--- id: account-safety title: Account security level: 1 modes: [day-pack, rucksack] moment: "They are in the app's settings for another reason, are using a shared or borrowed device, or are about to share a chat link." keywords: [account safety, two-factor, passkey, password, sign out, shared device, shared link, sessions, login, hacked account] source: "research/2026-10-20-concepts/account-safety.md; research/2026-10-23-essentials/batch-4-facts.md; mapping (product/learning-system/MAPPING-1-2.md): FAQ 2.18 (home), 4.08; MISTAKES 1.11 (home); tips T017; strand P" --- ## What it is The account behind your AI app holds your chats, what the app remembers about you and any apps you have linked, so the account is only as safe as its sign-in. Lock it with two-step sign-in, which adds a second check, or, where offered, a passkey, which replaces your password and resists fake sign-in pages. Sign out on any shared device, such as a family laptop, because closing the tab does not sign you out. Check who a shared chat reaches, because in some apps anyone with the link can read it. ## Tips - Turn on two-step sign-in or a passkey where offered for your AI account, because passkeys resist fake sign-in pages and your chats are only as safe as its sign-in. - Sign out on any shared or borrowed device and from devices you no longer use, because closing the tab does not sign you out. - Check whether a chat you share is a public link, and turn off old links, because anyone holding a public link can read the chat. ## Questions people ask - Q: My AI app has no password. How is it protected? A: In some apps you sign in through another account or an emailed link and cannot set a password. Then that other account or your inbox is the lock, so secure it. - Q: I lost my phone. What now? A: Getting back in can take days, and up to 30 days in some apps. Keep your recovery methods up to date, and save any recovery keys, or you can be locked out for good. - Q: I got a sign-in prompt I did not start. What do I do? A: Deny it. Someone may know your password, so change it if you have one and sign out of all your devices. - Q: What can a thief see if they get in? A: They can see your chat history, what the app remembers about you and anything you have connected. Remove connected accounts, and tell your bank if payments are saved. - Q: Should my kids use AI? A: It depends on their age and the app, because each app sets its own age rules, most from 13 and some from 18, and at least one lets a younger child use it only when a parent switches it on. Some apps have family or teen controls that let a parent switch off features such as voice and images, and some have none. ## For your AI Facts (checked 23 October 2026; fact check research/2026-10-23-essentials/batch-4-facts.md; research note research/2026-10-20-concepts/account-safety.md). - Passkeys stop scammers stealing a password through a fake sign-in page; SMS and email codes are the least secure second step (Australian Cyber Security Centre, 7 October 2026, https://www.cyber.gov.au/publication/personal-cyber-security-handbook/use-passkeys). - Recovery: ChatGPT support checks can take a few days; Microsoft can take 30 days when both recovery methods are lost; Google can take up to 7 days after recovery details change. - Sharing a login: OpenAI's, Anthropic's and Microsoft's terms say not to share account credentials; Google's say only to keep the account secure. - Minimum ages: ChatGPT 13, with a parent's permission under 18; Claude 18; Gemini 13 or the country's age, 18 for work accounts, under 13 only if a parent switches it on through Family Link (rolled out gradually, not in the EEA, Switzerland or the UK, https://support.google.com/gemini/answer/16109150); Copilot 13 by Microsoft, though eSafety lists 18 for Australians (https://www.esafety.gov.au/key-topics/esafety-guide/microsoft-copilot). - Family controls: ChatGPT lets a linked parent set quiet hours and turn off voice, memory and images, without reading chats (https://help.openai.com/en/articles/12315553); Gemini works with Family Link; Copilot with Microsoft Family Safety; Claude has none and checks ages. - Australia: eSafety's codes, in force since 9 March 2026, require age checks on AI chatbots that can produce sexual, self-harm or high-impact violent material; the social media minimum age (16) names no AI chat app. In eSafety's August 2026 survey of 1,950 children aged 10 to 17, 78 percent had used an AI assistant and 20 percent had a harmful or inappropriate interaction (https://www.esafety.gov.au/research/talking-to-machines-childrens-experiences-with-ai-assistants-and-companions). Per app (menus move): ChatGPT, two-step and passkeys in Settings, Security and login; "Log out of all devices"; personal shared links open to anyone, managed in Settings, Data controls, Shared links. Claude, no password (Google or an emailed link), no two-step setting found, so the Google account or inbox is the lock; Log Out ends all devices (web); sharing is an email invite for one address by default, a public link opens for anyone. Gemini, the Google Account's 2-Step Verification or a passkey; public links readable by anyone. Copilot, the Microsoft account's two-step and passkeys; "Sign out everywhere"; whether link recipients must sign in is UNCONFIRMED. Teach it like this: work from their own app: lock the account behind it (a passkey or two-step where offered, otherwise the email or Google account that signs them in), sign out on shared devices, and check who a shared link reaches. For children, give the app's minimum age and its family controls, without lecturing.