Internet Safety Tips That Work When a Scam Looks Convincing
A scam does not need bad spelling or an implausible story. A delivery message can arrive on a day when you really are expecting a parcel. A fake store can use professional photographs, customer reviews and an encrypted checkout. A caller can know your name without being entitled to your account.
The most useful internet-safety habits still work when the request looks convincing. Instead of relying on spotting every visual clue, create an independent way to verify important actions and make accounts harder to take over. This guide follows the moments when people actually make decisions: signing in, opening a message, buying something, installing software and responding when a mistake has already happened.
Before you browse: secure the accounts that control the rest
Use unique credentials for important services, particularly your main email, password manager and financial accounts. A password manager can reduce the need to memorize or reuse passwords. Protect the manager’s own recovery route and keep access information available if your usual phone is lost.
Use supported passkeys or suitable multifactor authentication where available. Do not assume all additional sign-in methods offer identical protection, and do not approve an unexpected request simply because the screen uses a familiar logo. The FBI’s consumer guidance identifies stronger account access, updates and independent verification as useful everyday measures.
Make recovery practical. An excellent password is less helpful if an obsolete phone number controls reset messages or every recovery code is stored only on the device you are trying to recover. Review those arrangements whenever you replace a phone or change provider.
When a message asks you to act, leave the message
An effective general rule is to verify important requests somewhere other than the message that delivered them. Open the bank’s known app, use a saved legitimate bookmark or call a number already on your statement. That avoids making the entire decision depend on whether a displayed sender name or link looks right.
The FTC’s phishing guide explains how messages use account problems, invoices and familiar organizations to solicit information. Your goal is not to memorize every possible scam story; it is to avoid letting an unsolicited story determine where you sign in or whom you call.
| Request | Independent check | A reason to stop |
|---|---|---|
| Your bank account needs urgent verification | Open the established banking app or call the known provider number | Someone asks you to transfer money or disclose a one-time code |
| A parcel needs a new delivery payment | Check the actual order and carrier account | The message asks for unrelated identity or payment information |
| A friend needs money immediately | Contact them through an already known route | They refuse another form of verification |
| A software update is required | Use the device’s settings or the product’s official updater | A webpage asks you to run commands or install a remote-control tool |
These checks should be brief and repeatable. You do not need to determine who created a suspicious message before deciding not to follow its instructions.
What HTTPS proves, and what it does not
An encrypted connection helps protect information while it travels to the website. It does not prove the website’s operator is honest. A fraudulent store can use HTTPS and still keep your payment without delivering anything.
The FTC’s public-Wi-Fi guidance makes this distinction explicitly. Modern encryption changes the risks of ordinary public-network use, but it cannot turn a scam destination into a trustworthy business. Check the destination and the transaction, not merely the lock icon.
Do not dismiss browser certificate or security warnings to complete a purchase. If a legitimate service appears broken, contact it independently. A discount is not a good reason to enter sensitive information through a connection your browser is warning you about.
Before buying from an unfamiliar shop
Check the actual business identity, contact information, delivery and returns terms. Look for independent evidence that the seller exists and fulfills orders. Search the business name with complaint-related terms, but read the results critically rather than treating a single review score as proof.
A marketplace account and the marketplace itself are not the same seller. A trusted platform can contain a fraudulent listing, and a transaction moved outside the platform may have different protections. Keep the conversation and payment within the authorized process where that is part of the service’s protection.
The NCSC’s shopping guidance recommends checking unfamiliar sellers and payment arrangements. Its advice supports a simple test: would you still be comfortable buying if the countdown timer and dramatic discount disappeared? If not, pause rather than letting the page’s urgency decide for you.
Choose payment methods for the actual protections available
Compare the dispute and fraud processes offered by your provider and applicable jurisdiction. A familiar payment logo does not guarantee reimbursement in every circumstance. Know whether you are paying for a purchase, sending money to a person or authorizing a recurring payment.
Do not use a friends-and-family transfer just because an unknown seller says it avoids fees. Be particularly cautious when someone demands gift cards, cryptocurrency or another difficult-to-reverse method for an ordinary retail transaction. The Australian Cyber Security Centre’s online-activity guidance specifically flags inappropriate friends-and-family payment requests.
Save the order confirmation, description, expected delivery date and seller correspondence. If something goes wrong, those records help you explain the transaction without reconstructing a vanished listing. Do not send a seller unnecessary identity documents to resolve a simple delivery inquiry.
A QR code can open a useful official service or send you to an unrelated page. Check the destination displayed by your device before continuing, particularly on an unfamiliar sticker or a code placed over another label. Where possible, use the known app or type the legitimate service address yourself.
The FTC’s parking-code alert describes how substituted codes can lead to fake payment sites. The relevant habit applies beyond parking: the location of a sticker does not establish who controls the website behind it.
After following a code, assess the requested action. A menu should not ordinarily need access to your contacts, and a routine payment should not require you to install a device-management profile. Stop when the permissions or information requested do not match the task.
Fake CAPTCHA and update instructions
A normal human-verification prompt should not require copying a command into a system utility, opening a terminal or disabling security software. A webpage that asks for those actions is crossing from a browser task into control of your device.
The FTC’s fake-CAPTCHA warning describes this form of social engineering. Do not experiment with the supplied command to see what happens. Close the page and use official support if you are unsure whether a service is functioning.
Apply updates through the operating system, browser or product’s established updater. An alarming browser page claiming to have scanned your whole computer is not the same as a notification from your installed security software. Verify the source before granting access or installing anything.
Download software from an accountable source
Use the publisher’s official site or a reputable platform’s legitimate listing, and check the developer identity. Search advertisements and sponsored download buttons can lead to a different product than the one you intended to install.
Read permission requests in relation to the task. A simple utility that asks for broad accessibility control, remote access or device administration deserves scrutiny. On a work device, use the employer’s approved installation process rather than bypassing it to finish a job quickly.
Keep supported software updated and remove tools you no longer need through the proper process. A collection of forgotten browser extensions can retain permissions long after the original reason for installing them has gone.
Public Wi-Fi: avoid both complacency and outdated panic
Confirm the network name with the venue rather than choosing a plausible-looking hotspot automatically. Keep the device and browser supported, do not ignore certificate warnings and use the organization’s required work connection when handling business data.
A VPN can be useful for a defined purpose, but it does not protect you from entering credentials into a fake shop or approving a fraudulent transfer. It changes part of the connection path, not the trustworthiness of everything you do online.
For your own router, see our home Wi-Fi security guide. Network protection and account protection should reinforce each other instead of being treated as rival products.
Think about what you are sharing
A photograph, public profile and old document can collectively reveal more than any one item. Review who can see location information, travel plans, contact details and identity documents. Share what serves the purpose rather than filling every optional form field.
For cloud files, distinguish a link anyone can open from an invitation restricted to named recipients. Check permissions after copying folders or sharing a document outside the household. A difficult-to-guess link is not equivalent to a properly controlled recipient list.
Delete unnecessary sensitive exports according to an appropriate retention plan. Keep important records safely, but do not leave duplicates indefinitely in chat attachments, public folders and old devices merely because storage is cheap.
If you clicked a suspicious link
What happened next matters. Opening a page, entering a password, downloading a file, installing software and authorizing a payment are different events. Write down what you actually did rather than assuming the worst or dismissing it because nothing obvious changed.
If you entered credentials, use a trusted route to change them and review sessions and recovery settings. If the password was reused, address those other accounts too. If you installed software or granted remote access, disconnect and seek the device owner’s or qualified support team’s incident instructions rather than continuing sensitive activity on it.
If money or payment information was involved, contact the provider promptly through an official channel. Preserve the original message and transaction records. Reporting and recovery options vary, so do not rely on an internet promise that a charge can always be reversed.
Keep a simple response order
| Confirmed action | Priority |
|---|---|
| Only viewed an unexpected page | Close it, avoid further instructions and keep software supported |
| Entered a password or approved a sign-in | Secure the affected account and its active access |
| Provided personal identifiers | Assess identity-misuse protections and reporting appropriate to the data |
| Sent money or authorized a transaction | Contact the payment provider promptly and preserve evidence |
| Installed a file or granted remote control | Follow device incident-response guidance using trusted support |
For identity-related exposure, our identity-theft guide separates account takeover, credit-file protections and fraud recovery. A breach notification and an unauthorized transaction do not need exactly the same response.
Make the habits usable for the household
Agree that anyone can pause a suspicious request and ask for help without embarrassment. Scams often rely on urgency or secrecy, so a normal verification conversation is useful. Avoid turning every online mistake into a lecture that makes someone less likely to report the next one.
Keep a small list of trusted provider contact routes and account-recovery information securely available. A family member should not have to search randomly for a support number while an apparent fraudster is on the phone demanding action.
For children, use age-appropriate guidance and supported parental tools without treating tracking as a substitute for conversation. The family safety guide addresses broader responsibilities and changing independence.
Frequently asked questions
Does HTTPS mean a shop is legitimate?
No. It protects the connection to the site, not the honesty of the operator. Verify the business, payment process and transaction separately.
Can a convincing caller be trusted if they know my details?
Knowing your name or account-related information is not proof of authorization. End the unsolicited interaction and contact the organization through a trusted route.
Should I change every password after one suspicious email?
Not automatically. Match the response to what happened. Entering credentials or discovering unauthorized access calls for action; merely receiving a message is not proof that all accounts are compromised.
What is the most useful daily habit?
Verify important requests independently of the message, advertisement or caller that introduced them. Combine that habit with maintained devices and protected recovery accounts.
