You do not need to understand computers to stay safe online. You need about seven habits. This guide explains the ideas in plain English first, then gives you the habits, then tells you what to do if something goes wrong. If you are the person in your family who "knows computers," send this to the people who do not.
The short version
If you read nothing else, read this.
| Do this | Why |
|---|---|
| Install updates when your phone or computer offers them | Updates fix weak spots criminals already know about |
| Turn on two-step login for your email and bank | Stops someone who has your password |
| Use a password manager, and a different password for every site | One stolen password cannot open everything |
| Never share a code or password with anyone who contacts you | Real companies never ask for them |
| Do not click links in unexpected messages | Most scams start with a message |
| Call the number on your card, not the one in the message | Scammers fake the number they give you |
| Keep an eye on your accounts | Catching trouble early limits the damage |
What is a "hack," really?
A hack is when someone gets into something they are not allowed to use. A phone, a computer, an email account, a bank account, a company's website.
There are two main ways it happens.
1. Breaking a weak spot (a "bug"). All software is written by people, and people make mistakes. A mistake in the code can leave a gap, like a window that does not latch. Experts, and criminals, hunt for these gaps. When one is found, the maker releases a fix. This kind of hack usually targets companies and websites, not you personally.
2. Tricking a person. This one is far more common for everyday people. A criminal pretends to be your bank, a delivery company, your boss or a relative, and convinces you to hand over a password, a code or money. Nothing is "broken." You are simply fooled.
The important point: most harm to normal people comes from number 2. That is good news, because tricks can be recognized.
A building analogy
Imagine the internet as a huge city.
- Websites and apps are buildings.
- Software is the locks and walls of each building.
- A bug is a faulty lock that a criminal can open.
- An update is the locksmith's replacement lock.
- Your password is your own key.
- Two-step login is a second lock that needs a code only you can get.
- A scam is someone knocking and saying "I am from the gas company, let me in."
When you hear that "millions of websites have a weak lock," it means the building owners need to install the new lock. For your own devices, the new lock is the update you install yourself.
Why updates matter so much
Internet safety for beginners and software updates: a cracked gear repaired with a green patch
An update often looks boring: "Version 17.2 available." But many updates exist because someone found a weak spot. After the maker announces the fix, criminals read the announcement too. They know exactly what the old version did wrong, and they go looking for people who have not updated.
That is why the habit is simple: install updates soon. You do not need to understand what each one does.
A few rules keep updating safe:
- Use the device's own settings. On a phone or computer, open Settings and look for Software Update. On a browser, look for "About" in the menu.
- Never install an "update" from a pop-up, an email or a text. A message that says "your system is out of date, click here" is a classic scam. Real updates come from Settings.
- Update the router too. The small box that gives you Wi-Fi is a computer. Most have an update option in their app or setup page. If yours is very old and no longer gets updates, it may be time to replace it.
- Turn on automatic updates if your device offers it. Then you do not have to remember.
Passwords, in plain English
Your password is the key to your account. Three rules matter more than any "clever" password trick.
- A different password for every site. When a company gets hacked, criminals try the stolen passwords on other sites. If you reuse one everywhere, one leak opens everything.
- Long beats clever. A long password made of several random words is stronger and easier to remember than a short one full of symbols.
- Let a password manager do the remembering. A password manager is an app that creates and stores a unique password for every site, and you only remember one master password. Many phones and browsers already have one built in. Using it is far safer than writing passwords on sticky notes or reusing your favorite.
Two-step login: the single best upgrade
Protect yourself online with two-step login: a key carrying a fingerprint swirl
Two-step login, also called two-factor or multi-factor authentication, means that after your password, the site asks for a second thing, like a code from an app, a text message or a prompt on your phone.
Why it works: a criminal who steals your password still cannot log in, because they do not have your phone.
Turn it on in this order:
- Your email. It is the master key. If someone controls your email, they can reset the password to almost everything else.
- Your bank and any payment apps.
- Your phone's main account (Apple, Google or similar).
- Social media and shopping accounts.
An app that makes codes, or a security key, is stronger than text messages, but any second step is much better than none.
How scams work: the five tricks
Internet safety scams explained: a fishing hook dangling a blank envelope as phishing bait
Almost every scam uses the same tricks. Learn these and you can spot most of them.
| Trick | What it sounds like |
|---|---|
| Urgency | "Your account will be closed in one hour" |
| Fear | "There is suspicious activity on your bank account" |
| Authority | "This is the tax office, the police or your bank's fraud team" |
| A prize or a bargain | "You have won," or "pay less than anywhere else" |
| Secrecy | "Do not tell anyone, even your bank" |
Scammers want you to act before you think. So the best defense is to slow down.
The golden rules
- A real company will never ask for your password. Never. Not on a call, text or email.
- A real company will never ask for a code that was just sent to your phone. Those codes are for you to type into the company's own app or site, never to read out to a person.
- Do not click links in unexpected messages. If you think the message might be real, open the official app or type the website address yourself.
- Do not call back the number they gave you. Hang up and call the number on the back of your card or on the official website.
- Be extra careful with requests for gift cards, wire transfers or cryptocurrency. Those are hard to undo and scammers love them.
- Trust your discomfort. If it feels off, it probably is.
Phishing, smishing, vishing
These are just fancy names for the same trick through different channels.
- Phishing is a fake email.
- Smishing is a fake text message.
- Vishing is a fake phone call.
Today scammers can also copy a voice or write very convincing messages with AI. That is another reason to follow the rule "verify it yourself through a number or site you already trust," even if the voice sounds exactly like someone you know. A simple family trick is to agree on a secret "safe word" that only your family knows, so you can check that a panicked call from a relative is real.
Wi-Fi and public places
- Public Wi-Fi in cafes and airports can be watched or faked. For anything sensitive such as banking, use your phone's mobile data instead, or wait until you are home.
- Do not plug your phone into unknown charging ports when you can avoid it. Use your own charger and cable.
- Turn off Bluetooth and Wi-Fi when you are not using them, if you want to be extra careful. It is not essential, but it does little harm.
If you use AI tools: protect your AI accounts too
Many people now use AI apps and, if you build things, "API keys," the secret codes that let an app use an AI service. These have become a favorite target, and the lesson is the same as for your bank card.
An AI key is like a credit card for AI. Whoever holds the key can run AI, and the bill goes to the owner. Criminals steal keys and use them to run huge amounts of AI work at your expense. Some use stolen keys to power automated hacking tools, which then find more weak spots and steal more keys, so one stolen key can feed the next attack. That is why people have reported big bills appearing within minutes.
What to do:
- Set a spending limit on every AI account or key, and turn on usage alerts. This is the single best protection.
- Never paste a key into a chat, a screenshot, a public repository or a message. Treat it like a card number.
- Use a separate key for each app, so you can switch one off without breaking everything.
- Change your keys if a service you use says it was breached. Do not wait to see if you were affected.
- Check your usage page now and then. A sudden jump you cannot explain is a warning sign.
- Do not buy "cheap AI access" from strangers. It is often built on stolen accounts, and using it can get you into trouble.
Using someone else's key or account without permission is not a prank or a loophole. It is a crime in most places, usually some form of unauthorized access or fraud. We explain the developer side, including what is known about reported cases, in our post on the internet under attack and our guide to the Railway and OpenRouter key theft.
Smart gadgets and old apps
Every connected thing, such as cameras, doorbells, smart speakers and old apps, is another door into your home network.
- Delete apps you no longer use.
- Unplug gadgets you do not need.
- Change the default password on cameras and routers if they came with one.
- Download apps only from the official store of your phone.
Protecting money
- Check your bank account regularly, even if just a quick look each week. Catching a strange charge early makes it much easier to fix.
- Turn on alerts for card transactions, if your bank offers it.
- Know what protects you. Rules differ by country. In many places, if you report unauthorized transfers quickly, your loss is limited. In the US, deposits at insured banks are protected up to a set amount per person per bank if the bank itself fails. But money you are tricked into sending yourself is much harder to recover, which is why scam calls are the bigger danger.
- Do not panic and withdraw all your money because of a news story. Scammers count on panic.
What to do if something goes wrong
Take a breath. Acting calmly and quickly matters more than anything.
- Stop. Do not send any more money or information.
- Change your email password first, ideally from a different, clean device, then your bank and other important accounts.
- Turn on two-step login for each account you can.
- Call your bank right away using the number on your card if money or card details might be involved.
- Update your devices and run a security scan using a trusted app.
- Tell someone. Embarrassment is what scammers rely on. Many smart people are fooled.
- Report it to your local consumer protection or cybercrime agency, and to the platform where it happened.
A one-page checklist to send to family
Copy this into a message:
Stay safe online: 7 things
- Update your phone, computer, browser and Wi-Fi router when asked. Only from Settings, never from a pop-up.
- Turn on two-step login for your email and bank.
- Use a password manager. A different password for every site.
- Never tell anyone a password or a code, even if they say they are from your bank.
- Do not click links in unexpected messages.
- If someone calls about your money, hang up and call the number on the back of your card.
- If something feels wrong, stop and ask a family member.
Common questions
Do I need antivirus software? Many modern phones and computers have built-in protection. Keep your device updated and be careful what you install. A reputable security app can add another layer, but habits matter more than software.
Is it safe to shop online? Yes, if you stick to well-known stores, use a card or a payment service with buyer protection, and avoid typing card details into sites you do not know.
Are QR codes safe? A QR code is just a link. Treat it like any link: be careful with codes on stickers, parking meters and unexpected messages, since scammers sometimes place fake ones over real ones.
Is AI making scams worse? It can make them more convincing, with better writing and cloned voices. The defense does not change: never share codes, verify through a number you trust, and slow down.
Where to read more
When news breaks about a big weakness in software, the advice is almost always the same: update, use two-step login, and be careful with messages. For a current example with more technical detail, see our piece on the internet under attack and what to do. Developers and website owners can follow the PHP2Shell explainer and the eMudhra update checklist. To understand how AI is changing scams, see our post on the AI scam economy claim check and the deepfake video call fraud case.
Related reading
- The internet is under attack: what is happening and what to do (more technical)
- PHP2Shell: what happened and what to do now
- The eMudhra checklist: update everything
- The AI scam economy: claim check
- Deepfake video call fraud
- How to check a Mac for a cryptominer
This is general information, not personal security or legal advice. Rules and protections differ by country and bank, so check your own bank's guidance.