Learn Privacy and Security Tips for Online Safety

Understanding Digital Threats and How They Work

Online security threats have become increasingly common as more of our personal and financial information moves to the internet. According to the FBI's Internet Crime Complaint Center, there were over 880,000 complaints about internet crime in 2023, with losses exceeding $14 billion. Understanding what these threats are helps you recognize them before they cause harm.

Malware is software designed to damage or disrupt your device. It includes viruses that spread like biological viruses, worms that copy themselves and consume system resources, and trojans that disguise themselves as legitimate programs. Ransomware is a particularly serious type of malware that encrypts your files and demands payment to unlock them. In 2023, ransomware attacks affected organizations across healthcare, government, and business sectors, with some demanding millions of dollars.

Phishing attacks trick you into revealing sensitive information by impersonating trusted sources. A phishing email might look like it comes from your bank or a popular website, asking you to "verify your account" by clicking a link and entering passwords. Spear phishing targets specific individuals with personalized information, making the deception more convincing. According to research from Statista, phishing remains one of the most common cybersecurity threats, with attackers sending billions of phishing emails annually.

Man-in-the-middle attacks occur when someone intercepts communication between you and a website or service. This often happens on unsecured public Wi-Fi networks where attackers can see your data transmitted between your device and the network. Social engineering attacks manipulate people into breaking security procedures by exploiting trust, urgency, or fear rather than technical vulnerabilities.

Practical Takeaway: Threat recognition is your first line of defense. Before clicking links or downloading files, pause and verify the sender's identity through an independent channel—call the organization directly using a phone number you find yourself, or visit their official website rather than following a provided link.

Creating Strong Passwords and Managing Them Securely

Weak passwords remain a leading cause of data breaches. The most commonly used passwords include "123456," "password," and "qwerty"—all of which can be cracked in seconds by automated tools. A strong password is your first barrier against unauthorized access to your accounts, and different passwords for different accounts prevent a breach at one site from compromising all your accounts.

A strong password contains at least 12 characters and includes uppercase letters, lowercase letters, numbers, and special characters like ! @ # $ % ^ & *. For example, "BlueMoon$42!Ocean" is significantly stronger than "bluemoon42" because it mixes character types. The longer your password, the exponentially harder it becomes to crack. According to cybersecurity research, a 12-character password with mixed character types would take a computer billions of years to crack through brute force.

Password managers like Bitwarden, 1Password, Dashlane, and LastPass store your passwords in an encrypted vault, allowing you to use unique, complex passwords for every account while only needing to remember one master password. This approach eliminates the temptation to reuse passwords or write them down on sticky notes. When you log into a website, the password manager automatically fills in your credentials, reducing the chance of entering your password on a fake website designed to steal it.

Two-factor authentication (2FA) adds a second layer of security beyond your password. After entering your password, you must provide a second form of verification: a code sent via text message, an email link, a code generated by an app like Google Authenticator or Authy, or biometric data like your fingerprint. Even if someone steals your password, they cannot access your account without this second factor. Financial institutions, email providers, and social media platforms increasingly offer 2FA options.

When creating security questions for account recovery, avoid answers that are easily researched through social media. If a site asks "What is your mother's maiden name?" and that information appears in your family's online genealogy, an attacker could use it to reset your password. Instead, use unrelated answers that only you would know.

Practical Takeaway: Start this week by enabling two-factor authentication on your most important accounts—email, banking, and social media. These accounts are keys to accessing your other accounts. Then consider using a password manager for new accounts and updating passwords you've used elsewhere.

Protecting Your Personal Information Online

Personal information is valuable to attackers because it can be used for identity theft, fraud, and blackmail. The Federal Trade Commission reports that identity theft affected approximately 8.7 million Americans in 2023. The types of information that matter include your Social Security number, financial account numbers, driver's license number, home address, phone number, and email address. Attackers combine these pieces to open credit accounts in your name or drain existing accounts.

Limiting what you share online is one of the most effective protections. Social media platforms make sharing convenient, but they retain vast amounts of personal data, and privacy settings often default to sharing more rather than less. Before posting, consider whether that information could be used against you. Criminals use details like your pet's name, hometown, school attended, or family members' names to reset passwords using common security questions. Your birth date, when shared with your graduation year and hometown, can reveal your age and help someone impersonate you.

Be cautious with public Wi-Fi networks at coffee shops, libraries, and airports. These networks often lack encryption, meaning anyone on the network can see data you transmit—including passwords and credit card numbers. If you must use public Wi-Fi, avoid logging into financial accounts, entering credit card information, or accessing sensitive work information. A virtual private network (VPN) like ProtonVPN, NordVPN, or Mullvad encrypts all your internet traffic, protecting your data even on unsecured networks. However, choose a reputable VPN provider, as the VPN operator can see your traffic if it's not properly encrypted.

Data brokers purchase and sell information about individuals to marketers, credit companies, and others. You can check what information brokers have collected about you and request removals through services like Spokeo, BeenVerified, and Whitepages. The California Consumer Privacy Act and similar laws in other states give you the right to request that companies disclose and delete your personal information.

When discarding old devices, simply deleting files is insufficient—deleted files can often be recovered. Use secure deletion tools that overwrite data multiple times before disposal. For devices with sensitive information, physical destruction may be appropriate. Shred documents containing personal information before throwing them away.

Practical Takeaway: Review privacy settings on your social media accounts this week, limiting visibility of personal details to friends only. Then search for your name online to see what information is publicly available, and consider requesting removal from data broker websites.

Recognizing and Avoiding Scams and Fraud

Scams cost Americans billions of dollars annually. According to the Federal Trade Commission, consumers reported losing over $10 billion to fraud in 2023, with romance scams, imposter scams, and online shopping fraud leading the losses. Understanding how scams work helps you spot warning signs before losing money.

Romance scams build emotional connections with victims over weeks or months before requesting money for emergencies, travel, or investments. The scammer may claim to be stranded abroad and needing money for a ticket home, or needing funds for a business opportunity they promise to share profits from. Red flags include refusal to video call, requests for money transfer via wire or gift cards, and inconsistencies in their story. Legitimate romantic relationships develop naturally and do not involve requests for money to people you've never met in person.

Tech support scams often begin with pop-up warnings claiming your device is infected or has security problems. Clicking the warning leads to a fake tech support site or calls a number where scammers pretend to be from Microsoft, Apple, or your internet provider. They gain remote access to your computer and steal login credentials or install malware. Legitimate companies do not contact you through pop-ups to warn about security problems. If you're concerned about your device's security, open your browser fresh and visit the official website of the company in question.

Prize and lottery scams claim you've won something you never entered, requesting personal information or money to claim your prize. Legitimate lotteries do not require winners to pay taxes or fees upfront—these are deducted from your prize. Government agencies never contact citizens to claim benefits through unsolicited calls or emails.