Cybercrime and Online Safety: How to Protect Yourself
More of our everyday lives now take place online, from banking and shopping to work and keeping in touch with family. This convenience also creates opportunities for cybercriminals. Knowing how common online threats work—and taking a few sensible precautions—can help protect your money, personal information and devices.
What is cybercrime?
Cybercrime is criminal activity involving computers, phones, networks or the internet. It can include stealing personal information, breaking into accounts, spreading malicious software or tricking people into sending money. Some attacks target organisations, while others are designed to deceive individuals.
Common online threats
- Phishing: Fraudulent emails, texts, calls or messages that pretend to come from a trusted organisation. They may try to get you to reveal passwords or payment details, or to open a harmful link or attachment.
- Malware: Harmful software that can steal information, damage files or give someone unauthorised access to a device. Ransomware is a type of malware that can lock files and demand payment to restore access.
- Account takeover: Criminals use stolen or guessed passwords to access email, social media, shopping or banking accounts.
- Online shopping and investment scams: Fake shops, adverts or investment opportunities can take your money or personal details without providing what was promised.
- Identity theft: Personal information is used without permission, for example to apply for credit or impersonate you.
Practical ways to stay safer
Use strong, unique passwords
Use a different password for each important account. A password manager can help you create and store strong passwords. Where available, turn on multi-factor authentication (MFA), which adds an extra step—such as an approval prompt or security code—when you sign in.
Pause before clicking
Be cautious with unexpected messages, even if they appear to come from a familiar company or person. Check the sender and website address carefully. Avoid using links in messages to sign in or make payments; instead, open the organisation’s official app or type its web address into your browser. If a request seems urgent or unusual, verify it using contact details you find independently.
Keep devices and software updated
Install updates for your operating system, browser, apps and security software. Updates often fix weaknesses that criminals could exploit. Enable automatic updates where practical, and only download software from trusted sources.
Secure your home Wi-Fi
Change the router’s default administrator password, use a strong Wi-Fi password and install router updates when available. Avoid entering sensitive information over public Wi-Fi unless you are confident the connection is legitimate; using mobile data can be a safer option.
Protect personal information
Think carefully before sharing personal details online. Information such as your address, date of birth or answers to security questions can help criminals impersonate you. Review privacy settings on social media and be wary of quizzes or posts that ask for personal information.
Back up important files
Keep copies of important photos and documents on a separate device or a reputable cloud service. A backup can help you recover files if a device is lost, damaged or affected by ransomware. Check occasionally that you can access your backups.
What to do if you think you have been targeted
- Stop communicating with the suspected criminal. Do not click further links, open attachments or send money.
- Contact your bank promptly if you have shared payment details or made a transfer. Use the number on your bank card or its official website.
- Change affected passwords from a device you believe is safe. Change any other accounts using the same password and enable MFA.
- Secure your device. Run a scan with reputable security software, remove suspicious apps and install available updates. If you believe a work device or account is involved, tell your organisation’s IT or security team.
- Keep evidence such as messages, email addresses, website links and payment records. Do not forward suspicious messages to friends or colleagues.
- Report the incident. In England, Wales and Northern Ireland, use the official Report Fraud service or contact the police. In Scotland, contact Police Scotland. Report suspicious emails to [email protected] and suspicious text messages by forwarding them to 7726. If someone is in immediate danger, call 999.
Stay alert, not alarmed
No single measure can prevent every cybercrime, but a few consistent habits can make a real difference. Use unique passwords and MFA, keep software updated, check unexpected requests independently and act quickly if something seems wrong. These steps help make the internet safer for you and the people around you.
8 Essential Tips for Protecting Yourself Against Cyber Crime
- Use strong, unique passwords for every account.
- Turn on two-factor authentication.
- Never share passwords or security codes.
- Check links before clicking them.
- Ignore unexpected requests for money or personal details.
- Keep your devices and apps updated.
- Use secure Wi-Fi for sensitive tasks.
- Report suspicious messages to the relevant service.
Use strong, unique passwords for every account.
Use a strong, unique password for every online account to make it harder for criminals to gain access. If one password is exposed in a data breach, using different passwords helps prevent other accounts from being compromised too. A password manager can create and securely store complex passwords, so you don’t have to remember them all. Where available, switch on multi-factor authentication for an extra layer of protection.
Turn on two-factor authentication.
Turn on two-factor authentication (2FA) wherever it’s available to add an extra layer of protection to your online accounts. As well as your password, you’ll need to confirm your identity using a second method, such as an authenticator app, security key or sign-in prompt. This can make it much harder for cybercriminals to access your account, even if they manage to obtain your password.
Never share passwords or security codes.
Never share your passwords or security codes with anyone, even if they claim to be from your bank, a well-known company or a technical support team. Genuine organisations will not ask you to tell them a one-time passcode or password. Criminals may use these details to access your accounts or steal your money. If a message or call asks for a code, do not reply; contact the organisation using its official website or phone number instead.
Check links before clicking them.
Before clicking a link, take a moment to check where it leads. Hover over it on a computer, or press and hold it on a mobile device, to preview the web address. Look out for misspellings, unexpected domains or addresses that do not match the organisation named in the message. If a link arrives unexpectedly or urges you to act quickly, don’t use it to sign in or make a payment; visit the organisation’s official website or app instead.
Ignore unexpected requests for money or personal details.
Ignore unexpected requests for money or personal details, even if they appear to come from someone you know or a trusted organisation. Scammers may create a sense of urgency to pressure you into acting quickly. Pause, check the request through a separate, trusted channel—such as calling a known number—and never share passwords, security codes or banking details in response to an unsolicited message or call.
Keep your devices and apps updated.
Keep your devices and apps updated to help protect them from cybercrime. Updates often fix security weaknesses that criminals could exploit, as well as improving performance and reliability. Turn on automatic updates where possible, and download updates only through your device’s settings or the app’s official store.
Use secure Wi-Fi for sensitive tasks.
Use a secure Wi-Fi connection when carrying out sensitive tasks such as online banking, shopping or accessing work accounts. Public networks in cafés, hotels and airports may not be properly protected, so avoid entering passwords or payment details unless you can verify the connection is legitimate. When in doubt, switch to mobile data or use a trusted virtual private network (VPN), and make sure the websites you use begin with “https”.
Report suspicious messages to the relevant service.
If you receive a suspicious email or text, report it using the relevant service rather than replying, clicking links or forwarding it to others. In the UK, you can forward suspicious texts to 7726 and report phishing emails to [email protected]; for messages on social media or other platforms, use the service’s built-in reporting tools. Reporting helps providers investigate scams and may help protect other people too.