I was recently asked for some general cyber security advice from a friend looking to help her family and friends during these uncertain times online. In fact, what she actually said was “do you have any good resources/guides you’d recommend on hardening one’s personal security? With what is going on in the world, I want to give me family members something to follow.”

The problems with most advice however is that it has an expiry date. 2-factor authentication was a huge step forward in the securing of personal and work account, but that was 10 years ago. It is still relevant, but there are also many workarounds and deceptive techniques widely employed by criminals that make it a lot less secure now. In fact, whilst most cybersecurity advice sounds straightforward (use strong passwords, switch on multi-factor authentication, keep your devices updated, don’t click suspicious links, etc.), it’s all very specific and frankly a little nerdy.

That is not say that it isn’t sensible advice though, but it can leave you with a rather important question: how do you know what action, message, activity or whatnot looks, and is, suspicious?

A convincing scam might arrive when you are expecting a delivery, worrying about a bill, or waiting to hear from your bank. It doesn’t need to fool you forever, it only needs to catch you at a moment when you are distracted, tired or willing to take something at face value.

Staying safe online therefore involves more than learning a few rules. It means changing how you respond to the things that appear on your screen.

Urgency

The first change is to stop treating urgency as a reason to act.

“Your account will be closed.” “This payment needs approving.” “I need your help right now.” These messages encourage you to make a decision before you have had time to think. Get into the habit of doing the opposite: when a request creates pressure, slow down.

You do not have to establish whether a message is fraudulent before deciding to check it. Open your banking app yourself. Visit the company through a saved bookmark. Call the person using a number you already have. A request can be plausible and still deserve verification.

That also means becoming comfortable with being slightly awkward.

If someone claiming to be from your bank calls, you can end the call and contact the bank yourself. If a relative messages from a new number asking for money, call their usual number. If a colleague sends an unexpected document requiring you to sign in, check with them through another channel.

You are allowed to interrupt the flow of a conversation. You are allowed to say, “I’ll check and get back to you.” You do not owe a stranger immediate cooperation because they sound helpful, authoritative or impatient.

Attraction

The next change is to think less about whether you are an interesting or attractive target.

“I’ve got nothing worth stealing” is a comforting thought, but consider what losing access to your email would mean. What could someone reset? Who could they contact while pretending to be you? Which documents, photographs and conversations could they see?

Your email account deserves particular attention because it can provide a route into other accounts. Give it a unique password and enable multi-factor authentication. Use a password manager to make unique passwords manageable elsewhere, too. These are among the National Cyber Security Centre’s core recommendations.

Think about the consequences of losing access, rather than how valuable you imagine yourself to be.

Routine

It also helps to stop making security depend on remembering to be careful all the time. Nobody maintains perfect concentration. Build habits and settings that carry some of the cognitive load. Enable automatic updates. Let a password manager generate and save passwords. Put a screen lock on your phone. Make backing up important files something that happens automatically.

The NCSC recommends keeping software updated because updates include security fixes. Treat that maintenance as an ordinary part of owning a device, like charging it, rather than an interruption you can postpone indefinitely. (More NCSC guidance )

Apply the same thinking to what you install and share.

Before downloading an app, adding a browser extension or granting access to your contacts, pause long enough to consider whether you need it. Does this service need your date of birth? Does that app need your location all the time? Are you keeping an account you stopped using years ago?

You do not need to become secretive about everything. Simply get used to treating access to your information as something you choose to give.

Failure

Another useful change is to prepare for mistakes.

Could you get back into your accounts if your phone disappeared tomorrow? Do you know where your recovery codes are? Is your recovery email address still accessible? Could you recover the photographs and documents you care about?

Keep backups and occasionally check that you can restore something from them. For an external backup drive, disconnect it when it is not in use. The NCSC’s backup guidance explains why a separate, recoverable copy matters.

Whoops!

Finally, take embarrassment out of the response.

If you think you have been caught, tell someone and act promptly. Contact your bank through a trusted route if money is involved. Secure the affected account. Ask for help if you are unsure what happened.

Make it easy for your friends and family to do the same. A friend group or household where someone can say “I think I’ve made a mistake” without being ridiculed is better prepared to deal with one.

In summary, you don’t need to distrust everything or become a technical expert. You just need a few dependable habits that still work when you are busy, worried or distracted.

• Slow down when you feel rushed. Pressure is a reason to check before acting.
• Check through a route you trust. Open the app yourself or call a number you already know.
• Make protection routine. Use unique passwords, multi-factor authentication and automatic updates.
• Prepare to lose access. Keep recovery details safe and maintain backups you can restore.
• Speak up quickly if something goes wrong. Getting help matters more than avoiding embarrassment.