Security glossary

Proving who you are to an account, usually with an email address or username and a password — for online banking or your email, for example. Scammers like to copy exactly these sign-in pages.

Tip: Never open a sign-in page from a link in a message — use the app or type the address yourself. More: The inbox

A secret word or phrase you sign in with. A good password is long, known only to you and used for one account only.

Tip: No genuine company will ask for your password by email, text or phone. More: I clicked — what now?

A program that stores your passwords encrypted and creates a separate, random password for every account. You only need to remember one good main password.

Tip: A password manager only fills in your password on the genuine site. If the field stays empty, treat it as a warning sign.

Signing in without a password: you confirm with your fingerprint, face or device PIN. A passkey only works for the genuine site — a fake one can't do anything with it.

Tip: Where a service offers passkeys, it's worth switching. More: I clicked — what now?

Besides your password, a second proof is needed, such as a code sent to your phone or a confirmation in an app. Someone who only has your password can't get in with it alone.

Tip: Never pass on a code you didn't request yourself — not even on the phone. More: I clicked — what now?

A number that works for just one sign-in or payment — sent by text, shown in an app or on a card reader. It's often the last hurdle in front of your money.

Tip: Read what the code is for before entering it — and never give it to anyone who calls or messages you. More: I clicked — what now?

A short secret number, for your bank card or to unlock your phone, for example.

Tip: Only you know your PIN — your bank and the police never ask for it.

After a scam, have your card or online banking blocked straight away — call your bank on the number on your card, or 159 in the UK.

Tip: Your bank's number is on your card and in your banking app — never use one from a message. More: I clicked — what now?

Fake messages, usually emails, that lure you onto a copied website or push you to pay — to get passwords, card details or money. The word is a play on “fishing”.

Tip: Pressure, fear or a tempting prize are the levers. The more a message rushes you, the more it pays to stay calm. More: The inbox

Phishing by text message or messenger — a supposed parcel, an unpaid fee or “Hi Mum, this is my new number”.

Tip: Don't tap links in texts — open the app or the website you know yourself. More: Texts and messengers

Who sent a message. Anyone can choose the name that's displayed — the address behind it tells you more, and even that can be faked.

Tip: If a message is unexpected, check through a channel you already know — not by replying or using its link. More: The inbox

Clickable text or a button. The visible text can claim anything; what counts is the target — the address that opens behind it.

Tip: On a computer, point at it with the mouse without clicking. On a phone, don't tap it — open the app or the address you know yourself. More: The inbox

The name of a website. Who it belongs to is shown by the part right before the ending, such as .co.uk or .com — so you read the address from the right.

Tip: The address ends at the first “/” after “https://”. Everything further left can be chosen freely by the owner. More: The address duel

Web addresses may contain letters such as ü or é. Technically they are converted into a stand-in spelling that starts with “xn--”: übung-macht-sicher.de becomes xn--bung-macht-sicher-12b.de. Some programs show this form — then a genuine address looks strange. That is why this site spells its German address with “ue” instead of “ü”: typing übung-macht-sicher.de takes you to uebung-macht-sicher.de.

Tip: Scammers use the same technique to disguise addresses with lookalike letters. If “xn--” appears in an address whose name has no special letters — your bank's, for example — take it as a warning sign. More: The address duel

A file that comes with an email, such as a PDF or a photo. The dangerous ones start a program, or are Office files asking you to “enable content”.

Tip: Don't open unexpected invoices or reminders — check in your customer account instead. More: The inbox

A shortened address that only shows its real target once you open it.

Tip: If it's about money, passwords or codes, don't open the short link — go to the site you know yourself. More: The address duel

A square of dots that your phone camera reads as an address. You only see where it leads after scanning it.

Tip: After scanning, read the address shown first — then decide. More: The address duel

Unwanted bulk messages: mostly annoying adverts, but often scams too.

Tip: Don't reply and don't click “unsubscribe” links — just delete it.

The program you open websites with, such as Edge, Chrome, Firefox or Safari.

Tip: Browser updates come from the browser itself — never from a website that tells you to update. More: Warning pop-ups

A program on a phone or tablet. Your bank's app is a good way to check a suspicious message — as long as you open it yourself.

Tip: Only get apps from the App Store or Google Play — never through a link in a message.

A new version of your operating system, browser or app. Updates close known security holes — best let them install automatically.

Tip: If a website pushes you to update, be careful: updates come through your settings or the app store. More: Warning pop-ups

A program that detects and blocks malicious software. Windows comes with its own, Windows Security (Microsoft Defender), which updates itself. Macs have built-in protection too.

Tip: Keep the built-in protection switched on. Security software that a website or a caller pushes on you is the trap. More: I clicked — what now?

Programs that secretly cause harm: spying on your data, locking your files or controlling your computer remotely.

Tip: Only install programs from sources you know — and never because a message or a caller asks you to. More: I clicked — what now?

A window that suddenly opens. Fake warnings claim your device is in danger and show a phone number or ask for money — real warnings from your system don't.

Tip: Don't call and don't type anything in — close the window, restarting the browser if you need to. More: Warning pop-ups

Someone controls your computer over the internet as if they were sitting in front of it. Scammers use a pretext to get you to install a program for it.

Tip: Never give remote access to anyone who called or messaged you. If it has happened, disconnect the device from the internet. More: I clicked — what now?

A picture of what's on your screen right now. It lets you show a suspicious message to someone, or to an AI, without tapping any link.

More: Asking AI for advice — with care

Scare software: a page or window claims your device is infected, to push you into a call, a purchase or a download.

Tip: Real security software doesn't show you a phone number to call. More: Warning pop-ups

People claiming to work for well-known companies call you — or get you to call them — about a supposed problem with your computer. They're after remote access and money.

Tip: Hang up. Big companies don't call you out of the blue about your computer. More: Warning pop-ups

Someone texts claiming to be your child or grandchild with a new number, and soon asks urgently for money.

Tip: Call the old number you know before sending any money. More: Texts and messengers

Callers pretend to be the police, your bank or an authority — the number on your screen can even look genuine — and push you to hand over money, cards or valuables.

Tip: Hang up and call the number you know yourself — for your bank, 159 connects you safely. More: I clicked — what now?