Stay safe online — no jargon

Phishing tricks you into handing over passwords or money by pretending to be someone you trust.

• Urgency & fear: "Your account will be closed in 24 hours" pressures you to act fast.
• Check the real address: hover over links and inspect the sender domain — "paypa1.com" is not "paypal.com".
• Generic greetings: "Dear customer" instead of your name is a red flag.
• Unexpected attachments: never open invoices or "documents" you weren't expecting.
• Golden rule: when in doubt, go to the website directly — don't click the email link.

Length beats complexity. A long passphrase is both stronger and easier to remember.

• Use a passphrase of 4+ random words, e.g. correct-horse-battery-staple.
• Never reuse passwords across sites — one breach then unlocks everything.
• Let a password manager (Bitwarden, 1Password, KeePass) do the remembering.
• Check if your email has been in a breach at haveibeenpwned.com.

Attackers manipulate people, not just computers. Common cons include:

• Tech-support scams: "Microsoft" calling about a virus — they will ask for remote access or payment.
• OTP fraud: nobody legitimate ever needs your one-time password. Never share it.
• Job & investment scams: guaranteed returns or upfront fees are red flags.
• Romance & impersonation: verify identities before sending money — always.

• Enable transaction alerts so you spot fraud instantly.
• Use credit cards or UPI with limits for online shopping, not your main account.
• Never bank on public Wi-Fi without a VPN.
• Bookmark your bank's real site; don't search for it each time.

• Set up parental controls and age-appropriate accounts.
• Talk about oversharing — location, school, and personal photos.
• Teach kids that strangers online may not be who they claim.
• Keep devices in shared spaces and review app permissions together.

• Enforce MFA on email, cloud, and admin accounts.
• Train staff to recognise phishing — people are the front line.
• Back up regularly and test that you can restore.
• Keep software patched and limit who has admin rights.
• Have a simple incident plan: who to call, what to do first.