Stay safe: free advice for people and small teams

Eight checks that stop most attacks

None of these needs a product. They take an afternoon to set up and protect you for years.

1. Long, unique passwords in a manager

Use a different password for every account, and make each one long: a few unrelated words beat a short string of symbols. Keep them in a password manager so you never have to remember or type them. Reuse is the problem a manager solves: when one site leaks, the same password opens nothing else.

2. Two-factor sign-in everywhere it is offered

Turn on two-factor sign-in for email, banking, cloud storage and anything else that offers it. An app that generates codes, or a hardware key, is better than a text message, but a text message is still far better than nothing. With it on, a stolen password alone gets an attacker nowhere.

3. Updates on the day they arrive

Most break-ins use a hole that was fixed weeks or months before, on a machine that never installed the fix. Turn on automatic updates for the operating system, the browser and the apps you use, and let the machine restart when it asks. Treat “update later” as “stay open later”.

4. A pause before any link or attachment you did not expect

Messages that push you to act now are the most common way in. Before you click, ask whether you were expecting this, and check the sender through a channel you already trust: the number in your contacts, the website you already have bookmarked, the person at the next desk. If a message asks you to sign in, type the address yourself rather than following the link.

5. Backups kept offline and tested

Keep a copy of what matters on a drive that is unplugged when you are not backing up, or in a service the attacker cannot reach from your machine. Then try a restore: a backup you have never restored is a hope, not a backup. Ransomware is survivable when the copy is out of reach.

6. Least privilege at work

Nobody needs admin rights to read email. Give each account only what its job needs, use a separate admin account for admin work, and remove access when someone’s role changes. The damage from one mistake, or one stolen password, then stays small.

7. A second channel before paying an invoice or changing bank details

Invoice fraud works by email alone. When a supplier’s bank details change, or a payment request arrives that you did not expect, call the number you already have on file, not the number in the message, and confirm with a person. Make this a rule that no sense of urgency can override.

8. Report it early

An early report stops the next victim. If you clicked, paid or let someone in, tell your bank, your IT team or the police as soon as you suspect it. Nobody is in trouble for reporting; the only bad report is the one that comes a week late.

If something already happened

1. Disconnect. Unplug the network cable or turn off Wi-Fi on the affected machine. Do not turn the machine off: evidence lives in its memory.
2. Change passwords from a clean device: a different phone or computer you trust. Start with email, because email resets everything else.
3. Tell your bank straight away if money, cards or bank details are involved. Banks can stop or recall payments when told quickly.
4. Keep the evidence: the message, the addresses, screenshots, the time it happened. Do not delete anything yet.
5. Report it, using the addresses below.

Where to report

• Anything involving Emersa products or this site: 4d@emersa.io. A human reads it.
• In the UK: Action Fraud at actionfraud.police.uk, and forward suspicious emails to the NCSC’s reporting service at report@phishing.gov.uk.
• Elsewhere: your national CERT (computer emergency response team), which every country in the EU and most others maintain.

What we do about it

This advice is free and needs none of our products. For enterprises that need more, Emily Wilson and Krupiq are built for cybersecurity and compliance, and the security page explains how this site itself is protected and how to report a vulnerability in it.