only if the company drags its f…
Benefit
There are several situations in which a company must proactively delete personal information: when a service i…
As long as any other method can achieve the same result, a service provider cannot force you to use facial recognition. If you decline facial recognition, they must offer alternatives such as a card swipe, password entry, or ID verification. They also cannot threaten that “the service won’t be provided” if you refuse. Installing facial recognition devices in hotel rooms, public showers, changing rooms, or restrooms is strictly prohibited.
Cost
No cost involved. When asked to use facial recognition, si…
Benefit
The Administrative Measures for the Safe Use of Facial Recognition Technology clearly state: “Where other non-…
The API relay service is sandwiched between you and the model provider. It can see and change the content you send and the answers you receive back. A study tested more than 400 relay services, 9 of which inserted malicious code into the commands to be executed, and 17 of which had accessed the cloud-service keys that the researchers deliberately put in. If AI is allowed to automatically execute commands, modified commands may cause the computer to be loaded with malicious code.
Cost
Connecting directly to official services usually costs mor…
Benefit
In June 2026, the Ministry of State Security issued a risk warning. Some proxy sites retain users’ submissions…
Someone may use another person's identity card to obtain SIM cards for fraud without that person's knowledge. Free official services now let you check the SIM cards in your name, the number of app accounts linked to a phone number, and your UnionPay cards. Ask the carrier or bank to investigate and close anything you do not recognize.
Cost
No charge. Check SIM cards through the 工信微报 WeChat account…
Benefit
China's Anti-Telecom and Online Fraud Law requires telecom authorities to provide convenient channels for user…
After a number is cancelled, the carrier can reassign it to someone else after as little as 90 days. Accounts you have not relinked remain connected to that number, so verification codes go to its new owner, who may use them to sign in. Before changing numbers, update your accounts and the number held by your banks.
Cost
No charge. Change the linked number separately for each ac…
Benefit
China's Telecom Service Specifications set a minimum 90-day freeze for mobile numbers, meaning the period betw…
