Staying Safe Online: A Guide to Protecting Your Digital Life

A plain-English guide to protecting your accounts, devices and money online, from password managers and passkeys to data breach alerts and spotting scams.

Protecting Your Digital Life

Banking, shopping, health records, photos and messages to family now all live behind online accounts, and criminals know it. You don’t need to be a technical expert to make yourself a much harder target. The steps below, most of them recommended by the National Cyber Security Centre (NCSC), take an afternoon to set up and protect against the attacks that catch most people out.

Cyber attacks are the most likely emergency in Gloucestershire’s Community Risk Register. If something has already gone wrong, see how to report fraud, scams and cyber crime.

1. Secure Your Email First

Your email account is the key to everything else, because it’s where password reset links are sent. If someone gets into your email, they can get into your bank, shopping and social media accounts too. Give it a strong password that you use nowhere else, and turn on two-step verification before anything else.

2. Use a Password Manager

Reusing passwords is the biggest risk most people take. When one site is breached, criminals try the same email and password on hundreds of others. A password manager creates a different strong password for every site, remembers them all, fills them in for you and syncs them between your phone and computer. Many will also warn you if a saved password turns up in a breach.

The one built into your phone or web browser is a good start. Standalone apps add features such as sharing passwords safely with family. Whichever you choose, protect it with a long password made of three random words and two-step verification.

3. Turn On Two-Step Verification

Two-step verification (2SV), also called multi-factor authentication (MFA), asks for a second proof that it’s you, such as a code from an app or a text message, as well as your password. It means a stolen password on its own isn’t enough to get into your account. Turn it on for your email, bank, social media and shopping accounts. An authenticator app is more secure than codes sent by text, but any second step is far better than none.

Never read out or forward a verification code to anyone who contacts you, even if they say they’re from your bank or the police. Your bank will never ask for one.

4. Switch to Passkeys Where You Can

A passkey replaces your password with the fingerprint, face scan or PIN you already use to unlock your phone or computer. There’s nothing to remember or type, and nothing for a fake site to steal, which makes passkeys much harder to phish than a password and a code. Google, Apple, Microsoft, Amazon, PayPal and a growing number of banks and shops offer them: look for “passkey” or “sign in without a password” in an account’s security settings. The NCSC now says passkeys should be the default way for people to sign in.

5. Find Out if Your Details Have Been Leaked

Data breaches are common, and your email address is probably already in one. Have I Been Pwned, a free service run by security researcher Troy Hunt, lets you search for your email address across billions of breached records and see which breaches it appeared in. Sign up for its alerts to get an email if your address turns up in a new breach.

If you find yourself in a breach, change that site’s password, and anywhere else you used the same one, then turn on two-step verification. Watch out for scam emails that quote real details from the breach to seem genuine.

6. Keep Everything Updated

Updates fix security holes that criminals are already using. Turn on automatic updates for your phone, tablet, computer, apps and web browser, and install them promptly when asked. When a device is too old to get updates any more, it’s time to replace it, or at least stop using it for banking and email.

7. Back Up What Matters

Photos, documents and other files you couldn’t replace should be backed up automatically, to a cloud service or an external drive kept unplugged when not in use. A backup means ransomware, a lost phone or a broken laptop is an inconvenience rather than a disaster.

8. Learn to Spot a Scam

Phishing, a message or call that tricks you into handing over details or money, is the most common cyber attack by far. Scams can arrive by email, text, phone call, social media or online adverts, and they often look professional. The warning signs are nearly always the same:

  • Too good to be true: a prize, refund, investment return or bargain you weren’t expecting.
  • Urgency: your account will be closed, a parcel returned or a fine raised unless you act now.
  • Authority: the message claims to be from your bank, HMRC, the police, a delivery firm or a well-known brand.
  • Unusual payment: a request to pay by bank transfer, gift cards or cryptocurrency, or to move money to a “safe account”.
  • Secrecy: you’re told not to tell your bank or family.

If in doubt, stop. Don’t click the link, call the number given or reply. Contact the organisation using a number or site you already know, or call 159 to be put through to your bank. The national Take Five to Stop Fraud campaign sums it up as stop, challenge, protect.

9. Help Family and Friends

Older relatives, children and anyone new to the internet are often targeted. Help them set up a password manager and two-step verification, agree that you’ll always check with each other before sending money in response to a message, and consider a family code word to prove it’s really you if someone claims to be a relative in trouble.

If Something Goes Wrong

  • Lost money or shared bank details: call your bank immediately, or 159.
  • Report fraud and cyber crime to Action Fraud on 0300 123 2040 or online, and suspicious texts to 7726. Our cyber security page lists every way to report.
  • Change the password on any account you think has been accessed, and on any other account that used the same password.
  • Keep a note of what happened, including dates, messages and payment details.

Frequently Asked Questions

Is the Password Manager in My Browser Good Enough?

  • Yes, for most people. The password managers built into Apple, Google, Microsoft and the main web browsers create strong passwords, sync between devices and warn about breached passwords. What matters most is using one, with a different password for every site.

What’s the Difference Between Two-Step Verification and a Passkey?

  • Two-step verification adds a second check on top of your password. A passkey replaces the password altogether, using your device’s fingerprint, face scan or PIN. Passkeys are harder to phish because there’s no password or code to hand over.

Is Have I Been Pwned Safe to Use?

  • Yes. It’s a long-running free service used by individuals, companies and governments. It shows which breaches an email address appeared in, not the passwords themselves.

My Email Address Is in a Data Breach. What Should I Do?

  • Change the password for the breached site and anywhere you reused it, turn on two-step verification, and be wary of messages that mention the breached site or quote your details. Being in a breach doesn’t mean your accounts have been accessed.

How Can I Tell if a Message Is Really From My Bank?

  • Assume it isn’t until you’ve checked. Don’t use the contact details in the message. Call the number on the back of your card or on the bank’s own site, or call 159. Banks will never ask you to move money to a safe account or to share a verification code.

About This Page

Last reviewed 24 October 2026. Spotted something out of date? Let us know.