Cyber security tips: how to stay safe online at home and at work

The threats you are most likely to meet

Most attacks on individuals and small offices go after people rather than systems. The UK's NCSC says the majority of cyber harms to individuals start with criminals stealing or compromising login details, and the US numbers point the same way. The FBI's Internet Crime Complaint Center (IC3) received 1,008,597 complaints in 2025, with reported losses of $20.877 billion, and phishing and spoofing was the crime type reported most often, with 191,561 complaints (2025 IC3 Annual Report).

Two definitions help with the rest of this guide. Malware is software that runs on your device against your interests. Get Cyber Safe describes how it reaches passwords: by reading them where they are stored, watching the websites you visit and recording what you type with a keystroke logger (Get Cyber Safe). Ransomware is malware that blocks access to your files or systems until a ransom is paid, usually by encrypting them. The IC3 received more than 3,600 ransomware complaints in 2025, and notes that the losses reported to it usually leave out lost business, time and files, and the cost of recovery.

Spot and report phishing and scam messages

Phishing is a message that pretends to come from someone you trust, so that you click a link, open an attachment, pay, or hand over a password or card number. It arrives by email, by text message (smishing), by direct message on social media (our social media safety guide covers the scams specific to it) or by phone (vishing). CISA's phishing guidance lists the signs:

• urgent or emotional language, especially a threat of consequences if you do not act now;
• a request for personal or financial information;
• shortened links you cannot check, and addresses or links that are nearly right, such as amazan.com;
• a story you were not expecting: the FTC lists suspicious sign-in attempts, a problem with your payment details, an invoice you do not recognize and a government refund.

Spelling mistakes used to give phishing away. CISA now warns that in the era of AI some phishing emails have perfect grammar, so rely on the other signs. The same technology clones voices: the FBI's December 2024 alert on AI-enabled fraud advises agreeing a secret word or phrase with your family, and hanging up and calling back on a number you have looked up yourself when a caller asks for money.

What to do with a suspicious message:

1. Do not click, reply or call the number in it, including any "unsubscribe" link.
2. Check through another channel. Open the company's app or type its web address yourself, or contact the person on a number you already have.
3. Report it, then delete it. Use the report phishing or report spam option in your mail or messaging app; each country runs a forwarding service for scam emails and texts (the reporting table below lists them).

The strongest protection against a fake sign-in page is a sign-in method that will not work on it, which is the next habit.

Lock down your accounts: passkeys, password managers and MFA

Account takeover usually starts with a reused password. One site is breached, criminals try the same email address and password everywhere else, and the account that matters most, your email, falls with it. Whoever controls your email can reset most of your other passwords, which is why the first Cyber Aware action is a strong, separate password for your email account.

The fix is to stop depending on passwords you have to remember. Passkeys are the strongest option. A passkey is a sign-in credential based on public-key cryptography, kept on your phone, computer or password manager and unlocked with your fingerprint, face or PIN. The NCSC explains that each website gets its own passkey, so your device cannot be tricked into signing in to a fake site, and a breach of the website does not expose a secret that works anywhere else (NCSC). On April 23, 2026 the NCSC changed its advice: passkeys should now be consumers' first choice wherever a service supports them, and its technical report found them at least as secure as, and generally more secure than, the strongest password paired with two-step verification.

Where a service does not offer passkeys yet:

1. Use a password manager. It generates, stores and fills a different strong password for every account, so a breach at one site exposes only that site. CISA's password guidance points out that some are free and built into web browsers; the one you need to remember is the password manager's own.
2. Turn on multi-factor authentication (MFA), also called two-step verification (2SV) or two-factor authentication (2FA), starting with email, banking and social media. CISA's MFA steps are the same for most services: open the account's security settings, find two-factor or two-step authentication, and choose a method.

When you do have to make up a password, the agencies agree on length over complexity:

Not every MFA method is equal, but any is far better than none. A study of Microsoft Azure Active Directory accounts by Microsoft researchers (Meyer et al., 2023) found that MFA reduced the risk of compromise by 99.22% across the population, and by 98.56% where credentials had already leaked; authenticator apps outperformed codes sent by SMS. Turn on what is offered today, then move to an authenticator app, a security key or a passkey when you can.

Keep software updated and malware out

Flaws in software can give criminals a way into your files and accounts, and updates are how vendors close them. CISA's update advice is short: install updates as soon as you are notified, especially for web browsers and security software, and turn on automatic updates so they happen without you. The rest follows from the NCSC's device guidance:

• Turn on automatic updates for the operating system, browser and apps on every device. Our guide to updating a computer or phone covers Windows, macOS, Linux, iPhone and Android.
• Replace devices that no longer get updates. The replacement does not have to be the latest model, only one that still receives them.
• Install apps only from official stores or the developer's website, and delete the ones you no longer use.
• Keep the built-in protection on. Modern devices ship with antivirus and a firewall turned on by default; check that nobody has switched them off. Our guide to choosing antivirus software covers when the built-in protection is enough.
• Change default passwords on routers, cameras and other connected devices, and keep their firmware updated.

Protect a lost or stolen phone or laptop

A phone lost while unlocked hands its finder your email, messages, banking apps and the codes your accounts send for MFA. Three settings, all made before anything goes wrong, turn a lost device from a breach into an expense. The exact screens on iPhone, Android, Windows and Mac are in our guide to securing your personal devices.

Lock the screen

The NCSC recommends a 6-digit PIN or a strong password to unlock a device, and fingerprint or face recognition on top where the device supports it. Avoid guessable PINs such as 123456, and do not reuse the same PIN across devices.

Encrypt the storage

Encryption scrambles what is stored so that someone who takes the drive out, or starts the device another way, cannot read it without your sign-in or recovery key.

• iPhone and iPad: setting a passcode turns on Apple's Data Protection automatically (Apple Platform Security).
• Android: devices launched with Android 10 or later must use file-based encryption, and the default storage for your data is available only after you unlock the device (Android Open Source Project).
• Windows: Device Encryption, which turns on BitLocker encryption automatically, is enabled when you set up the PC with a Microsoft account, or a work or school account, and its recovery key is stored in that account. With a local account it is not turned on automatically (Microsoft Support). Our Windows setup guide shows where to check it and find the key.
• Mac: Macs with Apple silicon or a T2 chip encrypt data automatically, and FileVault adds the requirement to enter your login password before anyone can decrypt it (Apple Support).

Set up remote lock and erase before you need it

Apple's Find My, Android's Find Hub and Windows' Find My Device can locate and lock a missing device, and the phone versions can erase it, but only if they were switched on beforehand (Apple, Google, Microsoft). On Android, Find Hub turns on when you add a Google Account; on Windows, Find My Device needs a Microsoft account with administrator rights and location turned on.

On iPhone, Stolen Device Protection (iOS 17.3 or later) deals with the thief who watched you type your passcode. Away from familiar places such as home or work, it requires Face ID or Touch ID, with no passcode fallback, to open saved passwords and cards, and it makes you wait an hour before changes such as a new Apple Account password (Apple Support). If an iPhone is gone for good, report it to the police and your carrier and erase it remotely, but do not remove it from Find My: that keeps Activation Lock on and makes the phone harder to resell.

Back up what you cannot afford to lose

Backups are the defence that covers every way of losing data: ransomware, a stolen laptop, a failed drive or a file deleted by mistake. CISA's 3-2-1 rule is the standard shape:

• 3 copies of anything important: the original and two backups;
• 2 different types of storage, such as an external drive and a cloud service;
• 1 copy kept off site, outside your home or office.

Against ransomware, one of those copies has to be offline. CISA's #StopRansomware Guide explains why: many ransomware variants look for backups they can reach and delete or encrypt them, so a drive that stays plugged in can be lost with the originals. Unplug the backup drive after each run, or use a backup service that keeps earlier versions, and test a restore from time to time.

A folder that syncs every change is not an offline copy on its own: a deletion or an encrypted file syncs too. If a file is already gone, our guide to recovering deleted files on Windows goes through the Recycle Bin, OneDrive, File History and recovery tools in the order to try them.

Is public Wi-Fi safe to use?

For everyday browsing, mostly yes. The FTC explains that hotspots were risky when most websites did not encrypt traffic; today most do, so connecting through public Wi-Fi is usually safe. Look for the padlock or https:// before you sign in. With apps it is harder to tell, although the FTC notes that most encrypt too.

The risks that remain are the ones encryption does not cover. Snooping is unauthorized access to someone else's data, on a network, a device or a screen. Eavesdropping is the narrower act of intercepting communications as they travel. On a hotspot, Get Cyber Safe warns about three things:

• Fake hotspots. An evil twin uses the same or a similar name as the real network so that devices join it. Ask the staff for the exact network name before you connect.
• The rest of the network. Anyone can join a public network, including someone looking for devices that are not up to date. Keep updates current and the firewall on, and turn Wi-Fi off when you are not using it.
• Shoulder surfing. The oldest form of snooping still works in a café or on a train.

Get Cyber Safe is more cautious than the FTC: it advises against banking or shopping on public Wi-Fi and suggests a VPN if you use hotspots often. A practical middle ground is to keep banking for your home network or mobile data, and to use a VPN if your work depends on hotspots. For how these attacks work, and the other meanings of the words (DHCP snooping on network switches, for example), read what snooping is in cyber security and how eavesdropping attacks work.

What a DDoS attack means for you and your business

A denial-of-service (DoS) attack makes a website or online service unavailable by flooding it with traffic until it cannot respond. A distributed denial-of-service (DDoS) attack does the same from many machines at once, usually a botnet of hijacked devices (CISA). The target is a service, not a person, but home devices can take part without their owners knowing: CISA notes that internet-connected devices with default passwords are easy to recruit, and that their owners are victims too. Changing default passwords and updating firmware, as above, keeps your router and cameras out of someone else's attack.

If your business runs a website or online shop, the defence sits in front of it. CISA recommends a DoS protection service that detects abnormal traffic and filters it before it reaches your network, and a plan that says who to call. Our explainer on how DDoS attacks work covers the attack types and a response runbook for a small business.

If you have been hacked or scammed: what to do first

Then work through the rest in this order, following the NCSC's recovery steps:

1. Recover the account through the provider's own help pages, found by typing its address, never through a link in a message.
2. Check your email for forwarding rules and filters you did not create. The NCSC warns that criminals add them to receive copies of your mail, including password reset links.
3. Change the password on the hacked account and on every account that used the same one.
4. Sign out all other devices and apps from the account's settings.
5. Turn on two-step verification if it was not already on.
6. Update your devices, and scan them if you opened an attachment or installed something. The FTC advises updating your security software before the scan.
7. Tell your contacts to treat recent messages from the account with suspicion.
8. Report it, using the table below. In the US, if a scammer has your Social Security, card or bank account number, IdentityTheft.gov lists the steps for what was exposed.

Where to report fraud in the US, Canada and the UK

Report even when nothing was lost. The NCSC uses reported emails to take down scam addresses and websites, and the Canadian Anti-Fraud Centre (CAFC) says reports can link crimes together in Canada and abroad.

Sources for the table: the FTC for the US; Get Cyber Safe and the CAFC for Canada; the NCSC's pages on scam emails and scam texts for the UK.

A UK business, charity or other organization under a live cyber attack should call Report Fraud on 0300 123 2040 straight away. In the US, a business hit by ransomware should file a report with the IC3.

Security basics for a small office

Everything above applies at work. The NCSC's small organisations guide opens with the reason to act: it says one in two small businesses suffers a cyber incident every year. A business adds problems a household does not have: many accounts to keep consistent, people who join and leave, and payments that can be redirected.

Start from a published baseline rather than a shopping list of products:

• CIS Controls v8.1, Implementation Group 1 (IG1): 56 safeguards that the Center for Internet Security defines as essential cyber hygiene, written for small and medium organizations with limited IT and security expertise (CIS).
• The NCSC's small organisations guide (published April 2026): securing email, important accounts and devices, backups and spotting attacks, with many steps that take as little as five minutes.
• The Canadian Centre for Cyber Security's baseline controls: 13 controls for organizations with fewer than 500 employees, written to get 80% of the benefit from 20% of the effort (Cyber Centre).

Two habits are worth adding on day one. First, confirm every change of bank details by phone, on a number you already hold: business email compromise, where a criminal poses as a supplier or an executive to redirect a payment, accounted for $3.05 billion in losses reported to the IC3 in 2025. Second, remove access the day someone leaves: their accounts, their sessions and the devices they used.

If you would rather hand this to someone, our IT support service uses CIS Controls IG1 as the baseline for the small teams it supports, and covers identity and MFA, device management with disk encryption, and endpoint security. Our security scanning service checks your websites and servers from the outside, including the DMARC, SPF and DKIM records that stop your email domain being spoofed.