Online Threats Are Real, and They Are Getting Smarter
Nobody is immune to online scams. It is not about being tech-savvy or old or young — it is about being human. Scammers exploit trust, urgency, and distraction. The same person who would never hand their bank card to a stranger on the street might click a link in a text message that looks like it came from their bank.
The National Cyber Security Centre (NCSC), part of GCHQ, tracks millions of malicious campaigns each year targeting UK residents and businesses. Phishing emails, fake websites, romance fraud, investment scams, ransomware — the list is long, but the defences are mostly the same small set of habits repeated consistently.
Passwords: Still the First Line of Defence
Most people know they should use strong passwords. Most people do not. The most commonly used passwords in the UK still include “password,” “123456,” and the names of Premier League football teams. If your password appears on a list of common passwords, assume criminals already have it.
Use a password manager. The built-in ones in your phone or browser are fine for most people — they are certainly better than reusing the same password across twenty different sites. The NCSC recommends using three random words strung together (like “sunset-piano-river”) as a strong and memorable password. Add two-factor authentication (2FA) wherever it is offered, especially for email, banking, and social media accounts.
Spotting Phishing and Scams
Phishing messages try to trick you into giving away passwords, payment details, or personal information. They arrive by email, text, WhatsApp, social media — every channel you use. The tell-tale signs are usually there if you pause before clicking: urgent language (“your account will be closed”), generic greetings (“Dear Customer”), slightly wrong sender addresses, and links that do not go where they claim to go.
If you receive a suspicious email, forward it to report@phishing.gov.uk — the NCSC’s Suspicious Email Reporting Service. They received over 32 million reports since launching and have taken down more than 300,000 scam websites as a result.
For scam texts, forward them to 7726 (which spells SPAM on a phone keypad). It is free, and your mobile network uses the reports to block future scam messages.
Protecting Your Devices
Install updates when they are available. Every time you hit “remind me later” on a software update, you are leaving a known security hole open. Most updates exist precisely because someone found a way in and the company patched it. Cyber criminals know what the patches fix and actively target devices that have not been updated.
On Windows, Windows Defender (built in) is sufficient for most users. On Macs, the built-in security is generally solid. You do not need to pay for third-party antivirus — the NCSC explicitly advises against it for typical home users. What you do need is to keep your operating system and applications current.
Social Media and Privacy
Check your privacy settings on every platform you use. The defaults are usually set to share more than you might want. On Facebook, review who can see your posts, who can look you up by email, and what apps are connected to your account. On Instagram and X, decide whether you want a public or private profile. On LinkedIn, be aware that your employment history is essentially public and can be used for social engineering.
Think about what you share. Photos of your home exterior can reveal your address. Posts about being on holiday tell people your house is empty. Your date of birth, mother’s maiden name, first pet — these are common security questions. If the answers are visible on your social media profiles, they are not good security questions anymore.
Children and Online Safety
If you have children, the online safety conversation cannot be a one-off chat. It needs to be ongoing, starting early, and adapted as they grow. Parental controls on devices and home broadband are a starting point, not the whole solution. Talk to your children about what they do online, who they talk to, and what they share. Make it normal for them to come to you if something feels wrong.
Organisations like Internet Matters (internetmatters.org), the NSPCC (nspcc.org.uk/keeping-children-safe/online-safety/), and the UK Safer Internet Centre (saferinternet.org.uk) all provide age-specific guidance for parents.
Official Resources
- National Cyber Security Centre — UK authority on cyber security
- NCSC Cyber Aware — Six practical actions to stay safe online
- Action Fraud — Report cyber crime and fraud
- Report Phishing — Forward suspicious emails to report@phishing.gov.uk
- Internet Matters — Helping parents keep children safe online
- NSPCC Online Safety — Child safety guidance
- UK Safer Internet Centre — Online safety tips and resources
- Get Safe Online — Practical online safety advice
Password Managers: The Single Biggest Improvement You Can Make
If you do one thing after reading this page, start using a password manager. The idea is simple: instead of remembering dozens of passwords — which inevitably leads to reusing the same weak ones — you remember one strong master password and let the password manager handle the rest. It generates long, random passwords for each site and fills them in automatically.
Built-in options like iCloud Keychain (Apple) and Google Password Manager (Android and Chrome) are free and good enough for most people. For those who want cross-platform access — Windows, Mac, iPhone, Android, all synced — standalone managers like Bitwarden (free for the basic version) or 1Password (paid) are excellent. The key habit is this: whenever you create a new account, let the manager generate the password, and save it immediately. Over a few months, you replace every weak password in your life without having to do it all at once.
Two-Factor Authentication Explained
Two-factor authentication, or 2FA, means you need two things to log in: something you know (your password) and something you have (usually your phone). Even if someone steals your password, they cannot get into your account without also having your phone. For most people, the easiest form of 2FA is a one-time code sent by text message, though security professionals prefer authenticator apps like Google Authenticator or Authy because text messages can theoretically be intercepted.
Turn on 2FA for your email account first. Every other account’s password reset goes through your email, so your email is the keystone. Then do your bank, your social media accounts, and any service that stores payment details. Most platforms now prompt you during login to enable 2FA, but you can also find the option under account settings or security settings on any major service. The two minutes it takes to set up could prevent months of headache if a password ever leaks.
Recognising Phishing Before You Click
Phishing has got harder to spot. Scammers now write in decent English, copy genuine logos, and sometimes reference real transactions or events. The old advice about spelling mistakes and foreign-sender addresses is less reliable than it used to be. Instead, focus on two things that scammers cannot easily fake: the actual web address behind the link, and the urgency of the request.
On a computer, hover over any link before clicking it. The real destination appears in the bottom-left corner of your browser. If the visible text says “barclays.co.uk” but the link points to “barclays-secure-login.xyz,” do not click. If the message creates artificial time pressure — “your account will be suspended in 24 hours” or “a suspicious login was detected, click here to verify” — be suspicious. Legitimate organisations rarely demand immediate action through a single email or text. Phone the company using a number you look up independently, not the one in the message.
Securing Your Social Media Accounts
Social media accounts are valuable to criminals because they let scammers impersonate you to your friends, family, and colleagues. Start by reviewing the privacy settings on each platform you use. On Facebook, limit who can see your posts and personal information to “Friends” rather than “Public.” On Instagram and X, consider switching to a private profile if you mainly use them for personal connections.
Remove old third-party app connections regularly. Over the years, most people accumulate dozens of apps and games connected to their Facebook, Google, or X accounts — quizzes, productivity tools, games you played once in 2016. Each connection is a potential entry point if that app’s security is compromised. On Facebook, go to Settings > Apps and Websites; on Google, visit myaccount.google.com/permissions; on X, go to Settings > Security and account access > Apps and sessions. Delete anything you do not recognise or no longer use.
Official Contacts
UK: National Cyber Security Centre — https://www.ncsc.gov.uk. Action Fraud — 0300 123 2040. Website: https://www.actionfraud.police.uk
India: Cyber Dost (MHA) — https://cybercrime.gov.in. Report phishing to: report.phishing@cert-in.org.in“>report.phishing@cert-in.org.in