<prompt> Human: Two or three months ago I got a notification from Steam that someone was trying to log in to my account from Kyrgystan, then from another country that I dont remember - both between 1am and 3am local time eastern US. Steam notified me, I changed my password and luckily didnt have a credit card attached to my account. I rarely use Steam except to store a couple video games I bought years ago and one I purchased this December. Then more recently, I got an notification from Ubisoft Uplay of the same thing, from countries in the middle east again. Once again, theyre just used to store a few old games and didnt have a credit card attached so I got lucky, I changed the password and added two-factor authorization. I also recently played an old game as in around last year on Ubisoft. A couple weeks ago somebody was able to log into my Facebook account from a town about 2 hours away from me, but no money was involved and Facebook did not notify me of this. I only noticed that I was logged in on a device in Jacksonville and unauthorized it. I also changed my password.Most recently, today my credit card which is through my bank that I use for checking texted me alerting me that it declined 109 in payments to iTunes for suspicious activity - I had no idea what that was. Im checking iTunes and it only lists a 20 purchase to some bizarre app with a Chinese character name that I dont have downloaded anywhere, but I am still working with Apple to figure out where the rest of the 109 was being purchased. My credit card is sending me a new card with a new number and CCV and all that now, but Im concerned that this is the third breach in as many months and I have no idea why this is happening. Im worried that it will eventually be a not-insignificant amount of money and that a fail-safe system for detecting fraud wont notice. What should I do? All these frauds involve the same email address - my main email address. Admittedly most of my passwords are variations of the same couple things, so I know I should change it. But I have been on the internet with some of these passwords since I was 13 years old, using this same email address since I was 14, Im in my 20s now - I have NO IDEA how many websites this email account and those password variations are tied to. Most of them dont have credit card information but Im increasingly terrified of the consequences of this. Is there anything I can do to protect my money now? ___edit: thank you all. I have downloaded LastPass and after a very lengthy and frustrating process especially with Apple, jeez I have successfully changed most of the passwords of the accounts associated with any of my money as well as my email password. When I get home Ill redo my Steam and Ubisoft passwords too cant do that at work so theyre more secure. Its gonna be a pain trying to think of every website Ive ever put my credit card number on - I bought a lot of crap online. Im having flashback nightmares to all the tiny little e-cig websites I bought juice from in college. But this is a really solid start and I appreciate all of your advice. Im also trying to delete a lot of these accounts - strangely difficult.I STRONGLY recommend that if you can, start finding a way to document all the websites you have to make an account on, and check the ones you havent logged in on in a few months. If you dont need it anymore, delete it. ESPECIALLY anything that involves money. I am really pissed about the CashCrate breach that I never got notified about even though it happened in 2016. Shout out to ussbastos for showing me - type in your email address and see if its been involved in a data breach.  <response>: What should I do? All these frauds involve the same email address - my main email address. Admittedly most of my passwords are variations of the same couple things, so I know I should change it.Basically, there is a list out there somewhere that has your email address linked with several very similar known passwords. People are using that information to log into sites that user your email as a username, and targeting sites that usually allow for pre-stored payment information.So long as you insist on continuing to use this same email address and passwords, you are going to continue to be a victim. Your best bet is to change both of those things. Adding two-factor authentication where available will also help. 