# Cyber security tips: how to stay safe online at home and at work > The habits that stop most attacks: passkeys or a password manager, MFA, updates, encryption, backups and spotting phishing, plus where to report fraud. - URL: https://computese.com/cyber-it-security/ - Author: Duong Quan Nguyen, CEO, Computese - Published: 2024-05-30 - Updated: 2026-09-25 - Topics: Security, IT support ## In short - Most cyber harm to individuals starts with stolen or compromised login details, the NCSC says, and phishing and spoofing was the crime type reported most often to the FBI's IC3 in 2025, with 191,561 complaints. - A few habits stop most of them: passkeys or a password manager, multi-factor authentication, automatic updates, a screen lock with encryption, backups with one copy offline, and checking unexpected requests another way. - Since April 2026 the UK's NCSC recommends passkeys wherever a service offers them. Where it does not, use a unique password from a password manager and keep two-step verification on. - If money has moved, call your bank first, then report it: ReportFraud.ftc.gov and IC3 in the US, the Canadian Anti-Fraud Centre, or Report Fraud in England, Wales and Northern Ireland. Scam texts go to 7726 in all three countries. - A small office should start from a published baseline, such as CIS Controls IG1 or the NCSC's small organisations guide, and confirm every payment change by phone. Staying safe online comes down to a few habits that block most attacks: a passkey or unique password for every account, multi-factor authentication, automatic updates, a locked and encrypted phone and laptop, regular backups, and treating any unexpected request for money or details as a scam until you have checked it another way. Government programs in three countries give the same core advice: CISA's [Secure Our World](https://www.cisa.gov/secure-our-world) campaign in the US (its pages now carry CISA's archive label), the NCSC's [Cyber Aware](https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online) actions in the UK and [Get Cyber Safe](https://www.getcybersafe.gc.ca/en) in Canada. This guide explains the threats those habits stop, how to set each one up, what to do and where to report if something has already gone wrong, and where a small office should start. For the attacks themselves in more depth, see our explainers on [snooping](https://computese.com/understanding-snooping-attacks-how-they-work/), [eavesdropping](https://computese.com/understanding-eavesdropping-attacks-how-they-work/) and [DDoS attacks](https://computese.com/understanding-ddos-attacks-how-they-work/). ## The threats you are most likely to meet Most attacks on individuals and small offices go after people rather than systems. The UK's [NCSC](https://www.ncsc.gov.uk/news/ncsc-leave-passwords-in-the-past-passkeys-are-the-future) says the majority of cyber harms to individuals start with criminals stealing or compromising login details, and the US numbers point the same way. The FBI's Internet Crime Complaint Center (IC3) received 1,008,597 complaints in 2025, with reported losses of $20.877 billion, and phishing and spoofing was the crime type reported most often, with 191,561 complaints ([2025 IC3 Annual Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf)). | Threat | What it looks like | The habit that stops most of it | | ----------------------------- | ---------------------------------------------------------------------------------------------- | ----------------------------------------------------- | | Phishing and scam messages | An email, text, direct message or call that asks you to click, sign in, pay or confirm details | Pause, check through another channel, report | | Account takeover | Someone signs in with a password stolen in a breach or reused from another site | Passkeys or a password manager, plus MFA | | Malware and ransomware | Software that steals passwords, spies on you or locks your files | Automatic updates, official app stores, backups | | Snooping and eavesdropping | Someone reads your data or intercepts your traffic, for example through a fake hotspot | HTTPS, the right network, a locked screen | | Lost or stolen devices | A phone or laptop in the wrong hands, with email and banking still signed in | Screen lock, device encryption, remote lock and erase | | DDoS attacks (for businesses) | A website or online shop knocked offline by a flood of traffic | A protection service in front of the site | Two definitions help with the rest of this guide. **Malware** is software that runs on your device against your interests. Get Cyber Safe describes how it reaches passwords: by reading them where they are stored, watching the websites you visit and recording what you type with a keystroke logger ([Get Cyber Safe](https://www.getcybersafe.gc.ca/en/secure-your-accounts/passphrases-passwords-and-pins)). **Ransomware** is malware that blocks access to your files or systems until a ransom is paid, usually by encrypting them. The IC3 received more than 3,600 ransomware complaints in 2025, and notes that the losses reported to it usually leave out lost business, time and files, and the cost of recovery. ## Spot and report phishing and scam messages Phishing is a message that pretends to come from someone you trust, so that you click a link, open an attachment, pay, or hand over a password or card number. It arrives by email, by text message (smishing), by direct message on social media (our [social media safety guide](https://computese.com/how-to-use-social-media-safely/) covers the scams specific to it) or by phone (vishing). CISA's [phishing guidance](https://www.cisa.gov/secure-our-world/recognize-and-report-phishing) lists the signs: - urgent or emotional language, especially a threat of consequences if you do not act now; - a request for personal or financial information; - shortened links you cannot check, and addresses or links that are nearly right, such as `amazan.com`; - a story you were not expecting: the [FTC](https://consumer.ftc.gov/articles/how-recognize-avoid-phishing-scams) lists suspicious sign-in attempts, a problem with your payment details, an invoice you do not recognize and a government refund. Spelling mistakes used to give phishing away. CISA now warns that in the era of AI some phishing emails have perfect grammar, so rely on the other signs. The same technology clones voices: the FBI's [December 2024 alert](https://www.ic3.gov/PSA/2024/PSA241203) on AI-enabled fraud advises agreeing a secret word or phrase with your family, and hanging up and calling back on a number you have looked up yourself when a caller asks for money. What to do with a suspicious message: 1. **Do not click, reply or call the number in it**, including any "unsubscribe" link. 2. **Check through another channel.** Open the company's app or type its web address yourself, or contact the person on a number you already have. 3. **Report it, then delete it.** Use the report phishing or report spam option in your mail or messaging app; each country runs a forwarding service for scam emails and texts (the reporting table below lists them). > [!WARNING] > A padlock or `https://` in the address bar does not make a site honest. It means the connection is encrypted, and the [FTC](https://consumer.ftc.gov/articles/are-public-wi-fi-networks-safe-what-you-need-know) points out that scammers encrypt their fake sites too. The strongest protection against a fake sign-in page is a sign-in method that will not work on it, which is the next habit. ## Lock down your accounts: passkeys, password managers and MFA Account takeover usually starts with a reused password. One site is breached, criminals try the same email address and password everywhere else, and the account that matters most, your email, falls with it. Whoever controls your email can reset most of your other passwords, which is why the first Cyber Aware action is a strong, separate password for your email account. The fix is to stop depending on passwords you have to remember. **Passkeys** are the strongest option. A passkey is a sign-in credential based on public-key cryptography, kept on your phone, computer or password manager and unlocked with your fingerprint, face or PIN. The NCSC explains that each website gets its own passkey, so your device cannot be tricked into signing in to a fake site, and a breach of the website does not expose a secret that works anywhere else ([NCSC](https://www.ncsc.gov.uk/blog-post/trust-the-tech-using-password-managers-passkeys-to-help-you-stay-secure-online)). On April 23, 2026 the NCSC [changed its advice](https://www.ncsc.gov.uk/news/ncsc-leave-passwords-in-the-past-passkeys-are-the-future): passkeys should now be consumers' first choice wherever a service supports them, and its technical report found them at least as secure as, and generally more secure than, the strongest password paired with two-step verification. ![A phone holding an orange key signs in to the real website's server, which shows a check mark. The line toward an identical lookalike server stops at a blocked sign, so it gets nothing.](https://computese.com/images/blog/cyber-it-security/passkey.11df96ff37-1536.webp) *A passkey belongs to the site that created it, so a perfect copy of the sign-in page gets nothing from your phone.* Where a service does not offer passkeys yet: 1. **Use a password manager.** It generates, stores and fills a different strong password for every account, so a breach at one site exposes only that site. CISA's [password guidance](https://www.cisa.gov/secure-our-world/use-strong-passwords) points out that some are free and built into web browsers; the one you need to remember is the password manager's own. 2. **Turn on multi-factor authentication (MFA)**, also called two-step verification (2SV) or two-factor authentication (2FA), starting with email, banking and social media. CISA's [MFA steps](https://www.cisa.gov/secure-our-world/turn-mfa) are the same for most services: open the account's security settings, find two-factor or two-step authentication, and choose a method. When you do have to make up a password, the agencies agree on length over complexity: | Source | Advice | | ------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | | CISA (US) | At least 16 characters, random (a random string, or a passphrase of 4 to 7 unrelated words) and unique | | NCSC (UK) | Three random words | | Get Cyber Safe (Canada) | A passphrase of four or more random words and at least 15 characters | | [NIST SP 800-63B-4](https://pages.nist.gov/800-63-4/sp800-63b.html) (July 2025) | Services must require at least 15 characters for a password used on its own, with no forced mixes of character types and no forced periodic changes | Not every MFA method is equal, but any is far better than none. A study of Microsoft Azure Active Directory accounts by Microsoft researchers ([Meyer et al., 2023](https://arxiv.org/abs/2305.00945)) found that MFA reduced the risk of compromise by 99.22% across the population, and by 98.56% where credentials had already leaked; authenticator apps outperformed codes sent by SMS. Turn on what is offered today, then move to an authenticator app, a security key or a passkey when you can. ## Keep software updated and malware out Flaws in software can give criminals a way into your files and accounts, and updates are how vendors close them. CISA's [update advice](https://www.cisa.gov/secure-our-world/update-software) is short: install updates as soon as you are notified, especially for web browsers and security software, and turn on automatic updates so they happen without you. The rest follows from the NCSC's [device guidance](https://www.ncsc.gov.uk/collection/small-organisations-guide-to-cyber-security/protecting-your-devices): - **Turn on automatic updates** for the operating system, browser and apps on every device. Our guide to [updating a computer or phone](https://computese.com/how-to-update-your-computer-or-phone/) covers Windows, macOS, Linux, iPhone and Android. - **Replace devices that no longer get updates.** The replacement does not have to be the latest model, only one that still receives them. - **Install apps only from official stores or the developer's website**, and delete the ones you no longer use. - **Keep the built-in protection on.** Modern devices ship with antivirus and a firewall turned on by default; check that nobody has switched them off. Our guide to [choosing antivirus software](https://computese.com/choose-the-right-antivirus-software-for-your-pc/) covers when the built-in protection is enough. - **Change default passwords** on routers, cameras and other connected devices, and keep their firmware updated. ## Protect a lost or stolen phone or laptop A phone lost while unlocked hands its finder your email, messages, banking apps and the codes your accounts send for MFA. Three settings, all made before anything goes wrong, turn a lost device from a breach into an expense. The exact screens on iPhone, Android, Windows and Mac are in our guide to [securing your personal devices](https://computese.com/secure-your-personal-devices-from-cyber-attacks/). ### Lock the screen The NCSC recommends a 6-digit PIN or a strong password to unlock a device, and fingerprint or face recognition on top where the device supports it. Avoid guessable PINs such as 123456, and do not reuse the same PIN across devices. ### Encrypt the storage Encryption scrambles what is stored so that someone who takes the drive out, or starts the device another way, cannot read it without your sign-in or recovery key. - **iPhone and iPad:** setting a passcode turns on Apple's Data Protection automatically ([Apple Platform Security](https://support.apple.com/guide/security/passcodes-and-passwords-sec20230a10d/web)). - **Android:** devices launched with Android 10 or later must use file-based encryption, and the default storage for your data is available only after you unlock the device ([Android Open Source Project](https://source.android.com/docs/security/features/encryption/file-based)). - **Windows:** Device Encryption, which turns on BitLocker encryption automatically, is enabled when you set up the PC with a Microsoft account, or a work or school account, and its recovery key is stored in that account. With a local account it is not turned on automatically ([Microsoft Support](https://support.microsoft.com/en-us/windows/security/encryption/device-encryption-in-windows)). Our [Windows setup guide](https://computese.com/how-to-set-up-windows-for-a-new-computer/) shows where to check it and find the key. - **Mac:** Macs with Apple silicon or a T2 chip encrypt data automatically, and FileVault adds the requirement to enter your login password before anyone can decrypt it ([Apple Support](https://support.apple.com/guide/mac-help/protect-data-on-your-mac-with-filevault-mh11785/mac)). ![A drive taken out of a laptop is connected to another computer, whose screen shows only scattered noise. The drive is orange and carries a small padlock.](https://computese.com/images/blog/cyber-it-security/drive.b9c6fb3e32-1536.webp) *With encryption on, a drive pulled from a stolen laptop is noise to anyone without your sign-in or recovery key.* ### Set up remote lock and erase before you need it Apple's Find My, Android's Find Hub and Windows' Find My Device can locate and lock a missing device, and the phone versions can erase it, but only if they were switched on beforehand ([Apple](https://support.apple.com/en-us/101593), [Google](https://support.google.com/android/answer/6160491?hl=en), [Microsoft](https://support.microsoft.com/en-us/accounts-billing/security/find-and-lock-a-lost-windows-device)). On Android, Find Hub turns on when you add a Google Account; on Windows, Find My Device needs a Microsoft account with administrator rights and location turned on. On iPhone, Stolen Device Protection (iOS 17.3 or later) deals with the thief who watched you type your passcode. Away from familiar places such as home or work, it requires Face ID or Touch ID, with no passcode fallback, to open saved passwords and cards, and it makes you wait an hour before changes such as a new Apple Account password ([Apple Support](https://support.apple.com/en-us/120340)). If an iPhone is gone for good, report it to the police and your carrier and erase it remotely, but do not remove it from Find My: that keeps Activation Lock on and makes the phone harder to resell. ## Back up what you cannot afford to lose Backups are the defence that covers every way of losing data: ransomware, a stolen laptop, a failed drive or a file deleted by mistake. CISA's [3-2-1 rule](https://www.cisa.gov/sites/default/files/publications/data_backup_options.pdf) is the standard shape: - **3** copies of anything important: the original and two backups; - **2** different types of storage, such as an external drive and a cloud service; - **1** copy kept off site, outside your home or office. Against ransomware, one of those copies has to be offline. CISA's [#StopRansomware Guide](https://www.cisa.gov/stopransomware/ransomware-guide) explains why: many ransomware variants look for backups they can reach and delete or encrypt them, so a drive that stays plugged in can be lost with the originals. Unplug the backup drive after each run, or use a backup service that keeps earlier versions, and test a restore from time to time. ![Ransomware has locked a laptop's files and the backup drive plugged into it, while an orange drive kept unplugged on a shelf still holds a clean copy, with a third copy in the cloud.](https://computese.com/images/blog/cyber-it-security/backup.8e41250be6-1536.webp) *Ransomware encrypts whatever it can reach, including a backup drive left plugged in. The copy that survives is the one kept offline.* A folder that syncs every change is not an offline copy on its own: a deletion or an encrypted file syncs too. If a file is already gone, our guide to [recovering deleted files on Windows](https://computese.com/how-to-recover-deleted-files-on-windows/) goes through the Recycle Bin, OneDrive, File History and recovery tools in the order to try them. ## Is public Wi-Fi safe to use? For everyday browsing, mostly yes. The [FTC](https://consumer.ftc.gov/articles/are-public-wi-fi-networks-safe-what-you-need-know) explains that hotspots were risky when most websites did not encrypt traffic; today most do, so connecting through public Wi-Fi is usually safe. Look for the padlock or `https://` before you sign in. With apps it is harder to tell, although the FTC notes that most encrypt too. The risks that remain are the ones encryption does not cover. **Snooping** is unauthorized access to someone else's data, on a network, a device or a screen. **Eavesdropping** is the narrower act of intercepting communications as they travel. On a hotspot, [Get Cyber Safe](https://www.getcybersafe.gc.ca/en/secure-your-connections/public-wi-fi) warns about three things: - **Fake hotspots.** An **evil twin** uses the same or a similar name as the real network so that devices join it. Ask the staff for the exact network name before you connect. - **The rest of the network.** Anyone can join a public network, including someone looking for devices that are not up to date. Keep updates current and the firewall on, and turn Wi-Fi off when you are not using it. - **Shoulder surfing.** The oldest form of snooping still works in a café or on a train. Get Cyber Safe is more cautious than the FTC: it advises against banking or shopping on public Wi-Fi and suggests a VPN if you use hotspots often. A practical middle ground is to keep banking for your home network or mobile data, and to use a VPN if your work depends on hotspots. For how these attacks work, and the other meanings of the words (DHCP snooping on network switches, for example), read [what snooping is in cyber security](https://computese.com/understanding-snooping-attacks-how-they-work/) and [how eavesdropping attacks work](https://computese.com/understanding-eavesdropping-attacks-how-they-work/). ## What a DDoS attack means for you and your business A denial-of-service (DoS) attack makes a website or online service unavailable by flooding it with traffic until it cannot respond. A distributed denial-of-service (DDoS) attack does the same from many machines at once, usually a **botnet** of hijacked devices ([CISA](https://www.cisa.gov/news-events/news/understanding-denial-service-attacks)). The target is a service, not a person, but home devices can take part without their owners knowing: CISA notes that internet-connected devices with default passwords are easy to recruit, and that their owners are victims too. Changing default passwords and updating firmware, as above, keeps your router and cameras out of someone else's attack. If your business runs a website or online shop, the defence sits in front of it. CISA recommends a DoS protection service that detects abnormal traffic and filters it before it reaches your network, and a plan that says who to call. Our explainer on [how DDoS attacks work](https://computese.com/understanding-ddos-attacks-how-they-work/) covers the attack types and a response runbook for a small business. ## If you have been hacked or scammed: what to do first > [!IMPORTANT] > If money has left your account, call your bank or card issuer before anything else and ask them to recall the payment. The IC3 says time is of the essence: in 2025 its Recovery Asset Team froze $679 million of $1.16 billion in attempted theft, across 3,900 incidents. Then work through the rest in this order, following the [NCSC's recovery steps](https://www.ncsc.gov.uk/guidance/recovering-a-hacked-account): 1. **Recover the account** through the provider's own help pages, found by typing its address, never through a link in a message. 2. **Check your email for forwarding rules and filters** you did not create. The NCSC warns that criminals add them to receive copies of your mail, including password reset links. 3. **Change the password** on the hacked account and on every account that used the same one. 4. **Sign out all other devices and apps** from the account's settings. 5. **Turn on two-step verification** if it was not already on. 6. **Update your devices, and scan them** if you opened an attachment or installed something. The FTC advises updating your security software before the scan. 7. **Tell your contacts** to treat recent messages from the account with suspicion. 8. **Report it**, using the table below. In the US, if a scammer has your Social Security, card or bank account number, [IdentityTheft.gov](https://www.identitytheft.gov/) lists the steps for what was exposed. ## Where to report fraud in the US, Canada and the UK Report even when nothing was lost. The NCSC uses reported emails to take down scam addresses and websites, and the Canadian Anti-Fraud Centre (CAFC) says reports can link crimes together in Canada and abroad. | What happened | United States | Canada | United Kingdom | | ------------------- | --------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- | | Scam email | Forward it to `reportphishing@apwg.org` | Report it to the CAFC online | Forward it to `report@phishing.gov.uk` | | Scam text message | Forward it to 7726 (SPAM) | Forward it to 7726 (SPAM), free of charge | Forward it to 7726, free with most providers | | Fraud or cybercrime | [ReportFraud.ftc.gov](https://reportfraud.ftc.gov/) and the FBI's [IC3](https://www.ic3.gov/) | Local police, and the CAFC at [reportcyberandfraud.canada.ca](https://reportcyberandfraud.canada.ca/) or 1-888-495-8501 | England, Wales and Northern Ireland: [Report Fraud](https://reportfraud.police.uk/) or 0300 123 2040. Scotland: Police Scotland on 101 | Sources for the table: the [FTC](https://consumer.ftc.gov/articles/how-recognize-avoid-phishing-scams) for the US; [Get Cyber Safe](https://www.getcybersafe.gc.ca/en/blogs/reporting-spam-text-messages-7726) and the [CAFC](https://antifraudcentre-centreantifraude.ca/report-signalez-eng.htm) for Canada; the NCSC's pages on [scam emails](https://www.ncsc.gov.uk/collection/phishing-scams/report-scam-email) and [scam texts](https://www.ncsc.gov.uk/collection/phishing-scams/report-scam-text-message) for the UK. A UK business, charity or other organization under a live cyber attack should call Report Fraud on 0300 123 2040 straight away. In the US, a business hit by ransomware should file a report with the IC3. ## Security basics for a small office Everything above applies at work. The NCSC's [small organisations guide](https://www.ncsc.gov.uk/collection/small-organisations-guide-to-cyber-security) opens with the reason to act: it says one in two small businesses suffers a cyber incident every year. A business adds problems a household does not have: many accounts to keep consistent, people who join and leave, and payments that can be redirected. Start from a published baseline rather than a shopping list of products: - **CIS Controls v8.1, Implementation Group 1 (IG1):** 56 safeguards that the Center for Internet Security defines as essential cyber hygiene, written for small and medium organizations with limited IT and security expertise ([CIS](https://www.cisecurity.org/controls/implementation-groups/ig1)). - **The NCSC's small organisations guide** (published April 2026): securing email, important accounts and devices, backups and spotting attacks, with many steps that take as little as five minutes. - **The Canadian Centre for Cyber Security's baseline controls:** 13 controls for organizations with fewer than 500 employees, written to get 80% of the benefit from 20% of the effort ([Cyber Centre](https://www.cyber.gc.ca/en/guidance/baseline-cyber-security-controls-small-and-medium-organizations)). Two habits are worth adding on day one. First, **confirm every change of bank details by phone**, on a number you already hold: business email compromise, where a criminal poses as a supplier or an executive to redirect a payment, accounted for $3.05 billion in losses reported to the IC3 in 2025. Second, **remove access the day someone leaves**: their accounts, their sessions and the devices they used. If you would rather hand this to someone, our [IT support](https://computese.com/services/it-support/) service uses CIS Controls IG1 as the baseline for the small teams it supports, and covers identity and MFA, device management with disk encryption, and endpoint security. Our [security scanning](https://computese.com/services/security-testing/) service checks your websites and servers from the outside, including the DMARC, SPF and DKIM records that stop your email domain being spoofed. ## Key terms - **Phishing**: A message or call that pretends to come from someone you trust, to get you to click, open a file, pay or hand over details. By text message it is called smishing; by phone, vishing. - **Malware**: Software that runs on your device against your interests, such as viruses, spyware and keystroke loggers that record what you type. - **Ransomware**: Malware that blocks access to your files or systems, usually by encrypting them, until a ransom is paid. - **Account takeover**: Someone else signs in to your account, usually with a stolen or reused password, and often changes the recovery details so you cannot get back in. - **Multi-factor authentication (MFA)**: Signing in with a second proof beyond the password, such as a code from an authenticator app, a security key or a fingerprint. Also called two-step verification (2SV) or two-factor authentication (2FA). - **Passkey**: A sign-in credential based on public-key cryptography, kept on your device or in a password manager and unlocked with your fingerprint, face or PIN. It works only on the site it was created for. - **Password manager**: An app, or a feature built into a browser or phone, that generates, stores and fills a different strong password for every account. - **Device encryption**: Scrambling the data stored on a phone or computer so it can be read only after the device is unlocked. BitLocker, FileVault and Apple's Data Protection are examples. - **Evil twin**: A fake Wi-Fi hotspot with the same or a similar name as a real one, set up so that devices join it and send their traffic through the attacker. - **DDoS attack**: A distributed denial-of-service attack floods a website or network with traffic from many machines at once, usually a botnet of hijacked devices, until real users cannot reach it. ## Common questions ### What are the most important cyber security tips? Use passkeys or a password manager so every account has its own strong credential, and turn on multi-factor authentication. Let your devices update automatically, lock and encrypt your phone and laptop, and back up your files with one copy kept offline. Check any unexpected request for money or details through a channel you already trust. ### Is it safe to use public Wi-Fi? For everyday browsing, usually: the FTC notes that most websites now encrypt traffic, so other people on the hotspot cannot read it. The remaining risks are fake hotspots with a copied name, a device that is not up to date, and sites or apps that do not encrypt. Canada's Get Cyber Safe advises against banking on public Wi-Fi and suggests a VPN if you use hotspots often. ### What is the difference between cyber security and IT security? IT security, or information security, protects information and the systems that hold it, whatever the risk: an attacker, a lost laptop or a failed disk. Cyber security is the part that deals with attacks through networks and the internet. For a person or a small office the two overlap almost completely, which is why this guide treats them together. ### Is SMS two-factor authentication still worth turning on? Yes. Codes by text message are weaker than an authenticator app, but in a Microsoft study MFA cut the risk of account compromise by 99.22%, and authenticator apps did better than SMS. Turn on what is offered today and move to an authenticator app, a security key or a passkey when you can. ### How often should I change my passwords? When there is a reason: a breach at the service, a phishing message you answered, or a password you have reused elsewhere. NIST's SP 800-63B-4 tells services not to force periodic password changes, but to force one when there is evidence of compromise. ### What should I do if I clicked a link in a phishing message? If you typed a password, change it from the real site or app, along with any account that uses the same password, and sign out other sessions. If you downloaded a file, update your security software and run a scan. If you gave card or bank details, call your bank now; in the US, IdentityTheft.gov lists the steps for what was exposed. ## Sources 1. [Secure Our World](https://www.cisa.gov/secure-our-world), CISA 2. [Top tips for staying secure online (Cyber Aware)](https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online), National Cyber Security Centre (UK) 3. [Get Cyber Safe](https://www.getcybersafe.gc.ca/en), Government of Canada 4. [2025 IC3 Annual Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf), FBI Internet Crime Complaint Center 5. [Passphrases, passwords and PINs](https://www.getcybersafe.gc.ca/en/secure-your-accounts/passphrases-passwords-and-pins), Get Cyber Safe, Government of Canada 6. [Recognize and Report Phishing](https://www.cisa.gov/secure-our-world/recognize-and-report-phishing), CISA 7. [How To Recognize and Avoid Phishing Scams](https://consumer.ftc.gov/articles/how-recognize-avoid-phishing-scams), Federal Trade Commission 8. [Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud (I-120324-PSA)](https://www.ic3.gov/PSA/2024/PSA241203), FBI Internet Crime Complaint Center 9. [NCSC: Leave passwords in the past, passkeys are the future](https://www.ncsc.gov.uk/news/ncsc-leave-passwords-in-the-past-passkeys-are-the-future), National Cyber Security Centre (UK) 10. [Trusting the tech: using password managers and passkeys to help you stay secure online](https://www.ncsc.gov.uk/blog-post/trust-the-tech-using-password-managers-passkeys-to-help-you-stay-secure-online), National Cyber Security Centre (UK) 11. [Use Strong Passwords](https://www.cisa.gov/secure-our-world/use-strong-passwords), CISA 12. [Turn On MFA](https://www.cisa.gov/secure-our-world/turn-mfa), CISA 13. [SP 800-63B-4: Digital Identity Guidelines, Authentication and Authenticator Management](https://pages.nist.gov/800-63-4/sp800-63b.html), NIST 14. [How effective is multifactor authentication at deterring cyberattacks?](https://arxiv.org/abs/2305.00945), arXiv (Microsoft researchers) 15. [Update Software](https://www.cisa.gov/secure-our-world/update-software), CISA 16. [Small organisations guide to cyber security: Protecting your devices](https://www.ncsc.gov.uk/collection/small-organisations-guide-to-cyber-security/protecting-your-devices), National Cyber Security Centre (UK) 17. [Passcodes and passwords (Apple Platform Security)](https://support.apple.com/guide/security/passcodes-and-passwords-sec20230a10d/web), Apple 18. [File-based encryption](https://source.android.com/docs/security/features/encryption/file-based), Android Open Source Project 19. [Device Encryption in Windows](https://support.microsoft.com/en-us/windows/security/encryption/device-encryption-in-windows), Microsoft Support 20. [Protect data on your Mac with FileVault](https://support.apple.com/guide/mac-help/protect-data-on-your-mac-with-filevault-mh11785/mac), Apple Support 21. [How to find your lost iPhone or iPad](https://support.apple.com/en-us/101593), Apple Support 22. [Find, secure, or erase a lost Android device](https://support.google.com/android/answer/6160491?hl=en), Google Android Help 23. [Find and lock a lost Windows device](https://support.microsoft.com/en-us/accounts-billing/security/find-and-lock-a-lost-windows-device), Microsoft Support 24. [About Stolen Device Protection for iPhone](https://support.apple.com/en-us/120340), Apple Support 25. [Data Backup Options](https://www.cisa.gov/sites/default/files/publications/data_backup_options.pdf), CISA 26. [#StopRansomware Guide](https://www.cisa.gov/stopransomware/ransomware-guide), CISA 27. [Are Public Wi-Fi Networks Safe? What You Need To Know](https://consumer.ftc.gov/articles/are-public-wi-fi-networks-safe-what-you-need-know), Federal Trade Commission 28. [Public Wi-Fi](https://www.getcybersafe.gc.ca/en/secure-your-connections/public-wi-fi), Get Cyber Safe, Government of Canada 29. [Understanding Denial-of-Service Attacks](https://www.cisa.gov/news-events/news/understanding-denial-service-attacks), CISA 30. [Recovering a hacked account](https://www.ncsc.gov.uk/guidance/recovering-a-hacked-account), National Cyber Security Centre (UK) 31. [Report a scam email](https://www.ncsc.gov.uk/collection/phishing-scams/report-scam-email), National Cyber Security Centre (UK) 32. [Report a scam text](https://www.ncsc.gov.uk/collection/phishing-scams/report-scam-text-message), National Cyber Security Centre (UK) 33. [Reporting spam text messages to 7726](https://www.getcybersafe.gc.ca/en/blogs/reporting-spam-text-messages-7726), Get Cyber Safe, Government of Canada 34. [Report fraud and cybercrime](https://antifraudcentre-centreantifraude.ca/report-signalez-eng.htm), Canadian Anti-Fraud Centre 35. [Report Fraud: the place to report cyber crime and fraud](https://reportfraud.police.uk/), Report Fraud (UK police reporting service) 36. [CIS Critical Security Controls Implementation Group 1](https://www.cisecurity.org/controls/implementation-groups/ig1), Center for Internet Security 37. [Small organisations guide to cyber security](https://www.ncsc.gov.uk/collection/small-organisations-guide-to-cyber-security), National Cyber Security Centre (UK) 38. [Baseline cyber security controls for small and medium organizations](https://www.cyber.gc.ca/en/guidance/baseline-cyber-security-controls-small-and-medium-organizations), Canadian Centre for Cyber Security