Security glossary

Proving who you are to an account, usually with an email address or username and a password — for online banking or your email, for example. Scammers like to copy exactly these sign-in pages.

Tip: Never open a sign-in page from a link in a message — use the app or type the address yourself. More: The inbox

A secret word or phrase you sign in with. A good password is long, known only to you and used for one account only.

Tip: No genuine company will ask for your password by email, text or phone. More: Passwords

A program that stores your passwords encrypted and creates a separate, random password for every account. You only need to remember one good main password.

Tip: A password manager only fills in your password on the genuine site. If the field stays empty, treat it as a warning sign. More: Passwords

Signing in without a password: you confirm with your fingerprint, face or device PIN. A passkey only works for the genuine site — a fake one can't do anything with it.

Tip: Where a service offers passkeys, it's worth switching. More: The second key

Besides your password, a second proof is needed, such as a code sent to your phone or a confirmation in an app. Someone who only has your password can't get in with it alone.

Tip: Never pass on a code you didn't request yourself — not even on the phone. More: The second key

A number that works for just one sign-in or payment — sent by text, shown in an app or on a card reader. It's often the last hurdle in front of your money.

Tip: Read what the code is for before entering it — and never give it to anyone who calls or messages you. More: The second key

A short secret number, for your bank card or to unlock your phone, for example.

Tip: Only you know your PIN — your bank and the police never ask for it.

After a scam, have your card or online banking blocked straight away — call your bank on the number on your card, or 159 in the UK.

Tip: Your bank's number is on your card and in your banking app — never use one from a message. More: I clicked — what now?

Banks and other providers check who you are over video: you hold your passport or driving licence up to the camera. That's normal when you've applied for an account yourself. Scammers talk people into it to open accounts or take out credit in their name.

Tip: Only take part if you started the application yourself. If someone tells you what to say, stop. More: On the phone

Fake messages, usually emails, that lure you onto a copied website or push you to pay — to get passwords, card details or money. The word is a play on “fishing”.

Tip: Pressure, fear or a tempting prize are the levers. The more a message rushes you, the more it pays to stay calm. More: The inbox

Phishing by text message or messenger — a supposed parcel, an unpaid fee or “Hi Mum, this is my new number”.

Tip: Don't tap links in texts — open the app or the website you know yourself. More: Texts and messengers

Who sent a message. Anyone can choose the name that's displayed — the address behind it tells you more, and even that can be faked, right down to your own address.

Tip: If a message is unexpected, check through a channel you already know — not by replying or using its link. More: The inbox

Clickable text or a button. The visible text can claim anything; what counts is the target — the address that opens behind it.

Tip: On a computer, point at it with the mouse without clicking. On a phone, don't tap it — open the app or the address you know yourself. More: The inbox

The name of a website. Who it belongs to is shown by the part right before the ending, such as .co.uk or .com — so you read the address from the right.

Tip: The address ends at the first “/” after “https://”. Everything further left can be chosen freely by the owner. More: The address duel

Web addresses may contain letters such as ü or é. Technically they are converted into a stand-in spelling that starts with “xn--”: übung-macht-sicher.de becomes xn--bung-macht-sicher-12b.de. Some programs show this form — then a genuine address looks strange. That is why this site spells its German address with “ue” instead of “ü”: typing übung-macht-sicher.de takes you to uebung-macht-sicher.de.

Tip: Scammers use the same technique to disguise addresses with lookalike letters. If “xn--” appears in an address whose name has no special letters — your bank's, for example — take it as a warning sign. More: The address duel

A file that comes with an email, such as a PDF or a photo. The dangerous ones start a program, or are Office files asking you to “enable content”.

Tip: Don't open unexpected invoices or reminders — check in your customer account instead. More: The inbox

A shortened address that only shows its real target once you open it.

Tip: If it's about money, passwords or codes, don't open the short link — go to the site you know yourself. More: The address duel

A square of dots that your phone camera reads as an address. You only see where it leads after scanning it.

Tip: After scanning, read the address shown first — then decide. More: Shopping and paying

Unwanted bulk messages: mostly annoying adverts, but often scams too.

Tip: Don't reply and don't click “unsubscribe” links — just delete it.

The program you open websites with, such as Edge, Chrome, Firefox or Safari.

Tip: Browser updates come from the browser itself — never from a website that tells you to update. More: Warning pop-ups

Usually this means File Explorer in Windows: the program that shows the folders and files on your computer. Some people also say “Explorer” for the web browser — Microsoft retired the old Internet Explorer in June 2022; its successor is Edge.

Tip: Turn on file name extensions in File Explorer (the “File name extensions” setting): then you can see when “invoice.pdf” is really the program “invoice.pdf.exe”. More: The inbox

A program on a phone or tablet. Your bank's app is a good way to check a suspicious message — as long as you open it yourself.

Tip: Only get apps from the App Store or Google Play — never through a link in a message or because a caller asks you to.

A new version of your operating system, browser or app. Updates close known security holes — best let them install automatically.

Tip: If a website pushes you to update, be careful: updates come through your settings or the app store. More: Warning pop-ups

A program that detects and blocks malicious software. Windows comes with its own, Windows Security (Microsoft Defender), which updates itself. Macs have built-in protection too.

Tip: Keep the built-in protection switched on. Security software that a website or a caller pushes on you is the trap. More: Devices and accounts

A copy of your photos and documents, for example on an external drive or in online storage. If the computer breaks or ransomware locks your files, they are still there.

Tip: Only plug the drive in for the backup — ransomware can spread to it — and check the backup now and then. More: Devices and accounts

Programs that secretly cause harm: spying on your data, locking your files or controlling your computer remotely.

Tip: Only install programs from sources you know — and never because a message or a caller asks you to. More: I clicked — what now?

A window that suddenly opens. Fake warnings claim your device is in danger and show a phone number or ask for money — real warnings from your system don't.

Tip: Don't call and don't type anything in — close the window, restarting the browser if you need to. More: Warning pop-ups

Someone controls your computer over the internet as if they were sitting in front of it. Scammers use a pretext to get you to install a program for it.

Tip: Never give remote access to anyone who called or messaged you. If it has happened, disconnect the device from the internet. More: I clicked — what now?

A picture of what's on your screen right now. It lets you show a suspicious message to someone, or to an AI, without tapping any link.

More: Asking AI for advice — with care

Scare software: a page or window claims your device is infected, to push you into a call, a purchase or a download.

Tip: Real security software doesn't show you a phone number to call. More: Warning pop-ups

People claiming to work for well-known companies call you — or get you to call them — about a supposed problem with your computer. They're after remote access and money.

Tip: Hang up. Big companies don't call you out of the blue about your computer. More: Warning pop-ups

Someone texts claiming to be your child or grandchild with a new number, and soon asks urgently for money.

Tip: Call the old number you know before sending any money. More: Texts and messengers

An email claims to have filmed you through your camera and threatens to share the video unless you pay, usually in Bitcoin. Such emails go out in bulk to any address the scammers have — they are guessing and almost certainly have no video.

Tip: Don't pay, don't reply — and talk to someone you trust. More: The inbox

Callers pretend to be the police, your bank or an authority — the number on your screen can even look genuine — and push you to hand over money, cards or valuables.

Tip: Hang up and call the number you know yourself — for your bank, 159 connects you safely. More: On the phone

Scammers make a different number appear on your screen from the one they really use — your bank's, for example. Caller ID is therefore not proof of who is calling.

Tip: Hang up and call back on a number you know — or 159 for your bank — from another phone if you can. More: On the phone

A supposed relative claims to be in serious trouble — an accident, an arrest — and urgently needs money; often a fake police officer takes over. The aim is cash, sometimes collected by a courier.

Tip: Hang up and call the person on the number you know. The police never come to your home to collect money. More: On the phone

Criminals use artificial intelligence to copy the voice of someone you know — even your child or grandchild. A familiar voice on the phone is therefore not proof.

Tip: Ask for your family's safe phrase and call back on the saved number. More: Family agreements

A secret phrase agreed with close family and friends. If a caller claiming to be family can't give it, hang up. The UK government's Stop! Think Fraud campaign recommends it.

Tip: Agree it in person, never send it by message — and pick nothing that can be found online. More: Family agreements

An online shop that only looks real: it lures you with very low prices, wants a bank transfer and never delivers. Money sent by bank transfer is usually gone.

Tip: Check the shop before you buy — and pay by credit card where you can, never by bank transfer. More: Shopping and paying

Criminals use your details — your name, date of birth or a picture of your ID — to pass themselves off as you. They order goods, take out contracts or open accounts in your name. Often you only notice when bills or letters arrive that aren't yours.

Tip: Only share your ID where it's really needed. If it has happened: report it and check your credit report. More: I clicked — what now?

Someone who moves money from crime through their bank account — often without realising, after a “job” offer. An account that scammers open in your name with your ID can be used the same way. It's a crime, and the account holder faces the consequences.

Tip: Never open an account for someone else or pass on money for strangers. More: On the phone