Four things worth knowing before anything else.
You do not need to understand how the internet works to be safe on it. You need four habits. This page explains each one, why it matters, and exactly what to do. Nothing here takes more than an afternoon.
-
Passwords and accounts
One reused password can open every door you own.
-
What you share, and who can see it
A post carries more than the picture in it.
-
Scams, fake messages and pressure
Almost every scam pulls the same lever.
-
Checking your settings
The same five questions work on every app.
Length beats cleverness
Most accounts are not broken into. They are opened with a password that leaked somewhere else. When a shop or a game or an old forum is breached, the email and password pairs end up on lists, and someone tries them everywhere. If you use the same password in two places, a break-in at the weaker one is a break-in at both.
Swapping letters for symbols does not help as much as people think. A password like Pa$$w0rd! is short and predictable. Four ordinary words in a row is far harder to break and far easier to remember.
Do this
- Use a different password for your email, your bank and your main social accounts. If you fix only three, fix those three.
- Make them long. Four unrelated words beat eight scrambled characters.
- Turn on two step login wherever it is offered. An app that generates codes is stronger than codes by text message, because a phone number can be stolen.
- Let your phone or browser remember passwords for you, or use a password manager. A written list in a drawer at home is also fine. The danger is reuse, not storage.
Your email account is the master key
Almost every other account can be reset through your email. If someone gets into it, they do not need any of your other passwords - they can simply ask each site to send a reset link. Protect that one account harder than the rest, and check that the recovery phone number and backup address on it still belong to you.
Worth knowing
You can check whether an address of yours has appeared in a known data breach at haveibeenpwned.com, a free service run by security researcher Troy Hunt. If it has, change that password everywhere you used it. Being on the list is common and is not a sign you did anything wrong.
A post carries more than the picture
When you put something online, you are sharing three things at once: what is in the frame, what is around it, and who is allowed to pass it on. The first is obvious. The other two are what catch people out.
What the background gives away
A photo taken on your doorstep can show a house number. A photo in a school jumper shows which school. A bus in the corner shows a route, and a route shows a neighbourhood. None of these matter on their own. Together they let a stranger work out where a child is at half past three on a Tuesday.
About hidden photo data
Photos from a phone can store the exact place they were taken inside the file itself. The large social platforms strip this out when you upload, but a file sent directly - as an email attachment, or as a document rather than a photo in a chat app - often keeps it. If you are sending an original file to someone you do not know well, send it as a photo, not as a file.
Things that are never worth posting
- Your home address, your school or workplace name, or a photo that clearly shows either.
- Your full date of birth alongside your full name. Together they are used to prove identity.
- Boarding passes, tickets, bank cards or official letters, even partly covered. The codes on them carry more than they look like they do.
- A live location. Posting where you are now is different from posting where you were last week.
Urgency is the lever
Scams differ wildly on the surface. A parcel that cannot be delivered, a bank warning, a tax refund, a friend who has lost their phone and needs money, a job that pays too well. Underneath, nearly all of them do the same four things.
- They create a deadline. Act now, today, or the account closes and the money is gone.
- They borrow authority. A bank, the police, a delivery company, a platform you actually use.
- They ask you to keep it quiet, or to stay on the phone while you act, so that nobody talks you out of it.
- They want an unusual payment: gift card codes, a transfer to a new account, cryptocurrency. All of these are hard or impossible to reverse, which is exactly why they are asked for.
If a message does three of those four, it is a scam, whatever it says it is.
The move that defeats almost all of it
Stop, and make contact yourself through a route you already trust. Hang up and dial the number printed on your bank card. Open the delivery company’s app rather than tapping the link. Ring your grandson on the number you have always had for him. A genuine organisation will never mind you calling them back. A scammer cannot survive it.
Two things nobody legitimate will ever ask for
No bank, platform, tax office or police force will ask for your full password, or for a one time code that was sent to your phone. Those codes exist to keep other people out of your account. Reading one aloud hands the account over. If someone asks, that alone tells you who they are.
Checking a link before you tap it
The part of a web address that matters is the last two words before the first single slash. In bank.example-secure.com/login the real site is example-secure.com, not your bank. On a computer you can rest the pointer over a link and read the real address at the bottom of the window. On a phone, press and hold instead of tapping, and the address appears.
Five questions that work on every app
Settings menus are redesigned constantly, so a step by step guide for one app goes out of date in months. The questions do not change. Open the privacy section of any app and find the answer to each of these.
- Who can see what I post? Set it to friends or followers you have approved, not to everyone.
- Who can message me? Restrict this to people you already follow or have accepted. This one setting removes most unwanted contact.
- Who can find me? Turn off the options that let people find your profile by phone number or email address.
- Is my location being shared? Check both the app’s own location sharing and your phone’s permission for that app. Set it to while using the app, or off.
- Who is on my list? Scroll your followers or friends. Remove anyone you cannot place. You do not owe anyone a connection.
Do it together
If you are helping a child or an older relative, sit next to them and let them press the buttons while you read the questions out. People remember what they did themselves, and a child who was involved in setting the rules is far more likely to come to you when something goes wrong.