Strong and unique passwords + 2FA (multifactor)

(password manager + 2FA)

(free version, browser extension, URL checking and report phishing emails + also report phishing attempts to CERT)

(free, Global Cyber Alliance, blocks phishing sites)

Don’t click on links (or attachments) in suspicious emails (go direct to the source)

Mouse over the email address or link (but don’t click links) (to see the real email sent from or real link)