Most cyber attacks on individuals do not need clever hacking. They rely on a message that tricks you, a password that is easy to guess or reused, or software that was never updated. This article explains the common threats in plain words and five habits that block most of them, based on guidance from CISA (the US cybersecurity agency) and the NCSC (the UK's national cyber security centre). It is written for anyone, with no technical background needed.

The threats you are most likely to meet

  • Phishing: a message by email, text or chat that pretends to come from a bank, a delivery company or a person you know, and pressures you to click a link or hand over information
  • Weak or reused passwords: CISA says that when you reuse a password, one data breach at one company exposes all your other accounts that share it
  • A taken-over email account: the NCSC says that an attacker who gets into your email can reach your other accounts and steal your identity, because email is used to reset passwords
  • Out-of-date software: updates include security fixes, and without them attackers can use holes that are already known
  • Online scams that ask for money: for example fake online sales, where the victim is tricked into transferring money to the scammer

CISA names four basic actions for everyone: recognize and report phishing, use strong passwords, use multifactor authentication together with a password manager, and update software. The NCSC adds a fifth habit, which is to back up your important data. The sections below take them one at a time.

INFOGRAPHIC
Five habits that block most attacks
Everyday security
habits, no technical skill needed
Long, separate passwords
a password manager does the remembering
A second login step
start with email and banking
Automatic updates
closes known holes
Spot phishing
do not click, verify another way
Back up
photos and key documents

Habit 1: Strong, separate passwords

A strong password is long and hard to guess, and a different one is used for each account. CISA recommends at least 16 characters, either a mix of letters, numbers and symbols, or a passphrase (a password made of several unrelated words) of 4 to 7 words. The NCSC suggests combining three random words. The two agencies give different numbers, so the safe reading is that a longer passphrase is better. Give your email account the strongest and most separate password of all, as the NCSC advises.

Nobody can remember dozens of long, different passwords, so use a password manager (an app that creates, stores and fills in passwords for you). CISA says it can also flag weak or reused passwords, and you only need to remember one long master password. Browsers include a free one, and paid ones exist. CISA suggests reading independent reviews before you choose.

Habit 2: Turn on a second login step

Multifactor authentication (MFA, also called 2-step verification) asks for a second proof when you log in, so a stolen password alone is not enough to get into your account. CISA lists three common kinds: a code sent by text or email, a code from an authenticator app (which changes about every 30 seconds), and biometrics such as a fingerprint or face. Turn it on for every account that offers it, starting with email, banking, online shopping and social media. Look in the account's security settings, where it may be called two-factor or two-step.

CISA's page does not rank these methods. Our own view is that an authenticator app is generally a better choice than a code sent by text, which can be intercepted or tricked out of you, but any second step is better than none. For a deeper comparison, see MFA: Which Type Is Safer? and Passkeys and FIDO2 Explained.

Habit 3: Keep software updated

Many updates fix security holes that attackers could otherwise use, so install them promptly, especially critical ones. Turn on automatic updates (often under Software or Security in the settings) so your phone, computer and apps update without waiting for you. CISA also says not to skip updates for your web browser and antivirus software.

Habit 4: Spot and report phishing

CISA lists these warning signs:

  • Urgency or threats: the message pressures you to act right away or warns of serious consequences
  • A request for personal or financial details: for example a password, a card number or a one-time code
  • Shortened links from someone you do not know: you cannot see where the link goes
  • A sender address or link that copies a real company's name with small changes: such as swapped letters
  • Do not rely on spelling mistakes: CISA notes that AI can now write clean text, so poor grammar is no longer a reliable sign

If a message looks suspicious, do not click its links or open its attachments, do not reply, and do not use its unsubscribe link. If it might be real, contact the company or person another way that you already trust: type the company's web address yourself, or call a number you already have. Then use the report button in your email app, or the report option next to the sender's name, and delete the message.

Scammers also use voice and video. See Deepfakes and AI Social Engineering for how to double-check a request that seems to come from someone you know.

Habit 5: Back up what you cannot replace

The NCSC advises copying your most important data, such as photos and key documents, to an external hard drive or cloud storage. A backup protects you when a phone is lost, a device breaks or malware locks your files. One extra point is our own view: do not leave the external drive plugged in all the time, because some malware also damages files on connected drives. For a fuller method, see Backup 3-2-1-1-0 and Immutable Backups.

If something goes wrong

Act quickly, because the first hours matter most when money has moved. Steps:

  • Stop and disconnect: stop replying to the scammer and stop clicking. If you installed something at their request, turn off the device's internet connection
  • If you transferred money, call your bank and the 1441 hotline at once: according to The Standard, 1441 is run by Thailand's Ministry of Digital Economy and Society, works 24 hours a day, and aims to suspend the scammer's account within 1 hour of a report. Confirm the number and the process on the official sites, because they can change
  • Report to the police: use the online reporting service of the Royal Thai Police's technology crime unit at thaipoliceonline.go.th, or go to a police station
  • Have the details ready: the destination account number, the amount, the date and time, and the channel used (our own checklist, based on common advice from Thai news reports)
  • Change passwords and secure the accounts: change the password on any account that may be affected, and on every other account that used the same password. Turn on a second login step, then check the account's recovery email and phone number
INFOGRAPHIC
Tricked into a transfer: the first five steps
1
Stop and disconnect
stop replying and clicking
2
Call the bank and 1441
in hours, not days
3
Report to police
online or at a station
4
Gather the details
account, amount, time
5
Change passwords
including accounts sharing it

Common mistakes

  • Using one password everywhere: one breach then exposes every account that shares it
  • Protecting social media but not email: the NCSC says email is the key that resets your other accounts
  • Clicking the link in a message to check whether it is real: type the company's address yourself instead
  • Treating clean spelling as proof that a message is real: CISA says AI now writes clean text
  • Postponing updates for weeks: attackers move quickly once a hole is known
  • Waiting a few days before telling the bank about a scam transfer: the response targets in the 1441 reports are measured in hours

Start today

  • Change your email password to a long passphrase that you use nowhere else: then turn on a second login step for it
  • Install a password manager and move your most important accounts into it first: email, banking and shopping
  • Turn on a second login step for your bank, shopping and social media accounts
  • Turn on automatic updates on your phone and computer: and update your browser
  • Copy your photos and key documents to a drive or cloud storage: and check that you can open them
  • Save the 1441 number and the police online reporting address in your phone: you will not want to search for them in a hurry

If you run an organization, the same habits apply to your staff, and you can see where you stand with the self-assessment. For what to do after a ransomware attack, see Ransomware: The First 5 Steps.

If your organization must show customers its security readiness, see ISO 27001 vs SOC 2: Which Should You Choose?.

References and further reading

The advice on passwords, MFA, updates and phishing comes from the CISA pages listed below, and the advice on email security and backups comes from the NCSC page. Details about the 1441 hotline come from a news report dated November 2023 and may have changed, so check them on official sites before relying on them. Items marked as our own view do not come from those sources. The sources were read on 23 October 2026, and guidance changes, so check the original pages again.