1
Secure the main email account
Review sign-in method, recovery details, forwarding rules and signed-in devices.
Account priority
Which Digital Accounts Should Lottery Winners Secure First?
Start with accounts that can reset, authorise or reveal other accounts. The exact services will differ by household, but the dependency chain is usually more important than the brand name.
2
Secure banking and payment access
Enable the bank's strongest authentication and transaction alerts.
3
Review the mobile number
Check provider security and where the number is being used for recovery.
4
Review cloud, devices and social accounts
Protect documents, photos, location history and personal information that can make targeting easier.
For a newly confirmed win: also secure the email or online account connected directly to the lottery entry. The wider claim sequence belongs in the Lottery Winner Checklist.
Email security
Why Is Your Email Account So Important After a Lottery Win?
Email often sits behind banking notifications, professional correspondence, cloud services and password-recovery links. If somebody controls the inbox, they may be able to work outward into other accounts.
Review how you sign in
Use a passkey where the email provider supports it. Otherwise use a unique password from a password manager and enable 2-step verification.
Check recovery email and phone details
Remove old addresses and numbers you no longer control. Recovery routes are part of the security boundary, not an administrative afterthought.
Check devices, sessions and forwarding rules
Review signed-in devices and unfamiliar sessions. Also check that mail is not being silently forwarded to an address you do not recognise.
A separate private email for banks, solicitors and advisers can reduce exposure because it is not published, used for shopping or shared across ordinary websites. It still needs the same strong authentication and recovery controls.
Authentication
Should Lottery Winners Use Passkeys, Password Managers or 2-Step Verification?
The National Cyber Security Centre changed its public guidance in April 2026: use passkeys where a service supports them. Where passkeys are unavailable, strong unique passwords plus 2-step verification remain the fallback.
Passkeys where available
Passkeys are resistant to phishing because there is no reusable password for you to type into a fake website. They use the trusted device and its unlock method.
Password manager where passwords remain
Generate and store a different password for every important service rather than creating memorable variations of the same password.
2-step verification when needed
If a passkey is not available, enable 2SV. Where a service gives you a choice, reduce reliance on SMS by using an authenticator or security key if practical.
Do not approve an unexpected sign-in prompt. A genuine authentication method can still be abused if a criminal convinces you to approve a login you did not start.
Phone number and account recovery
How Can Lottery Winners Reduce SIM-Swap and Mobile-Number Risk?
A mobile number can be used for calls, text codes and account recovery. The UK government's 2026 fraud call for evidence cites a 38% rise in unauthorised SIM swaps during 2025, making phone-number security a real account-takeover issue rather than a theoretical one.
Ask your network about account protection
Use any additional account PIN, password or porting protection your provider makes available.
Treat unexplained service loss seriously
If your phone suddenly loses service without an obvious reason, contact the provider through a trusted route and check important accounts.
Reduce public exposure of the number
Remove a private number from public websites, social profiles and unnecessary forms where possible.
Reduce reliance on SMS recovery
Use passkeys or stronger authentication methods where services support them rather than making one phone number the key to everything.
Banking and high-value payments
How Should Lottery Winners Protect Online Banking and Large Transfers?
Large balances make verification more important, not more complicated. The safest rule is that the person requesting a payment should never control the only route you use to verify that request.
Never move money because an incoming caller tells you it is at risk
UK Finance and Take Five state that a bank or the police will not ask you to transfer money to a so-called “safe account”. Caller ID can also be spoofed, so seeing the bank's name or a familiar number on the screen is not sufficient verification.
If a call is unexpected, end it and contact the bank yourself through its official app, the number on your card or statement, or 159 where your bank participates.
Detailed impersonation, investment, property-payment and adviser fraud belongs in Scams That Target Lottery Winners. This page keeps the focus on account and payment security.
Phones, computers and cloud accounts
How Should Lottery Winners Secure Phones, Laptops, Cloud Storage and Shared Devices?
A modern phone can hold email, banking apps, passkeys, identity documents, photographs and private messages at the same time. Device security therefore protects several layers at once.
Install security updates promptly
Keep operating systems, browsers and important apps supported and up to date. Enable automatic updates where practical.
Use a strong device lock
Protect phones and computers with a strong PIN/password or supported biometric unlock, and shorten auto-lock time on devices that travel with you.
Review cloud access
Check who can see shared photo libraries, files, backups and folders containing identity or prize documents.
Retire old devices properly
Remove old sessions, wipe devices before disposal and avoid leaving sensitive accounts permanently signed in on shared family hardware.
A dedicated device for high-value banking can be an extra layer for some households, but it is not a substitute for passkeys/2SV, software updates and independent payment verification.
Partners, children and people with access
What Digital Security Rules Should a Lottery Winner's Household Follow?
One person's strong security is not enough if another person can be pressured into sharing a code, approving a payment or publishing information about the family.
Partner or spouse
Agree that unexpected financial or account-security requests are independently verified before anybody acts.
Children
Set age-appropriate rules about the win, location, school, travel, expensive purchases and messages from strangers.
Assistants or household staff
Give only the access needed for the job. Booking travel should not automatically mean access to banking, private email or identity files.
Shared devices and family accounts
Do not keep major banking, legal or prize documents inside casual shared accounts if they do not need to be there.
A useful household rule: nobody moves money, shares a login code, installs remote-access software or confirms sensitive details because of an incoming call, email, text or social message alone.
For school, routines and age-appropriate disclosure, continue with How to Protect Your Children After a Big Win.
Suspicious calls, emails, texts and login prompts
What Should You Do When an Unexpected Message Claims Your Money or Account Is at Risk?
The safest response is to break the communication chain and start verification again from a source you control.
1
Stop the conversation
Do not click, reply, share codes, approve a sign-in or make a payment while being pressured.
2
Open the official channel yourself
Use the organisation's official app, website, card, statement or independently located contact details.
3
Check the account directly
Look for genuine alerts, recent sessions, payment activity and changes to contact or recovery details.
4
Report suspicious contact
Forward suspicious emails to report@phishing.gov.uk and suspicious calls/texts to 7726 where appropriate.
If something has already happened
What Should a Lottery Winner Do After an Account Takeover, Phishing Incident or Fraudulent Payment?
The priority depends on whether the incident involves credentials, a device, a phone number or money. Act on the part that can still cause further loss.
If money or bank details are involved
Contact the bank or payment provider immediately using an official trusted route. Do not wait for a fraud report before trying to stop or recover a payment.
If an account may be compromised
From a trusted device, change affected credentials, review sessions and recovery details, remove unfamiliar access and follow the provider's recovery procedure.
If your phone number may have been taken over
Contact the mobile provider promptly and then review accounts that rely on the number for sign-in or recovery.
UK reporting: Report Fraud handles cyber-crime and fraud reports in England, Wales and Northern Ireland. In Scotland, contact Police Scotland on 101. If there is immediate danger, use the appropriate emergency service.
Interactive review
Digital Security Checklist for Lottery Winners
This is a review list, not a cyber-security score. Tick items only when they are actually in place, and use the unticked items as the work list.
Household tool
Create Household Rules for Email, Phone, Banking and Social Media
A written household rule is useful because it removes the need to invent a response while somebody is frightened, rushed or excited.
Choose the rules above, then generate a simple household digital-security plan.
Questions answered
Digital Security After Winning the Lottery: FAQs
Current UK-focused answers covering passkeys, email, SIM swaps, banking calls, phishing, devices and household rules.
What should a lottery winner secure first online?
Start with the main email account because it often controls password resets and recovery for other services. Then secure banking, the mobile number used for recovery, cloud storage, social accounts and any account connected to the lottery claim.
Are passkeys better than passwords for lottery winners?
Where a service supports them, the UK National Cyber Security Centre recommends passkeys over passwords because they are resistant to phishing. Where passkeys are unavailable, use a unique password generated or stored by a password manager and enable 2-step verification.
Should a lottery winner create a new private email address?
It can be useful to keep banking, legal and adviser communication away from an old public-facing address. A separate address is not a substitute for strong sign-in protection, secure recovery settings and careful device access.
What is a SIM-swap attack?
A SIM-swap attack is when a criminal takes control of a victim's mobile number, which can let them intercept calls or text codes and abuse account-recovery routes. Unexpected loss of mobile service can be a warning sign.
Should lottery winners change their phone number?
Not automatically. The more useful first steps are to reduce public exposure of the number, review mobile-provider security, remove the number from unnecessary recovery routes and use stronger authentication where services support it.
Should lottery winners use SMS codes for 2-step verification?
Use the strongest method the service offers. Passkeys are preferred where available. If they are not, 2-step verification is still valuable; app-based or security-key methods can reduce reliance on a phone number where supported.
What should I do if someone claiming to be my bank calls me?
Do not approve payments, disclose security codes or rely on the incoming caller ID. End the conversation and contact the bank independently through its official app, the number on your card or statement, or 159 if your bank participates.
Will a bank ever ask me to move money to a safe account?
UK Finance and Take Five state that a bank or the police will not ask you to transfer money to a so-called safe account. Treat such a request as a major warning sign.
Should lottery winners use a separate device for banking?
It is not essential for every winner. A supported, updated and carefully controlled device is the priority. Some people handling very large sums may prefer a dedicated device to reduce exposure, but good authentication and verification processes matter more than owning extra hardware.
What should lottery winners avoid posting on social media?
Avoid publishing the win, live travel, home address clues, children's schools, regular routines, high-value purchases and details that help strangers connect your identity, wealth and location.
Should children and partners follow the same digital rules?
Yes. Household security works best when everyone understands the same rules for unexpected messages, verification codes, money requests, travel posts and sensitive screenshots.
What should I do if my phone suddenly loses service?
If the loss of service is unexpected, contact your mobile provider through a trusted route and check important accounts for unusual activity. A service loss can have innocent causes, but it is also a recognised warning sign in SIM-swap cases.
What should I do if I clicked a phishing link but did not send money?
Break contact, close the page, change any credentials you entered from a trusted device, review account sessions and recovery settings, and follow the relevant provider's security guidance. Suspicious emails can be forwarded to report@phishing.gov.uk and suspicious texts to 7726.
Where should fraud be reported in the UK?
Report Fraud is the national reporting route for cyber crime and fraud in England, Wales and Northern Ireland. In Scotland, contact Police Scotland on 101. If money or bank credentials are involved, contact the bank immediately as well.
Does digital security replace physical security or anonymity planning?
No. This page covers accounts, devices, phones, banking access and online exposure. Physical security, public anonymity, scam types and children's safety each have dedicated MLL guides so those topics can be handled in more depth.
Official guidance reviewed
Sources for Passkeys, Phishing, SIM-Swap Risk and UK Fraud Reporting
This page uses general UK cyber-security and fraud guidance and applies it to the practical circumstances of a lottery winner. There is no public dataset that measures the cyber-attack rate specifically for lottery winners.
- National Cyber Security Centre — Passkeys: what you need to know. NCSC recommends passkeys over passwords where available.
- NCSC — Setting up 2-Step Verification. 2SV guidance for services where stronger sign-in methods are not available.
- NCSC — Social media: how to use it safely. Digital-footprint and privacy-setting guidance.
- NCSC — Software and app updates. Current advice on applying security updates and enabling automatic updates.
- HM Treasury/Home Office — Unauthorised fraud in the UK, 2026 call for evidence. Covers SIM-swap, number-porting and account-takeover risks.
- Take Five — Impersonation scams. Safe-account, remote-access and independent-verification warnings.
- Stop Scams UK — 159. Direct bank-contact route covering more than 99% of UK retail current accounts.
- Report Fraud — Reporting suspicious emails, calls, texts and websites. Current reporting guidance, report@phishing.gov.uk and 7726.
- Report Fraud — Cyber crime and fraud reporting. England, Wales and Northern Ireland reporting route; Scotland directed to Police Scotland.
What Should Lottery Winners Remove or Stop Sharing on Social Media?
The NCSC warns that criminals can use a person's digital footprint to steal identity information or make phishing more convincing. A lottery winner should therefore look at the information strangers can combine, not just whether the jackpot itself was posted.
Live travel and location
Do not advertise that the household is away or publish real-time routines that make location predictable.
Home and vehicle clues
Street names, number plates, distinctive property features and repeated backgrounds can reveal more than the caption does.
Children's school and routine
Uniforms, clubs, school names, pickup routines and birthdays can become useful profiling information.
New wealth signals
Property purchases, renovations, watches, cars and luxury travel can connect an otherwise private household to substantial money.
For the disclosure decision itself, use Should You Post a Lottery Win on Social Media?.