Online Safety and Cybersecurity Essentials

Most adults were taught short passwords with a capital, a number and a symbol, changed often. That produced Spring2024! and Winter2025!: hard to remember and easy to guess, because thieves use tools that try millions of common patterns a second.

Sort your accounts. Tier 1 is email, banking, government accounts and your phone account: each gets its own long passphrase and two-step verification. Tier 2 is work, shopping with a saved card, and cloud storage. Tier 3 is newsletters and entertainment.

A password manager stores them in a locked vault behind one strong master passphrase. It feels like all your eggs in one basket, but most people’s eggs are already in one basket: the same password everywhere. Never keep passwords in a document or spreadsheet called “passwords”, and never email them to yourself. If you must start on paper, keep the paper where you keep your birth certificate.

Your password is something you know. A second factor is something you have (your phone, an authenticator app, a security key) or something you are (a fingerprint or face). Two different kinds together are much harder to steal.

If you suddenly get “Is this you?” prompts you did not start, do not approve them to make them stop. Someone probably has your password and is hoping you will tap Yes.

The most common trick: someone claiming to be your bank or “support” says a code is being sent to confirm it is you, and asks you to read it back. That code is your second lock. Read it to them and you have handed them the key. No real company asks for your password or your code.

Most infections do not start with a genius hacker. They start with a believable message. Scams and malware often work as a team: the message gets the click, the click installs the malware, the malware steals the account.

Your own pathway works on almost every scam: if the alert is real, you will see it when you log in the normal way. If it is fake, you just stepped around the trap. Malware usually arrives by predictable routes: unexpected attachments, fake “secure document” logins, free or “cracked” software, fake updates, and notification permissions you did not mean to give.

Real updates come from Settings or the official app store, never from a pop-up on a web page. If a fake warning will not close, press Ctrl+W (Command+W on a Mac) to close the tab, or close the browser completely. If it keeps returning, restart the device.

Criminals count on embarrassment: the longer you wait, the more they can do. The fastest fix beats the perfect one.

After a password slip, change that password and every place you reused it, email first, because email is the master key. Check two-step verification is on, look at recent activity, and look for strangers’ devices, new forwarding rules in your email, or changed recovery details.

If files are locked with a payment demand (ransomware), do not pay in a panic: paying does not guarantee you get them back and can mark you for more. Disconnect and get professional help. If money is involved, call your bank on the number printed on your card or its real website. And keep records: screenshots, case numbers, confirmation emails.

Many hacks simply use weaknesses that were fixed long ago on devices that never updated. Restarting now and then helps updates finish.

A backup is a second copy kept somewhere else. It turns a stolen laptop, a coffee spill or ransomware from a disaster into an inconvenience. Start with what would hurt most to lose: family photos, IDs, tax papers, leases, medical records.

Give away less: ask “do they really need this?” before filling in every field. Do not post photos of IDs or tickets, and remember that pet names and birthplaces on social media are often security-question answers. A few times a year, check your recovery phone and email, that two-step is still on, which devices are signed in, and whether your email has forwarding rules you did not make.