Internet Safety Essentials: The Questions Students Ask Us Most

This is the question I hear first, in almost every class. The honest answer is that no single sign settles it, but a handful of habits catch most of the trouble. Start with the sender: look at the actual address behind the name, not just the name shown. Then look at what the message wants. Scam emails nearly always push you to act quickly, to click, to log in, to confirm something, or to pay.

A real bank, utility or government office will not ask for your password or full card number by email. If a message says your account will close within a day, treat that urgency as the warning itself. Slow down, close the message and reach the company the way you normally would, through its own website or the phone number on your card.

In class we practise on sample messages printed on paper, circling every detail that feels off. Students are often surprised how quickly their instincts sharpen once they know where to look.

• Check the real sender address, not only the display name
• Be wary of urgency, threats and unexpected prizes
• Never use links in the message to log in
• Contact the company directly using a number you already trust

Many students arrive with a notebook of passwords, or one password used everywhere. Both are understandable, and both carry risk. A notebook can be lost or read by a visitor, and a reused password means one leak opens every account you own. A password manager stores each password in an encrypted vault that opens with one strong main password, so you only need to remember that one.

Is it risk free? No tool is. But for most people a reputable manager is far safer than reuse or sticky notes. The main password matters a great deal, so we suggest a short phrase of several unrelated words that is long, memorable and not written near your computer.

We also show students how to turn on a second step at login, such as a code sent to a phone. Together these two habits protect an account even if a password is somehow guessed.

• Use a long phrase made of unrelated words as your main password
• Give every account its own password
• Turn on a second login step for email and banking

Please do not feel embarrassed. Careful, intelligent people click bad links every week, and the useful question is what to do next. First, stay calm and disconnect nothing dramatic yet. If the link only opened a page and you typed nothing, close it and you are very likely fine. Run your device's built-in security scan to be sure.

If you entered a password, change it right away from a different, trusted device or a fresh browser window, and change it anywhere else you used the same one. If you shared card details, call your bank using the number on the back of your card and ask them to watch the account.

Keep a short note of what happened and when. It helps if you need to explain events to your bank, and it turns a stressful moment into a list of calm steps.

• Close the page and run a security scan
• Change any password you typed, starting with email
• Call your bank if card details were shared

Cafés, libraries and hotels all offer free Wi-Fi, and students want to know whether it is worth the worry. For reading the news or checking a bus time, it is generally fine. The concern is what you do while connected. On an open network, other people nearby may be able to see traffic that is not properly protected.

Our rule of thumb is simple: skip online banking, shopping and anything involving personal documents while on shared Wi-Fi. If you must, switch to your phone's mobile data instead, which is a private connection. Check that a site address begins with https and shows the padlock, though remember a padlock only means the connection is private, not that the site is honest.

Also turn off the setting that joins networks automatically, so your device does not connect to a look-alike network without asking.

• Save banking and shopping for home or mobile data
• Look for https, but do not treat the padlock as proof of honesty
• Turn off automatic joining of open networks

Fake shopping and government sites can look polished, so appearance alone proves little. We teach students to read the web address carefully. Look for small misspellings, extra words, or odd endings added to a familiar name. When in doubt, type the address yourself rather than following a link from an email, advertisement or text message.

Next, consider the offer. Prices far below every other store, or a government refund that requires a card number, should slow you down. Check for a real contact address, a clear returns policy and ways to reach a person. A site with none of these deserves caution.

A practical habit is to bookmark the sites you use regularly, such as your bank, so you always arrive at the genuine page. In class, students build their own short list of bookmarks, and many tell us it removes a surprising amount of daily doubt.

• Read the web address letter by letter
• Be suspicious of prices that seem too good to be true
• Bookmark the sites you rely on most

Students often ask whether they need this course or can pick it all up by reading. Plenty can be learned from articles like this one, and we hope they help. What a course adds is practice with someone beside you: opening a suspicious message together, setting up a second login step step by step, and asking the question you were too shy to ask elsewhere.

Internet Safety Essentials covers scam emails and fake websites, strong passwords and the protection of your accounts and personal information. It assumes you can already use email and a web browser. If you are not there yet, Computer Basics for Adults is the natural place to begin.

Lessons are short and paced for adults who want to take their time, with practice tasks after each one. Outcomes are realistic: more confidence, better habits and fewer moments of panic, not a guarantee against every trick.