To secure your online accounts, the Federal Office for Cybersecurity (FOCS) recommends three steps: a password of at least 12 characters, different for each service, a password manager and two-factor authentication wherever it is offered. These rules apply to individuals and Swiss SMEs alike, because a single stolen login can open several accounts.
This page gives an overview of access protection. It complements the basic measures of SME cybersecurity and the section devoted to protecting your business. It distinguishes what the authorities and experts say from our own analysis.
Key figures
- 12 characters minimum for a password, with upper-case and lower-case letters, numbers and special characters, according to the FOCS.
- At least 20 characters for a Wi-Fi password, the FOCS recommends.
- Password theft plays a role in around a third of the incidents suffered by Swiss SMEs, according to the study "Cybersecurity in SMEs 2026".
- On 19 October 2026, the FOCS published "Five steps to secure authentication".
- From 17 to 19 October 2026, an intruder used a user's login details to view data on the MySIHF portal of the Swiss Ice Hockey Federation.
What is a secure password?
A secure password is long, unpredictable and unique to a single service. On its page devoted to protecting devices and access, the FOCS sets the threshold at 12 characters. It asks for a mix of upper-case and lower-case letters, numbers and special characters.
The national awareness campaign S-U-P-E-R.ch adds a simple rule: avoid personal information, such as a date of birth or the name of someone close to you. The programme "eBanking – but secure!", run by the Lucerne University of Applied Sciences and Arts, recalls the principle: the more unpredictable, complex and long a password is, the safer it is.
Why a unique password for each account?
A reused password turns a single leak into several intrusions. In a publication dated 20 April 2026, the FOCS explains the mechanism: after a data theft, an automated tool checks whether the password works on other platforms.
Varying a password is not enough: changing a digit or adding a symbol creates a pattern that hackers know how to reconstruct, according to the same text.
The email account deserves the closest attention. It is the channel through which password reset requests for other services pass, the FOCS points out. Our analysis: protecting your email address first indirectly protects all the accounts linked to it.
Do you need a password manager?
Yes, according to the FOCS, which recommends one to keep a separate password for each service. A password manager creates, stores and fills in complex passwords. It saves you from memorising dozens of combinations.
Its weak point is the master password. If it is weak and falls into the wrong hands, it gives access to all the stored passwords, the office warns. The FOCS also advises choosing a manager that itself supports two-factor authentication. 2clics does not recommend any brand.
How does two-factor authentication work?
Two-factor authentication, also known as two-step verification, adds a second check after the password. An intruder who knows the password still has to get past this step.
The S-U-P-E-R.ch campaign cites several forms of second factor: a code received by SMS or generated by an authenticator app, a notification on the smartphone, or biometric confirmation by fingerprint or facial recognition. According to this campaign, even if the password is stolen, this step prevents almost any attempt at unauthorised access.
SMS code, app or passkey: which to choose?
The choice depends on the service, as each one offers its own methods. The table summarises what the official sources say about each method.
| Method | How it works | What the sources say |
|---|---|---|
| SMS code | A one-time code arrives on the phone after the password | The mobile network serves as an additional channel, which hampers interception (eBanking – but secure!) |
| Authenticator app | The app generates a code valid for a short time | Cited among the recommended second factors (S-U-P-E-R.ch) |
| Smartphone notification | The user confirms the login on their device | Cited among the recommended second factors (S-U-P-E-R.ch) |
| Passkey | A pair of cryptographic keys, combined with biometrics | Aims to replace the password (eBanking – but secure!) |
To go further, the FOCS guide "Five steps to secure authentication" compares the password, the passkey and the smart card. It suggests ranking authentication methods according to the security they offer.
Does two-factor authentication protect against everything?
No. It does not protect against real-time phishing, warned the National Cyber Security Centre (NCSC), in a review published on 14 February 2023 and still online on the FOCS website.
The mechanism described is simple. A fake login page receives the password. The fraudsters immediately enter it on the real page, which triggers the sending of the code. The victim then types this code on the fake page, and the hackers use it straight away.
The example, reported by a municipality, targeted Microsoft Office 365 accounts protected by two factors. The countermeasure remains the same: never enter a password on a page opened via a link received by email or SMS.
The FOCS adds a reflex: type the address of your bank or email service yourself, never from a Google search, where advertisements can lead to an imitation.
How can you tell if an account has been compromised?
The first sign often comes late: you suddenly can no longer log in, the FOCS notes. Other warning signs appear earlier:
- login attempts from unusual places or at unusual times;
- settings changed without your intervention;
- messages sent from your account that you did not write;
- one-time codes received without having requested them, to be reported immediately to your bank according to "eBanking – but secure!".
Login alerts themselves can be fake. Fraudsters imitate them to push people into clicking on a phishing link, the FOCS warns. It is better to open the service by typing its address, then check the account from there. The office also cites iBarry's data leak checker, which checks the passwords linked to an email address.
What to do if an account is hacked?
You need to act quickly and in the right order. The FOCS details these steps on its page devoted to hacked accounts:
- change the password immediately, if access still works;
- contact the provider without delay, if it is a bank or a financial service;
- otherwise, use the password reset, often sent to a registered alternative email address;
- if that address has also been changed, follow the provider's recovery procedure, which requires you to confirm your identity;
- then activate two-factor authentication, update your devices and run an antivirus scan.
A hacked email account requires an additional check. Fraudsters often create a rule that forwards emails to them, even after the password has been changed. The FOCS advises deleting it, resetting the services linked to that address and warning your contacts.
In the event of financial loss, the office recommends filing a complaint with the cantonal police. The following weeks call for particular vigilance against targeted phishing attempts.
Our analysis: recovery options should be prepared before an incident. An up-to-date backup address, and any backup codes kept away from the phone, as eBanking – but secure! advises for login details, prevent you from being locked out. For a business, these steps belong in a cyberattack response plan.
What rules should an SME follow to secure its accounts?
An SME needs written rules, not just good habits. "eBanking – but secure!" proposes a password policy in four stages: list all protected access points, set rules, check compliance and raise staff awareness.
This policy lays down several principles, according to the Lucerne programme:
- a password remains personal and is never shared;
- it is always stored and transmitted in encrypted form;
- the company provides its staff with a password manager;
- systems prevent old passwords from being reactivated;
- two-factor authentication protects password changes.
The S-U-P-E-R.ch campaign adds rights management. Each employee receives only the access needed for their role. Rights are withdrawn as soon as a person leaves the company or changes position, and are reviewed regularly.
The FOCS lists secure passwords and multi-factor authentication among its organisational measures. These rules matter even more when the team logs in remotely, as detailed on our page on remote working and IT security.
Dated example: from 17 to 19 October 2026, an intruder logged in to the MySIHF portal of the Swiss Ice Hockey Federation using a user's login details. On 26 October, the federation discovered that the data viewed was for sale on a forum. Our analysis: a single hijacked account was enough, which justifies two-factor authentication on every access to third-party data.
Training completes the set-up: S-U-P-E-R.ch suggests workshops on password managers and two-factor authentication. Our page on cybersecurity awareness details the methods, and an SME cybersecurity test helps measure your starting point.
Sources
- Federal Office for Cybersecurity: protecting devices, passwords and access control
- Federal Office for Cybersecurity: when one password compromises several accounts (20 April 2026)
- Federal Office for Cybersecurity: Office 365 accounts targeted by real-time phishing (14 February 2023)
- Federal Office for Cybersecurity: first steps to take
- Federal Office for Cybersecurity: what to do if an account is hacked or data is leaked?
- S-U-P-E-R.ch: how to secure your access
- eBanking – but secure!: an effective password policy for SMEs
- eBanking – but secure!: authentication via SMS
- eBanking – but secure!: passkeys (7 August 2024)
