Six rules for everyday life, in plain English. Each one comes with a short try-out. It takes about ten minutes, and nothing can go wrong.
Rule 1Anything can appear in a browser.
Your browser is the program you use to go online, such as Edge, Chrome, Firefox or Safari. Whatever appears in it is a web page. And a web page can look like anything: a warning from Windows, your bank, or a letter from HMRC.
A web page is only painted on. It can't find a virus, look at your files or lock your computer.
- How to recognise a web page: the address bar and the tabs at the top.
- A warning with a phone number is a scam. Real security warnings never ask you to call a number.
- Closing is always allowed: the tab, the window or the whole browser.
- The same goes for your phone: whatever appears in the browser is a web page.
Two tricks that blur the line
- Full screen: the page hides the address bar and tabs and fills the whole screen. Then it looks like the computer itself. Hold down the Esc key for two seconds and the frame comes back. If that doesn't help, quit the browser or restart the computer. If the browser then offers to restore your last pages, say no.
- Notifications: some sites ask whether they may send you notifications. If you choose “Allow” — often without noticing — their messages then appear at the edge of the screen, where your computer shows its own messages, sometimes even when the browser is closed. So on unfamiliar sites, choose “Block”. Already allowed? In your browser's settings, “Notifications” lists every site that may send you messages. You can block or remove unfamiliar sites there.
Try it: web page or computer?
Six pictures. For each one, decide: is it a web page, or a message from the computer itself?
Picture 1 of 6
Exercisehttps://security-alert-pc.test/warning⚠ Virus found!
Your computer is infected with 3 viruses.
Call support immediately:
☎ 0800 ••• 2291✓ Right: a web page.
✗ Not quite: this is a web page.
There's an address bar at the top: the window is a browser, so the warning is a web page. And a warning with a phone number is always a scam.
Answer: a web page. There's an address bar at the top: the window is a browser, so the warning is a web page. And a warning with a phone number is always a scam.
Picture 2 of 6
ExerciseUpdates available
Security updates are ready for your device.
You can install them now or later.
✓ Right: a message from the computer itself.
✗ Not quite: this is a message from the computer itself.
This message is in your device's settings: no address bar, no phone number, no pressure. Installing updates is a good idea.
Answer: a message from the computer itself. This message is in your device's settings: no address bar, no phone number, no pressure. Installing updates is a good idea.
Picture 3 of 6
Exercise⚠ Your computer has been locked
Dangerous malware detected.
Do NOT switch off your computer. Call now:
☎ 0800 ••• 4471✓ Right: a web page.
✗ Not quite: this is a web page.
A web page in full screen: the address bar and tabs are only hidden. Hold down the Esc key for two seconds and they come back. The phone number gives the trap away.
Answer: a web page. A web page in full screen: the address bar and tabs are only hidden. Hold down the Esc key for two seconds and they come back. The phone number gives the trap away.
Picture 4 of 6
ExerciseSecurity app
Threat removed
A dangerous file has been removed.
You don't need to do anything.
✓ Right: a message from the computer itself.
✗ Not quite: this is a message from the computer itself.
This message comes from your computer's security app: no phone number, no pressure, nothing to buy. If you're unsure, open the security app yourself and check there.
Answer: a message from the computer itself. This message comes from your computer's security app: no phone number, no pressure, nothing to buy. If you're unsure, open the security app yourself and check there.
Picture 5 of 6
ExerciseYour browser
Your PC is infected!
3 viruses found. Clean them now for free.
✓ Right: a web page.
✗ Not quite: this is a web page.
A web page, even though the message appears where your computer shows its own. Any site you've allowed to send “notifications” can do that, and it's often hard to see where it comes from. The push to “clean” gives it away: you don't need security software that a web page pushes on you. The fix: block the site under “Notifications” in your browser's settings.
Answer: a web page. A web page, even though the message appears where your computer shows its own. Any site you've allowed to send “notifications” can do that, and it's often hard to see where it comes from. The push to “clean” gives it away: you don't need security software that a web page pushes on you. The fix: block the site under “Notifications” in your browser's settings.
Picture 6 of 6
Exercisehttps://kestrelmoorbank.example/sign-inKestrelmoor Bank — Sign in
User IDPassword✓ Right: a web page.
✗ Not quite: this is a web page.
A web page — even your bank's real website is one. That's why the address in the address bar matters. The best way in is your own bookmark or the bank's app.
Answer: a web page. A web page — even your bank's real website is one. That's why the address in the address bar matters. The best way in is your own bookmark or the bank's app.
Done. Remember: whatever appears in the browser is a web page — even in full screen, and even when it turns up where your computer shows its own messages.
Rule 2Under pressure? Stop.
Scammers rush you: “today only”, “or your account will be blocked”, “or the police will come”, “your child needs money now”. The pressure is meant to stop you thinking.
So: the more a message or a caller rushes you, the more time you take. Don't tap, pay or give anything away for now. Hanging up is fine, and it isn't rude. Then check calmly, the way rule 3 shows.
Your account will be blocked today at 6 pm. Confirm now: https://kestrelmoor-login.example/account
What do you do first?
- ✗ Confirm quickly so nothing gets blocked. That's exactly what the sender wants: for you to act before you think.
- ✓ Stop: don't tap anything, and check calmly. Right. The rush is the warning sign. Whether anything is wrong with your account, you'll see in your banking app or on your bank's website — both of which you open yourself.
- ✗ Reply to the text and ask if it's true. Your reply goes to the sender — possibly the scammers. Asking is right, but your own way.
Rule 3Check for yourself, your own way.
If a message or a call comes out of the blue, don't check using what you've been sent: not the link in the message, not the number that's calling, not the button in the window. Go your own way:
- Open your bank's or the delivery company's app yourself.
- Type the address in yourself, or use your own bookmark.
- Look the number up yourself — on your card, in your paperwork or in your address book — and dial it yourself. Scammers can keep a landline connected: use a different phone, or wait five minutes. To reach your bank, you can also call 159.
The same goes for “Hi Mum, this is my new number”: call them on the number you already have.
“This is your bank's security team. Money has just been taken from your account.”
What do you do?
- ✗ Stay on the line and do what the caller says. Anyone can claim to be your bank on the phone. Even the name or number on the display can be faked.
- ✗ Call back using the redial button. Redial calls exactly the number that was displayed — and that can be faked.
- ✓ Hang up and call your bank yourself, on the number on the back of your card. Right. You dial a number you looked up yourself. Use a different phone or wait five minutes, because scammers can keep a landline connected. Or call 159 to reach your bank.
Rule 4Codes and passwords stay with you.
Your PIN, your passwords and the one-time passcodes you get by text are your keys. Whoever has them can get into your account or take money.
Your bank and the police never ask for any of them: not on the phone, not by text, not by email. Anyone who asks is trying to scam you. The same goes for approving something in your banking app: only approve what you're doing yourself, right now.
“This is the police. We're protecting your account from fraudsters. Please read me the code that's about to arrive by text.”
What do you do?
- ✗ Read out the code — it's the police, after all. The real police never ask for a one-time passcode. With it, the caller approves a payment from your account.
- ✗ Ask for their warrant card number first, then read it out. You can't check an ID over the phone. And the real police never need your code.
- ✓ Read out nothing, and hang up. Right. A one-time passcode is yours alone. Anyone who asks for it is trying to scam you — whoever they claim to be.
Rule 5Nothing for strangers: no access, no money.
Never give remote access to your computer or phone to anyone you didn't ask for help yourself — not even to a friendly voice on the phone. Genuine companies don't ring out of the blue to fix your computer. Don't install an app just because a caller or a website tells you to.
And no money for strangers: no transfer to a “safe account”, no cash or valuables for a courier, no gift card codes. A gift card code is like cash: once it's passed on, the money's gone.
“Your computer has reported viruses to us. Please install this program and I'll clean it up for you.”
What do you do?
- ✗ Install the program — the caller wants to help. With a program like that, the caller can see and control your computer. Next, they'll be after your money.
- ✓ Hang up and install nothing. Right. Genuine companies don't ring out of the blue to fix your computer. Anyone who calls like this wants access to it.
Rule 6If it has happened: act at once, get support.
Clicked, paid or given something away after all? It happens to careful people too — scammers are professionals. What matters now is acting quickly and in the right order:
- Call your bank straight away, using the number on your card or in your banking app, or call 159. Have your card or online banking blocked.
- Get support: someone calm whom you trust. But don't wait for them before blocking.
- Change any passwords you've given away.
- Report it to Report Fraud: reportfraud.police.uk or 0300 123 2040.
The full plan is behind the lifebuoy at the top of every page: I clicked — what now?
You gave a caller your bank details. Now you realise: it was a scam.
What do you do first?
- ✗ Wait and see if anything happens. Waiting only helps the criminals. The sooner things are blocked, the more can be prevented — sometimes a payment can still be recalled.
- ✓ Call your bank straight away and have things blocked. Right. Blocking comes first. Then get support and work through the emergency plan step by step.
- ✗ Keep it to yourself for now. Talking helps: two people keep track more easily. But block straight away — don't wait until someone's with you.
To take with you
All six rules on one card: print it and keep it by your computer.
The essentials: six rules
- Anything can appear in a browser. A web page is only painted on. Closing is always allowed.
- Under pressure? Stop. The more you're rushed, the more time you take.
- Check for yourself, your own way. Open the app yourself, dial the number yourself.
- Codes and passwords stay with you. Your bank and the police never ask for them.
- Nothing for strangers: no access, no money.
- If it has happened: act at once, get support. Your bank (number on your card) · 159 · Report Fraud 0300 123 2040 · police 999 in an emergency, otherwise 101
practice-makes-safe.org/en/the-essentials · numbers as of October 2026
What next?
You can practise every rule on simulated emails, texts, calls and pop-ups. The course takes you through it all in two paths; each station takes about ten minutes.
Go to the course Start with the pop-ups
How a computer works, and why a warning in the browser is only painted on, is shown in “No magic”.
Know someone who should practise this too?
Send this exercise to — or to anyone you like.
Then pass on the address of this exercise: https://practice-makes-safe.org/en/the-essentials
Sources (checked 16 October 2026)
Swiss Federal Office for Cyber Security (BACS), Week 24: Fake virus alert – Is my computer really infected? (17 June 2025; push notifications allowed unwittingly) · Microsoft, Protect yourself from tech support scams (no phone numbers in error messages, full screen, no unsolicited calls) and Manage website notifications in Microsoft Edge (bottom right, even when the browser is closed) · Google, Chrome Help, Use notifications to get alerts · WICG, Keyboard Lock (6 October 2021; hold Esc) · Eric Lawrence, Attack Techniques: Fullscreen Abuse (12 September 2023; after a restart, restoring brings the page back) and Attack Techniques: Notification Spam (it's hard to see where they come from) · Stop! Think Fraud (UK Government), Recognise the tactics (false urgency; asking for your PIN), How to spot a fake text message and How to spot phone fraud · Citizens Advice, Check if something might be a scam (paying with vouchers) · What to do after a scam follows the emergency plan; numbers and sources are listed there.
All companies, people, addresses and numbers in the exercises are invented. Any resemblance to real companies or people would be purely coincidental and unintended.