No single product stops every attack. Effective protection comes from several simple layers that are regularly checked and improved.
Ask about trainingStart with the first five controls, then introduce the remaining practices progressively.
If a link in an email, text message, or chat takes you to a page asking for your password, don’t enter it! Open the service’s app or type its known website address into your browser yourself! Even a link sent by someone you know can lead to a fake website.
Enable two-factor or multi-factor authentication wherever it is available. Prefer a security key, passkey, or authenticator app over SMS.
Use a different password for every account. A long password generated by a password manager is best; use a passkey instead of a password where one is available.
Before signing in or entering data, inspect the complete address in the browser. Do not authenticate on a page opened from a suspicious link or whose domain you do not recognise.
Before selling, donating, or recycling a device, sign out of accounts, remove activation locks, and use the manufacturer's secure factory-reset procedure.
If you receive an approval request you did not initiate, reject it. Never enter a PIN, password, or verification code for a request you did not start. If notification previews could lead to accidental approval, consider disabling them.
Use separate, hard-to-guess PINs for your phone and authentication tools.
Before approving an authentication request, check that the code shown in your authentication app matches the code displayed by the website or service you’re signing in to.
Do not connect USB drives, cables, chargers, or other devices of unknown origin. They can damage equipment or attempt to access your data.
Do not give visitors access to your private home or office network. Create a separate guest network and use it for less-trusted IoT devices as well.
Before posting, check whether views through windows, building numbers, location metadata, or other landmarks could reveal where you live.
A copy can be made from a detailed photograph of a key. Do not post images that clearly show a key's profile or access-card information.
For lesser-known shops, use a virtual or single-use card. Keep only as much money in the linked account as you can afford to lose.
Do not send money or cryptocurrency to accounts in extortion emails or messages. Preserve the evidence, do not engage with the sender, and report it to the police.
Confirm a new or changed bank account through a second channel using contact details you already trust. Ask for an electronically signed invoice where practical. If your bank warns that the recipient or account details do not match, do not send the money.
If you notice an unknown transaction or subscription payment, block the card immediately and contact your bank.
Block a missing card at once. Even if you later find it, ask the bank to replace it.
If a statement contains transactions you do not recognise, contact the bank and block the card. Restrict the account itself if necessary.
Do not share codes received by text, email, or an app from Facebook, Instagram, WhatsApp, or another service. Legitimate support staff do not need these codes.
Caller ID can be spoofed. End the call and ring the bank, authority, or company using a number from its official website or the back of your card.
A file extension does not prove that a file is safe. Documents can also be malicious. Confirm unexpected attachments with the sender through another channel and never enable macros or run embedded programs.
Use a written employment contract and verify the employer. Do not make upfront payments to an unknown recipient for starting work, equipment, or paperwork.
Where possible, meet in a safe public place and inspect the item. Do not open “delivery” or “receive payment” links sent by a seller, and never enter card details into them.
Check that the investment provider is licensed or authorized by the relevant financial regulator in your country. Guaranteed returns and pressure to borrow money are strong warning signs.
Open verification registerWhen buying medicines or food supplements, check that the product is listed or authorized by the relevant health or food-safety authority in your country, especially when buying outside a licensed pharmacy.
Enable automatic updates for the computers, phones, browsers, apps, and routers. Replace devices that no longer receive security updates.
Do not transfer money or send gift-card codes to strangers you met online. Gift cards are irreversible payments frequently requested by scammers.
Destroy documents containing personal, financial, or access information with a cross-cut shredder or a trusted confidential-document disposal service.
Regularly back up important documents and photos! Keep at least one copy separate from your device, for example, on an external drive that you disconnect after backing up! Occasionally check that you can restore files from your backup!