How to stay safe online

The internet can be a wonderful place for connection, information, and support. But it’s also a space where crimes take place. Fraud, harassment, and the sharing of harmful content online are all illegal, and they do happen.

This guide will help you recognise illegal and harmful behaviour online, protect yourself, and know what to do if something goes wrong. Please take a few minutes to read through.

1. Secure your accounts

One of the most common ways criminals access people’s accounts is by stealing or guessing weak passwords. A few simple steps make this much harder.

Use strong, unique passwords

• Use at least 12 characters, longer is better.

• Mix uppercase and lowercase letters, numbers, and symbols.

• Avoid obvious words like “password123”, your name, or your birthday, these are the first things criminals try.

• Never reuse the same password across different accounts.

• Use a password manager (like Nordpass or 1Password) to store and generate strong passwords securely.

Turn on two-factor authentication (2FA) on your accounts

2FA adds a second layer of security. Even if a criminal steals your password, they cannot log in without a second verification step.

• Go to your account settings on sites like Gmail, Facebook, or your bank and look for ‘2FA’ or ‘multi-factor authentication’.

• Use an authentication app (like Google Authenticator or Authy) rather than text messages where possible, it’s more secure.

Check if your data has been leaked

• Visit haveibeenpwned.com to see if your email or passwords have appeared in a known data breach.

• Check your credit report regularly for unfamiliar activity, this can be a sign of identity fraud. Free checks are available at experian.co.uk and clearscore.com

• If you spot anything suspicious, report it to your bank and to Action Fraud through their website actionfraud.police.uk or call 0300 123 2040.

2. Recognise scams and fraud

Fraud is a criminal offence. Online scams including phishing are a form of fraud where criminals pretend to be someone trustworthy (your bank, a delivery company, or even a friend) in order to steal your money or personal information. If you are targeted, you have not done anything wrong. These are organised criminal operations.

Warning signs

• Urgent messages like “Your account is at risk!” or “You’ve won a prize!”

• Poor spelling, odd grammar, or strange email addresses (e.g. paypal1@usa.com).

• Links that don’t match the official website, hover over a link to check where it really leads.

• Requests for your password, bank details, or personal information.

• Offers where you must make a small payment to claim a prize or package, this is always a scam.

How to protect yourself

• Never click links in emails or messages you are unsure about.

• Never send money or bank details to anyone who contacts you unexpectedly, your bank and legitimate companies will never ask for this.

• If you’re unsure whether a message is genuine, contact the company directly using a number from their official website, not the one in the message.

3. Harmful and illegal content

If you come across content you believe is illegal, such as terrorism, child sexual exploitation, or threats of violence, please report it to the police immediately by calling 999.

It’s important to know that sending or sharing certain content is a criminal offence, and you have every right to report it.

• Unsolicited sexual messages or images: Sending explicit content to someone without their consent is illegal.

• Harassment and threatening messages: Online harassment and threatening behaviour are criminal offences under UK law. This includes messages that make you feel unsafe or intimidated.

• Grooming: Where someone builds trust online in order to exploit or abuse another person. This is a serious criminal offence.

• Hate speech: Content that incites hatred or violence against people because of their race, religion, disability, sexual orientation, or other protected characteristics is illegal.

• Illegal content involving children: If you ever come across sexual content involving children anywhere online, report it immediately to the Internet Watch Foundation at iwf.org.uk.

4. How to report suspicious content

Suspicious texts

• Forward to 7726 (spells “SPAM” on your keypad), your mobile provider will investigate and block the number.

• Delete the message afterwards without clicking any links.

Suspicious emails

• Forward to report@phishing.gov.uk, this goes directly to the National Cyber Security Centre (NCSC).

• If the email pretends to be from your bank, forward it to their fraud team too (check your bank’s official website for the address).

• Delete from your inbox and ‘Deleted Items’ folder.

Scam websites or adverts

• Report to the ASA: asa.org.uk/make-a-complaint

• or to the NCSC: ncsc.gov.uk/report-scam-website

Harmful content on social media

• Use the ‘Report’ or ‘Flag’ button on any platform and select a reason (e.g. “Harassment”, “Scam or fraud”, “False information”).

• Do not share or repost harmful content, even to warn others as this spreads it further.

On our Online Community

Use the Flag button on any post or message that concerns you, or submit a Service Desk ticket. We will review and take appropriate action.

5. Browse, shop, and share safely

How you browse, shop, and share personal information online all affect your safety. Criminals create fake websites, fraudulent shops, and use personal details found online to commit identity fraud.

Browsing safely

• Check for ‘https://’ in the address bar, but be aware that fake sites can use HTTPS too, always double-check the full web address.

• Use a trusted browser (Chrome, Firefox, Edge, Safari, or Opera).

• Avoid downloading files or apps from unknown sources.

• Be cautious on public Wi-Fi, avoid logging into bank accounts or shopping sites. Use mobile data or a VPN where possible.

Shopping safely

• Only shop from well-known, trusted sites. Check reviews before buying from an unfamiliar store.

• Pay by credit card or PayPal where possible, avoid direct bank transfers to individuals or unfamiliar businesses.

• If a deal seems too good to be true, it almost certainly is.

Protecting your personal information

• Be careful about sharing your full name, address, date of birth, or financial details online, criminals use these to commit identity fraud.

• Set social media accounts to private and use a username rather than your full name on public sites.

• Do not post photos of sensitive documents like passports, ID cards, or boarding passes.

• Avoid announcing publicly that you are away from home.

6. Keep devices updated and watch out for misinformation

Keep your devices and software updated

Out-of-date software contains security weaknesses that criminals can exploit. Keeping everything updated closes those gaps.

• Turn on automatic updates for your phone, computer, and apps.

• Use a supported operating system (Windows 10/11, macOS, Android, iOS).

• Delete apps you no longer use; old, unmaintained apps can become a security risk.

Spot and avoid misinformation

Not everything online is true. Criminals and others deliberately spread false information to cause confusion or manipulate people, including fake news, misleading health advice, and AI-generated images or videos.

• Cross-check with trusted sources (BBC, NHS, http://Gov.uk , Reuters).

• Check the date and author of any article before sharing it.

• Be sceptical of posts with shocking or sensationalist claims and use fact-checking sites to verify.

• If you spot fake content, use the flag button to report it, don’t share it.

Useful resources

• getsafeonline.org Practical online safety advice

• ncsc.gov.uk/cyberaware National Cyber Security Centre

• actionfraud.police.uk Report fraud and cybercrime

• iwf.org.uk Internet Watch Foundation report illegal content online

• scamvoid.net Check website reputation and safety

Need more help?

If you have any questions about the Online Community, please submit a request through our Service Desk.

 Related articles