Strong passwords and two-factor sign-in
A strong password is long and unique — a short phrase of several words is easier to remember and harder to guess than a short jumble of characters. Use a different password for each important account, especially email, banking, and anything with payment information. If remembering many passwords feels impossible, a password manager app can store them behind one master password; ask a trusted person or your library for help choosing one. Turn on two-factor authentication (also called 2FA or multi-factor) wherever it is offered: after your password, the site sends a one-time code to your phone or app. Even if someone steals your password, they cannot get in without that code. Never share that code with anyone — not even someone claiming to be from your bank.
Recognizing phishing and scam messages
Phishing is a fake message designed to trick you into clicking a link, giving up a password, or sending money. Common signs: unexpected messages that create urgency or fear ('your account will be closed today'), links that go to a web address that almost — but does not exactly — match the real company, requests to 'confirm' your password, card number, or one-time code, and offers that seem too generous (free money, refunds, prizes you did not enter). Legitimate organizations do not ask for your password or full card number by email or text. If a message worries you, do not click or reply. Instead, contact the organization using a phone number or website you find yourself, and delete the message.
Protecting your personal information
Treat your Social Security number, bank account numbers, passwords, and one-time codes as private, like the keys to your home. Share them only with a legitimate organization you contacted first, over a channel you trust, when it is truly required. On social media, be careful about posting your full birth date, your children's school or schedule, your home address, or when your home is empty. Check the privacy settings on your accounts, and keep your phone and computer updated — updates fix security holes that scammers use. Be cautious with free apps that ask for permissions they do not need, such as a flashlight app wanting access to your contacts.
If something goes wrong
If you clicked a bad link or shared information, act quickly and do not blame yourself — these scams are designed by professionals to fool careful people. Change the password on the affected account (and any account that used the same password). Tell your bank immediately if payment details were involved; many banks can reverse or stop fraudulent charges if notified fast. Report identity theft at IdentityTheft.gov, which gives you a free recovery plan, and report scams at the FTC's ReportFraud.ftc.gov. Warn family members, especially older relatives, about the message you received. Talking about what happened openly helps others recognize the same trick.
A real-world example
Hypothetical example: a resident gets a text claiming to be from their bank: 'Unusual activity. Confirm your card now' with a link. The link goes to a web address that does not match the bank's real site. Instead of clicking, the resident calls the number on the back of their actual card. The bank confirms there is no problem and asks them to forward the text to its fraud department. The resident changes their online banking password as a precaution, turns on two-factor sign-in, and warns two relatives who received similar texts. No money is lost and no information is given to the scammer.
Steps to take
- Make a list of your most important accounts (email, bank, anything with a card).
- Give each one a unique, long password; consider a password manager.
- Turn on two-factor authentication on your email and bank accounts first.
- Practice checking the real web address behind a link before tapping it.
- Review your social media privacy settings and remove details you would not want public.
- Save IdentityTheft.gov and ReportFraud.ftc.gov, and tell one family member about them.
My online safety check
This checklist is optional and not saved. Copy it to keep a personal note. Do not enter sensitive information.
Go deeper in related modules
Not sure what a word means? Check Business Words Made Simple.
Official provider guides
These independent provider guides offer additional learning resources. Check current details directly with the provider; sharing a link does not imply an official affiliation with P.E.A.C.E.
- CISA: Secure Our World (opens in a new tab)
Official U.S. cybersecurity guidance on passwords, phishing, software updates, and multi-factor authentication, from the Cybersecurity and Infrastructure Security Agency.
- FTC Consumer Advice: How to avoid a scam (opens in a new tab)
The Federal Trade Commission's plain-language guidance on recognizing and reporting common scams, including online and phone fraud.
- IdentityTheft.gov (opens in a new tab)
The federal government's one-stop site to report identity theft and get a step-by-step recovery plan.