Three Random Words Won't Save You: A Field Guide to Privacy Tools That Actually Work

Imagine you are a mid-level manager at a regional logistics firm. You do most of your banking on your phone, your email is a Gmail address you've had since college, and your password is a variation of your dog's name plus a number you've used for a decade. One Tuesday, your phone suddenly loses signal. By the time you get home and connect to Wi-Fi, your bank account is drained, your email is locked, and your social media is posting cryptocurrency spam. You've just been SIM-swapped, and your privacy tools did nothing to stop it.

This is not a rare horror story. SIM swapping is a documented social engineering tactic where attackers convince a cellular carrier to transfer your phone number to a SIM card they control (CISA, Implementing Phishing-Resistant MFA). Once they have your number, they can reset passwords that rely on SMS codes, bypassing your 'two-factor' protection. The uncomfortable truth is that most privacy tools people rely on—complex passwords, SMS codes, even some authenticator apps—are not enough. This field report walks through a realistic attack scenario and shows which tools actually stop it, based on official guidance from CISA, NIST, and the UK's NCSC.

The Password Illusion

Let's start with your password, because that's where most people think the problem starts and ends. The dog's name plus a number is a classic mistake. The UK's National Cyber Security Centre specifically warns against passwords based on birthdays, sports teams, or family and pet names—details often visible on social media (NCSC, Three Random Words). Even the letter-to-symbol swaps, like changing 'o' to '0', add little strength, according to the same guidance. So you might think the fix is to create a more complex password, maybe with symbols and uppercase letters. But NIST's Digital Identity Guidelines, the federal standard, explicitly forbids forcing complexity rules (NIST SP 800-63B). Why? Because complexity rules often lead to predictable patterns like 'Password1!'—which attackers guess in seconds.

The better path, according to both NIST and CISA, is length. NIST requires passwords used as the only authentication factor to be at least 15 characters long, and recommends allowing up to 64 characters, including spaces and Unicode (NIST SP 800-63B). CISA echoes this, suggesting long, random passwords or passphrases of unrelated words, at least 12 to 16 characters, ideally more (CISA, Secure Our World). The NCSC goes further with its 'Three Random Words' method—think 'applenemobiro'—which is long enough and strong enough yet easy to remember (NCSC). So the first concrete step is to ditch the dog's name and create a passphrase of three unrelated words, or better yet, let a password manager generate a random 20-character string. NIST and CISA both recommend password managers to generate and store unique passwords for every account, eliminating password reuse (CISA, Secure Our World). If you're still reusing passwords, you're handing attackers the keys to everything.

The SMS Trap

Now, let's say you've upgraded to a long passphrase. You've also enabled two-factor authentication, because you've heard it blocks over 99.9% of account compromise attacks (Microsoft Security Blog). But here's the catch: you chose SMS codes. In our scenario, that's exactly what got you hacked. SMS codes are vulnerable to SIM swapping, which is precisely how the attacker took over your phone number. CISA's fact sheet on phishing-resistant MFA lists four ways traditional MFA is bypassed: phishing, push bombing (where attackers send repeated push notifications until you finally accept one), SS7 protocol vulnerabilities, and SIM swapping (CISA, Implementing Phishing-Resistant MFA). SMS falls into the SIM swap category, and CISA is blunt: SMS or voice codes should only be a last resort, and you should prefer phishing-resistant MFA such as authenticator apps, hardware security keys (FIDO2), or passkeys (CISA, Secure Our World). This is not a minor nuance. In 2024, phishing and spoofing was the most-reported crime category to the FBI's IC3, with 193,407 complaints (FBI IC3, 2024 Internet Crime Report). A lot of those started with a SIM swap or a phishing email that led to an SMS-based bypass.

The Phishing Bypass

Even if you use an authenticator app, you're not invincible. Phishing can trick you into entering a one-time code into a fake website. That's why CISA ranks phishing-resistant MFA—FIDO/WebAuthn and PKI-based—as the gold standard, resistant to phishing, push bombing, SS7, and SIM swap attacks (CISA, Implementing Phishing-Resistant MFA). If you can't get a hardware key, CISA recommends app-based one-time passwords or mobile push with number matching (CISA, Implementing Phishing-Resistant MFA). Number matching means the push notification shows a number you must enter on the login screen, so an attacker can't just spam you into approving. In our scenario, if you'd had a FIDO2 key or a passkey, the SIM swap wouldn't have mattered. The attacker couldn't reset your password without the physical key, and a phishing site can't ask for a passkey the way it asks for a code—the protocol binds the key to the real site's domain.

The Breach Reality Check

Now, let's say you've implemented strong passphrases and phishing-resistant MFA. You're feeling good. But you've been using the same email address for years, and it's probably in a data breach. The FBI's IC3 reported 64,882 complaints of personal data breach in 2024, making it the third most-reported crime category (FBI IC3, 2024 Internet Crime Report). That's not just a statistic; it means your credentials are likely floating around on the dark web. The free service Have I Been Pwned, run by Troy Hunt since 2013, lets you check whether your email or username has appeared in a known breach (Have I Been Pwned, About). It was created after the Adobe breach, which was at the time the largest single breach of customer accounts, and the same accounts kept appearing exposed, often with the same passwords (Have I Been Pwned, About). This is where the password manager becomes crucial: if you've used a unique, random password for each account, a breach at one site doesn't give attackers a key to your other accounts. NIST requires passwords to be screened against a blocklist of commonly used, expected, or compromised values (NIST SP 800-63B), so a good password manager will warn you if you're using a known compromised password. If you find your email in a breach, the right move is to rotate that password immediately (CISA, Secure Our World).

The Human Element

But here's the next layer: even with perfect passwords and MFA, a human can still be the weak link. Verizon's 2024 Data Breach Investigations Report found that more than two-thirds (68%) of data breaches involve a non-malicious human element, including people falling for phishing (Verizon, 2024 Data Breach Investigations Report). Phishing is not just the Nigerian prince email; it's smishing (SMS), vishing (voice), and quishing (malicious QR codes) (CISA, Secure Our World). The attacks create false urgency or fear, and the best defense is to pause before acting, hover over links to see the real URL, and verify sender addresses for misspellings (CISA, Secure Our World). In our scenario, the SIM swap might have started with a vishing call pretending to be your bank, asking you to 'confirm' a code. If you'd followed the pause-and-verify rule, you might have hung up and called your bank directly. That's a privacy tool that costs nothing.

Social engineering also includes pretexting, which Verizon found was involved in roughly a quarter (24–25%) of financially motivated incidents over the past two years (Verizon, 2024 Data Breach Investigations Report). Attackers research you, impersonate a trusted entity, and manipulate you into revealing information. The best defense is skepticism and verification, not a tool you can buy.

The Ransomware Connection

Finally, let's talk about the downstream consequences. Once attackers have access, they often deploy ransomware. Ransomware encrypts your files or systems and demands payment for decryption, and it often enters through phishing or exploited Remote Desktop Protocol (RDP) vulnerabilities (CISA, StopRansomware Guide). The FBI's IC3 reported that ransomware complaints rose 9% from 2023, and ransomware was again the most pervasive threat to critical infrastructure (FBI IC3, 2024 Internet Crime Report). In our scenario, the attacker who drained your bank account might have also encrypted your work computer, demanding ransom. The 3-2-1 backup rule—three copies of your data, on two different media, with one offsite—is a privacy tool that can save you from paying a ransom. CISA recommends backing up data securely and updating all software promptly (CISA, Secure Our World). The FBI has provided thousands of decryption keys to victims since 2022, helping avoid more than $800 million in ransom payments (FBI IC3, 2024 Internet Crime Report), but you don't want to rely on that.

Takeaway

Here's the bottom line. Three random words are a good start, but they won't save you from a SIM swap or a clever phish. The privacy tools that actually work, in order of priority, are: a password manager to generate and store unique, long passphrases (at least 15 characters, per NIST); phishing-resistant MFA—hardware keys or passkeys, not SMS; a breach-check service like Have I Been Pwned to know when to rotate credentials; and the human habits of pausing, verifying, and backing up. Stop relying on SMS codes. Stop reusing passwords. And if you're not using a password manager, you're the weak link. The tools exist. Use them.

Sources

• CISA (Secure Our World) - https://www.cisa.gov/secure-our-world
• NIST SP 800-63B (Digital Identity Guidelines) - https://pages.nist.gov/800-63-4/sp800-63b.html
• NCSC (Three Random Words) - https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online/three-random-words
• CISA (Implementing Phishing-Resistant MFA) - https://www.cisa.gov/sites/default/files/2023-01/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf
• Have I Been Pwned (About) - https://haveibeenpwned.com/About
• FBI IC3 (2024 Internet Crime Report) - https://www.ic3.gov/Media/PDF/AnnualReport/2024_IC3Report.pdf