Weekly Security Tips

Be wary of unexpected messages about deliveries, refunds, or prizes. Criminals time these around busy shopping periods.

Forward suspicious emails to report@phishing.gov.uk and suspicious texts to 7726. Your report helps protect others.

No legitimate organisation will ever ask you to pay using gift cards, cryptocurrency, or by transferring money to a "safe account".

If someone calls claiming to be your bank, hang up and call back using the number on your card or statement.

Before clicking a link, hover over it to see the real URL. Does it match the sender's organisation?

If an email creates urgency or panic, that's a red flag. Legitimate organisations give you time to respond.

If a service offers passkeys (biometric login), enable them. They're phishing-resistant and easier than passwords.

Set up a recovery method (phone number or backup email) on your most important accounts in case you get locked out.

Review your saved passwords this week. Remove any for accounts you no longer use.

Use three random words as a passphrase instead of complex character substitutions. "PurpleBananaRocket" is stronger and easier to remember.

Check if your email has appeared in a data breach at haveibeenpwned.com, and change those passwords immediately.

Never reuse your email password on any other site. Your email is the master key to all your other accounts.

Use a password manager to generate and store unique passwords for every account.

Enable two-factor authentication on your most important accounts, email, banking, and cloud storage.

If staff use personal devices for work, set minimum requirements: screen lock, automatic updates, and no shared family accounts.

Check that your insurance policy covers ransomware, business email compromise, and data breach notification costs.

Document your incident response plan, even a one-page checklist of who to call and what to do helps enormously under pressure.

Review who has admin access to your systems. The fewer people with elevated privileges, the smaller your attack surface.

Test your backups this week. Can you actually restore a file from last week's backup? Many businesses discover the answer too late.

Run a 5-minute team huddle about a recent scam in the news. Real examples stick better than generic training.

When a team member leaves, disable their accounts the same day. Lingering access is a common and preventable risk.

Create a simple process for verifying payment changes: always confirm new bank details by phone using a known number.

Ensure your home router firmware is up to date. Most routers have an admin page where you can check for updates.

Check your browser extensions this week. Remove any you don't recognise or no longer use.

Avoid public WiFi for banking or shopping. If you must use it, a VPN adds a layer of protection.

Check that Find My Device is enabled on your phone. It lets you locate, lock, or wipe your device if it's lost or stolen.

Review the apps on your phone. Delete any you no longer use, unused apps can still access your data.

Back up your phone photos and important files this week. If something goes wrong, you'll be glad you did.

Set your phone to lock automatically after 1-2 minutes. It's a small habit that prevents big problems if your device is lost.

Turn on automatic updates for your phone and computer. Security patches fix vulnerabilities before criminals can exploit them.

AI can now clone voices convincingly. If a family member calls asking for money urgently, verify by calling them back on their usual number.

Romance criminals build trust over weeks before asking for money. If an online contact asks for financial help, talk to someone you trust first.

Be wary of unexpected messages about deliveries, refunds, or prizes. Criminals time these around busy shopping periods.

Forward suspicious emails to report@phishing.gov.uk and suspicious texts to 7726. Your report helps protect others.

No legitimate organisation will ever ask you to pay using gift cards, cryptocurrency, or by transferring money to a "safe account".

If someone calls claiming to be your bank, hang up and call back using the number on your card or statement.

Before clicking a link, hover over it to see the real URL. Does it match the sender's organisation?

If an email creates urgency or panic, that's a red flag. Legitimate organisations give you time to respond.

If a service offers passkeys (biometric login), enable them. They're phishing-resistant and easier than passwords.

Set up a recovery method (phone number or backup email) on your most important accounts in case you get locked out.

Review your saved passwords this week. Remove any for accounts you no longer use.

Use three random words as a passphrase instead of complex character substitutions. "PurpleBananaRocket" is stronger and easier to remember.

Check if your email has appeared in a data breach at haveibeenpwned.com, and change those passwords immediately.

Never reuse your email password on any other site. Your email is the master key to all your other accounts.

Use a password manager to generate and store unique passwords for every account.

Enable two-factor authentication on your most important accounts, email, banking, and cloud storage.

If staff use personal devices for work, set minimum requirements: screen lock, automatic updates, and no shared family accounts.

Check that your insurance policy covers ransomware, business email compromise, and data breach notification costs.

Document your incident response plan, even a one-page checklist of who to call and what to do helps enormously under pressure.

Review who has admin access to your systems. The fewer people with elevated privileges, the smaller your attack surface.

Test your backups this week. Can you actually restore a file from last week's backup? Many businesses discover the answer too late.

Run a 5-minute team huddle about a recent scam in the news. Real examples stick better than generic training.