Picture a freelancer in Ibadan who has been working with a client in Canada for four months. One morning her email password stops working. The same email is linked to her freelance profile, her payment account and her cloud drive. Within an hour, the client gets a message from "her" asking to send future payments to a new account.
That is not a rare movie plot. When one email account falls, everything tied to it falls with it. This guide shows you how to set up your accounts, files and devices so that a hacked password, a stolen phone or a long blackout costs you an inconvenient afternoon and not your income.
It takes about two to three hours to do the whole setup once. After that, maintenance is a few minutes a month.
Why freelancers are targeted
You hold three things criminals like: access to payment accounts, a client's trust, and often a client's private files. You also work with people you may never meet, so a believable message is easy to fake.
Most attacks are not clever hacking. They are tricks: a fake login page, a "client" sending a file that asks you to sign in, or a call claiming your SIM or bank needs "verification". Good habits beat most of them.
Step 1: Protect your main email first
Your email is the master key, because every "forgot password" link ends there. Treat it as the most valuable thing you own online.
- Use a long, unique password. A phrase of four or five unrelated words is easier to remember than random symbols and is strong. Never reuse it anywhere else.
- Turn on two-step verification using an authenticator app or a security key, not SMS if you can avoid it. SMS codes can be taken over through SIM swap.
- Save the backup codes your email provider gives you. Write them on paper and keep them somewhere at home, not in a screenshot on the same phone.
- Add a recovery email that you control, ideally a separate address used for nothing else.
- Check the sign-in activity page of your email provider and sign out of devices you do not recognise.
Consider keeping two emails: one public address on your profile and proposals, and one private address used only for payment and banking accounts. If the public one gets spammed or phished, your money accounts stay quieter.
Step 2: Use a password manager
You probably have 30 or more accounts: freelance platforms, invoicing, bank apps, cloud storage, social media. You cannot remember 30 strong, different passwords, so most people reuse a few. That is how one leaked password becomes five break-ins.
A password manager stores them behind one strong master password. Several reputable ones have free plans; confirm current features on each provider's own site. Protect the manager itself with two-step verification and write down the master password once, offline.
If that feels like too much today, start smaller: change the passwords on your email, your bank or fintech apps, and your payment-receiving accounts, and make each one different.
Step 3: Secure your phone number and SIM
In Nigeria, Ghana, Kenya and South Africa, SIM swap fraud is a known route into bank and email accounts, because many services still send codes by SMS. Do these:
- Ask your network provider what extra protection or PIN they offer on your line. Do it in a branch or through the official app or code, not through a number someone sent you.
- Never tell anyone an SMS code, including someone claiming to be from your bank, a platform or a client.
- If your phone suddenly loses network for no reason and you are not in a bad-coverage area, treat it as an alert. Use another phone to contact your network and bank quickly.
- Keep your BVN, NIN and similar details private. A client has no reason to need them for a normal writing, design or virtual assistant job. Our guide on guarding your bank account covers more of the banking side.
Country note: the exact SIM-protection options differ by network and country, so ask your own provider what they offer.
Step 4: Recognise the tricks aimed at freelancers
| What you receive | What is really happening | What to do |
|---|---|---|
| A client sends a "brief" as a link that asks you to log in with your email password | Fake login page that steals your password | Do not enter details. Open the real site by typing the address yourself, and ask the client to send the file another way. |
| A zip or .exe file "to test" or "view the project" | Malware | Do not open. Ask for a normal PDF, Google Doc or similar. |
| "Platform support" messages you to confirm your account on WhatsApp or Telegram | Impersonation | Use only the support channel inside the platform's own site or app. |
| A client suddenly sends new bank details "because the old one has a problem" | Payment redirection or impersonation | Confirm by calling or video chatting with the person you already know. |
| A job asks you to pay for training or equipment first | Advance-fee scam | Walk away. See our post on client onboarding for what a legitimate first week looks like. |
The common thread is urgency and a request to leave the normal channel. Slow down, and verify through a route you chose yourself.
Step 5: Back up your work so a blackout or stolen laptop is survivable
Power cuts, a dying laptop charger, a snatched phone: these are everyday risks, not unusual ones. A simple rule works well: three copies, two kinds of storage, one away from your laptop.
- Working copy on your laptop.
- Cloud copy that syncs automatically when you have data. Many free cloud plans are enough for documents; check the current free storage on the provider's site.
- Offline copy on a flash drive or external drive, updated weekly and kept in a different spot from your laptop bag.
Set the cloud app to sync only on Wi-Fi if data is costly, or pause it while you are on a tight bundle. Save documents often. For longer projects, use a tool that autosaves online, so a sudden outage costs you minutes, not the whole afternoon. For more on keeping work going through outages, see our post on building an income buffer, which also helps when a bad week hits.
Step 6: Handle client files responsibly
Clients may share unpublished articles, customer lists, login details or product designs. Losing them can cost you the relationship, and in some cases create legal trouble.
- Keep each client's files in their own folder, so you can delete them cleanly after the project.
- Do not share a client's login by chat. Ask them to use a shared-access feature, or a tool that lets you log in without seeing the password.
- Do not use client files in your portfolio without written permission. Ask first, and offer to remove names or numbers.
- Do not work on client material on shared cafe or public computers. If you must, use a private browser window and sign out fully.
- Lock your laptop and phone with a screen password. Turn on device encryption and find-my-device features where your system offers them.
A worked example (hypothetical)
Take a freelance designer in Accra with a laptop, a phone and five clients. Her setup takes one Saturday:
- Hour one: she changes her email password to a four-word phrase, turns on an authenticator app, and writes the backup codes in a notebook.
- Hour two: she installs a password manager, moves her ten most important accounts into it, and changes each password.
- Hour three: she creates a cloud folder per client, copies files to a flash drive, and sets a monthly reminder to update it.
Three months later her laptop is stolen from a bus. She loses the device, not the work. She signs out of all sessions from her phone, changes her email password, restores files from the cloud and tells her clients what happened the same day. The cost: a replacement laptop, not her income. That is the realistic goal.
Common mistakes
- Using the same password everywhere. One leak opens every door.
- Keeping backup codes only on the phone. If the phone is stolen, so are they.
- Trusting a message because it knows your name or project. Scammers read public profiles and proposals.
- Skipping updates. Phone and laptop updates fix known holes. Run them when you have cheap or free data.
- Logging in on a shared device and forgetting to sign out.
- Staying silent after a breach. Tell affected clients and your payment provider early. Hiding it makes things worse.
If your account is hacked: first hour checklist
- Use a device you trust to change your email password and sign out all other sessions.
- Change passwords on payment, freelance and bank accounts, in that order.
- Contact your bank or payment provider through their official app or number to freeze or flag anything suspicious.
- Tell active clients by a verified channel, and warn them not to follow any payment change request.
- Report the incident to the freelance platform's support inside its own site.
- Check your phone line with your network provider if SMS codes were involved.
Frequently asked questions
Is an authenticator app really better than SMS codes?
Generally yes, because it is not tied to your SIM. Still, SMS is better than nothing, so use SMS if an app option does not exist.
Do I need a paid VPN for freelancing?
Not for most work. A VPN helps on public Wi-Fi but does not fix weak passwords or phishing. Do not use one to hide your location from a platform that asks for it; that can breach its rules and get you banned.
Can I store passwords in my phone notes?
Not a good idea. If the phone is unlocked or stolen, everything is exposed. A password manager or a paper notebook at home is safer.
What if a client insists I install software on my laptop?
Ask what it is for, and research it independently. Remote-access tools in particular can give someone full control. If the job does not truly need it, decline.
Your next step
Do one thing today: secure your email. Change the password, switch on two-step verification, and write the backup codes on paper. Then book a Saturday for the rest.
Results from any side hustle or online work vary widely, and nothing here is a promise of income. Be wary of anyone who asks you to pay upfront to start earning.