Account takeover is the most common way ordinary people get hurt online, and it is almost always boring: a password reused from a breached site, a phished one-time code, or a recovery flow that trusted a phone number the attacker had just hijacked.
The fixes are equally boring and extremely effective. This section covers them in the order most people should apply them.