Attacking the human, not the computer

Many attacks do not break the computer at all. They trick the person. This is called social engineering, and phishing is the most common kind: a fake message that pretends to be someone you trust, to make you click a link or hand over a password.

Warning signs of phishing:

• Urgency: "Your account will close in 1 hour."
• A link whose address does not match the real website
• Requests for your password, PIN, or a one time code
• Small spelling and grammar mistakes, or an odd sender address

The defence is a pause. Real organisations do not ask for your password by message. When in doubt, do not click. Go to the official website or app directly.

Practice

Look through your messages or email for one example that could be phishing. Write down two signs that made you suspicious, or two reasons you trust it.