Five Common Internet Safety Mistakes and How to Avoid Them

The most common mistake I meet in class is one easy password used for email, banking, shopping and streaming. It feels sensible, because nobody wants to memorize twenty of them. The trouble is that when one small website loses its customer list, the same password can be tried on every other account you own. People are often surprised how quickly that happens, and how long it takes to notice.

The fix does not need special skills. Give your email and your bank each a password that is used nowhere else. A string of four or five unrelated words, such as a made-up sentence you can picture, is longer and easier to remember than a short word with a number added at the end.

Once those two accounts are secure, work outward to the others over a few weeks. There is no prize for finishing in one evening, and a steady pace means you are less likely to get locked out.

• Use a different password for email and banking first
• Choose a long phrase of unrelated words
• Change a few accounts a week, not all at once

Scam emails rely on speed. A message claims your parcel is held, your account is suspended or a payment failed, and it wants an answer within the hour. The pressure is the real trick. When you feel rushed, you stop looking at the details that would give the message away.

Pause and read the sender's address, not just the display name. A bank or courier will rarely write from an address full of extra letters or a free webmail service. Look at the greeting too: a message that says only dear customer, with odd spelling or clumsy phrasing, deserves suspicion.

If you are unsure, do not use the links in the message. Close it, open your own browser and type the organization's address yourself, or phone the number printed on your card or a past statement. A real problem will still be waiting for you there.

• Check the actual sender address
• Treat urgent deadlines as a warning sign
• Go to the website yourself instead of using the link

Many learners tell me they trusted a site because it looked professional. Sadly, copying a logo and a colour scheme takes a scammer very little effort, so appearance proves nothing. A fake shop can look cleaner than a real one.

Look instead at how you arrived and what the site asks for. Did you land there from a search result, a message or an advertisement? Are the prices far below anywhere else? Does it want payment by gift card, wire transfer or a method you have never been asked for by a store before? Those are the details that matter.

Check the address bar for small misspellings of a name you know, and look for a real postal address and a working phone number on the contact page. When anything feels off, leave and search for the business again from scratch.

• Be wary of prices that look too good
• Read the address bar for odd spellings
• Avoid unusual payment methods such as gift cards

Not every scam arrives by email. A caller may say they are from your bank, a government office or a technology support line, and then ask you to confirm a birth date, a card number or a code that was just sent to your phone. The voice is often friendly and calm, which makes it easier to go along with.

A legitimate organization will not ask you for a full password or for the one-time code sent to your phone. If a caller asks, that is your signal to stop. You are allowed to hang up, even if it feels impolite, and nobody sensible will blame you.

Afterward, call the organization back on a number you already trust, not one the caller gave you. Wait a minute first, in case the line is still open on their end. Then tell a family member or friend what happened, because talking it through makes the pattern easier to spot next time.

• Never read out a code sent to your phone
• Hang up and call back on a number you trust
• Tell someone you trust about the call

Update reminders are easy to put off, especially when you are in the middle of something. Yet many of those updates close security gaps that are already known, and leaving them undone keeps the door open longer than it needs to be.

Set your computer and phone to install updates automatically, ideally overnight while you sleep. Then look at two-step verification, which asks for a second proof, usually a code sent to your phone, when you sign in. It takes a minute to switch on for email and banking and blocks most attempts to use a stolen password.

Keep a short written list of which accounts have it turned on, stored somewhere private at home rather than on the computer itself. That list also helps if you ever replace your phone and need to move everything across.

• Turn on automatic updates
• Enable two-step verification on email and banking first
• Keep a private list of protected accounts

Looking back over these five, none of them is about being careless or not clever enough. They are normal human habits: wanting convenience, answering politely, trusting a tidy page. Scammers build their approach around those habits, which is why the defence is usually a small pause rather than technical knowledge.

In my sessions I ask learners to choose just one change to make this week. Often it is a new password for email, or a rule never to click from a message that asks for urgent action. A single changed habit does more than a long list of good intentions that never gets started.

Mid autumn is a sensible time to do this, with more online shopping and delivery notices on the way. Taking an hour now means you meet those messages already prepared.