When it comes to protecting yourself and your data online there are three meaningful things you can do that are easy and will save your bacon. First, if you have Windows 10 you do not need to purchase anti-virus. Windows comes with Defender which is the Microsoft integrated anti-virus in Windows 10. If you want your own anti-virus that is okay too. The moral of the story is we need some sort of protection on our computers.
Next is the long standing problems of passwords. Passwords are not to be shared between humans or between applications or websites. However, do not use the same password for every single account. You do want to limit the passwords you duplicate especially for important accounts like the email account you receive login codes. Now that you have a bunch of different passwords, change them. Not right away or even all your accounts. Your top tier accounts should be changed annually at minimum. Passwords are great but there is another step. Login codes or the geeky term MFA or multi-factor authentication provide the user a code when a login attempt is made. Even if someone has your password they will need the login code if you enable it on your accounts. Login to your favorite site, look for account settings, security, preferences, etc.
Last but not least is keep your Windows and applications up-to-date. This easy process will patch holes in the software the bad guys are looking for. If there are no holes found the bad guys will move on to an easier target. This is the number one reason to use managed services in the business world. Setting up and patching is one thing, verifying and fixing updates when they get stuck is what keeps us safe.
Common sense goes a long way on the Internet. Trust no one and nothing like it is the first time you ever came across such a thing.