Category: Recommendations

By J. Mesa

Your boss emails you. She is stuck in a meeting and needs five $100 gift cards for client gifts. Buy them now, scratch off the backs, and send photos of the codes. You will be reimbursed today. The email came from a stranger, and the money is gone the moment you hit send. December brings a surge of these requests, because buying gift cards looks normal this month.

What is a gift card scam?

A gift card scam is a fraud in which a criminal persuades you to buy gift cards and hand over the numbers and PINs. With those numbers, the criminal spends or resells the balance within minutes.

One rule covers every version: gift cards are for gifts. Anyone who demands payment by gift card is a scammer. No government agency, utility, court, bank, or tech company accepts them.

Why do scammers want gift cards?

• Speed. The value moves the instant you read out the numbers.
• Anonymity. Nobody needs an ID or a bank account to redeem a card.
• No reversal. A gift card lacks the dispute rights of a credit card.
• Availability. Every grocery store and pharmacy sells them.

Criminals turn the balances into cash by buying electronics to resell or by selling the codes at a discount on online marketplaces.

What are the common gift card scams?

• The fake boss. An email or text that appears to come from an owner, a manager, a pastor, or a principal asks an employee to buy cards for clients or staff and keep it quiet.
• Government impersonators. A caller claims to be from the IRS, Social Security, or a court and threatens arrest unless you pay a fine with gift cards.
• Tech support. A pop-up or a caller says your computer is infected and takes payment for the “repair” in gift cards.
• Utility shutoff. A caller says your power goes off in an hour unless you pay now.
• Family emergency. A caller posing as a grandchild or a lawyer needs bail money.
• Romance. An online sweetheart you have never met needs help with an emergency.
• Prizes and sweepstakes. You won, and you owe “taxes” or “fees” first.
• Overpayment. A buyer sends a check for too much and asks for the difference back in gift cards. The check bounces later.

How does the fake boss gift card scam work?

This version targets businesses, schools, churches, and nonprofits.

1. The scammer finds the name of the owner or director on your website, and a list of staff.
2. The scammer creates a free email account with the boss’s name as the display name, or sends a text from an unknown number that opens with “Hi, this is [boss’s name].”
3. The first message is short: “Are you at your desk? I need a quick favor.”
4. Once the employee answers, the request arrives: buy gift cards, keep it confidential, send the codes.
5. The scammer asks for more cards until the employee stops.

It works because employees want to help the boss and because the boss is “in a meeting” and can’t take a call. New employees get targeted most, since scammers watch LinkedIn for job announcements.

What are the warning signs?

• Any request to pay with a gift card
• Urgency, with a deadline measured in minutes or hours
• A request for secrecy, or an instruction to lie to the cashier about why you are buying
• An order to stay on the phone while you shop
• A request to buy cards at several different stores
• A request to photograph or read out the numbers on the back
• An email from the boss that comes from a personal address, or a text from an unknown number

How do I protect my business?

• Write the rule down. The company never buys gift cards on the strength of an email or a text. Purchases follow the normal approval process.
• Verify by voice. Any unusual request for money or cards gets a phone call to a known number, or a walk down the hall.
• Tell every new hire in the first week. Scammers reach new staff within days of a public announcement.
• Tag external email. A banner that marks outside messages exposes a fake boss.
• Have the owner say it out loud: “I will never ask you to buy gift cards. If you get that message, it is not me.”
• Limit what the website gives away. Review whether you need a full staff directory with titles and direct email addresses.
• Cover it in training. See our post on how to spot a phishing email and our cybersecurity training.

How do I protect my family?

Talk about it at the holiday table. Older relatives lose the most, and many have never heard that gift card payment is the mark of a scam. Agree on a simple plan: if a caller demands money, hang up and call a family member before doing anything. Tell the grandparents that a real grandchild in trouble will still be in trouble ten minutes from now, after a callback.

What should I do if I gave a scammer gift card numbers?

Move fast. Minutes matter.

1. Call the gift card company right away and say the card was used in a scam. Ask whether any balance remains and whether they can freeze it. The phone number is on the back of the card or on the company’s website. Apple, Google Play, Amazon, Target, Walmart, and the major prepaid card brands all run fraud lines.
2. Keep the card and the receipt. You need both for the report.
3. Tell the store where you bought the cards.
4. Report it to the FTC at ReportFraud.ftc.gov and to the FBI at ic3.gov.
5. Tell your employer if the request posed as your boss. Others in the company may be getting the same message.
6. Stop responding to the scammer. Expect follow-up contacts that promise to recover your money for a fee. Those are scams too.

Can I get my money back?

Sometimes, if the scammer has not yet spent the balance when you call. Once the funds are used, recovery is unlikely. That is the reason criminals prefer gift cards, and the reason to call the card company before you do anything else.

What is gift card tampering?

A different crime hits honest shoppers. Thieves take cards from store racks, record the numbers and PINs, reseal the packaging, and return the cards to the shelf. When a shopper loads money onto the card, the thief drains it.

Protect yourself when you buy gift cards as gifts:

• Inspect the packaging. Skip any card with a torn, wrinkled, or resealed wrapper, or a scratched PIN cover.
• Pick cards from behind the counter or from the middle of the rack.
• Buy from the retailer’s own website when you can.
• Keep the receipt and give it with the card.
• Tell the recipient to use the card soon.

What should retail staff watch for?

If your business sells gift cards, your cashiers are the last line of defense. Train them to notice a customer who is on the phone while buying, seems frightened or rushed, buys large amounts, or is elderly and buying cards for a brand they would not normally use. A calm question can stop the loss: “Did someone ask you to buy these to make a payment?” Post a warning sign at the rack. Many retailers now do.

Are other payment methods a warning sign too?

Yes. Scammers also demand wire transfers, cryptocurrency, payment apps such as Zelle and Cash App, and cash sent by mail or handed to a courier. Each shares the traits that make gift cards attractive: fast, hard to trace, and hard to reverse. Treat a demand for any of them, from someone you did not contact first, as a scam.

Your next step

Send a two-line message to your staff today: “I will never ask you to buy gift cards by email or text. If you receive that request, call me.” Then make the same promise to your family. For help writing payment verification rules and training your team, see our services or contact Cerberus Cybersecurity.

By J. Mesa

VPN advertisements promise to make you anonymous, block hackers, and protect your identity. A VPN does none of those things on its own. It does one useful job well, and knowing what that job is tells you whether you need to pay for one.

What is a VPN?

A VPN, or virtual private network, is a service that creates an encrypted connection between your device and a server run by the VPN provider. Your internet traffic travels through that encrypted tunnel to the provider’s server and goes out to the internet from there.

How does a VPN work?

Without a VPN, your traffic passes through the local network and your internet provider on its way to a website. Each of them can see which sites you connect to. The website sees your IP address, which reveals your provider and your rough location.

With a VPN turned on:

1. Your device encrypts the traffic before it leaves.
2. The local network and your internet provider see only scrambled data going to the VPN server.
3. The VPN server decrypts the traffic and sends it to the website.
4. The website sees the VPN server’s IP address in place of yours.

You have moved your trust. Your internet provider can no longer see your browsing, and the VPN company now can.

What does a VPN protect you from?

• Snooping on untrusted networks. On hotel, airport, and coffee shop Wi-Fi, a VPN stops the network operator and other users from watching where your traffic goes.
• Tracking by your internet provider. Your provider can’t log the sites you visit.
• Exposure of your IP address. Websites and services see the VPN’s address.
• Location limits. A VPN can make you appear to be in another region.

What does a VPN not protect you from?

This list matters more than the first one.

• Phishing. A VPN delivers a fake sign-in page to you through an encrypted tunnel. You can still type your password into it. See our guide to spotting a phishing email.
• Malware. A VPN does not scan what you download.
• Weak or reused passwords. An attacker with your password signs in from anywhere.
• Tracking by the sites you use. Google, Facebook, and advertisers identify you by your login, your cookies, and your browser, with or without a VPN.
• Data breaches. A VPN has no effect on how a company stores your information.
• Anonymity. The VPN provider knows who you are and can see your traffic. Websites you sign in to know who you are.

Do I need a VPN at home?

For security, most people do not. Nearly every website and app now encrypts its own traffic with HTTPS, the padlock in your browser. Your home network is one you control. A VPN at home adds privacy from your internet provider and little else.

Spend the effort where it counts first: a strong, unique password for each account, multi-factor authentication, and software updates.

Do I need a VPN on public Wi-Fi?

It helps, and the risk is smaller than the ads suggest. Because of HTTPS, a snoop on the coffee shop network can’t read your banking session or your email. The snoop can see which sites you visit, and a fake hotspot can steer you toward a fraudulent page.

A VPN closes those gaps. So does using your phone’s hotspot or cellular data. If you travel often and work from shared networks, a VPN is a reasonable purchase. Our post on staying safe on the go covers the rest.

What is a business VPN?

A business VPN serves a different purpose from the consumer products in the ads. It connects a remote employee’s computer to the company’s private network, so the employee can reach file servers, accounting systems, and other internal resources from home or the road. Your firewall or a dedicated service provides it, and your IT team controls who may connect.

A consumer VPN hides your browsing from the local network. A business VPN extends your office network to an authorized person. Buying consumer subscriptions for your staff does not give them secure access to the office.

How do I secure a business VPN?

A VPN is a door into your network, and attackers know it. VPN devices sit among the most common entry points for ransomware.

• Require multi-factor authentication for every VPN login. A VPN protected by a password alone is one stolen password away from a break-in.
• Patch the VPN device quickly. Vendors release fixes for serious flaws several times a year, and criminals scan the internet for unpatched devices within days.
• Give each person an account. No shared logins. Disable the account the day someone leaves.
• Limit what the VPN reaches. A remote bookkeeper needs the accounting system and nothing else.
• Allow company-managed devices only, where you can. A family computer full of malware should not join the office network.
• Review the logs for logins at odd hours and from unexpected countries.
• Replace hardware the vendor no longer supports.

Do small businesses still need a VPN?

It depends on where your systems live. If your email, files, and accounting all run in cloud services such as Microsoft 365, Google Workspace, and QuickBooks Online, your staff reach them directly over HTTPS, and a VPN adds little. Protect those logins with multi-factor authentication.

If you keep a server, a records system, or network storage in the office, remote staff need a secure way in. A VPN is the traditional answer. Never expose Remote Desktop straight to the internet as a shortcut.

Newer “zero trust” access tools take a different approach. They verify the person and the device, then grant access to one application at a time and not to the whole network. Ask your IT provider whether one fits your size and budget.

How do I choose a consumer VPN?

If you decide to buy one, check these points.

• Independent audits. Look for a published audit of the provider’s no-logs claim by a named outside firm.
• Clear ownership. You should be able to learn who runs the company and where it operates.
• Modern protocols, such as WireGuard or OpenVPN.
• A kill switch that blocks traffic if the VPN connection drops.
• A paid plan from a known provider. Running servers costs money. A free VPN often pays its bills by collecting and selling your browsing data, which defeats the purpose.
• No outsized promises. Be wary of any product that claims to make you anonymous or “unhackable.”

Are free VPNs safe?

Many are not. Studies of free VPN apps have found data collection, advertising trackers, and in some cases malware. A few reputable providers offer limited free tiers supported by their paid customers. Outside of those, avoid free VPN apps, above all on a device that holds work email.

Does a VPN slow down my internet?

Somewhat. Your traffic takes a longer route and gets encrypted along the way. With a good provider and a nearby server, most people notice little difference for browsing and video calls.

Is using a VPN legal?

In the United States, yes. A handful of countries restrict or ban them, so check before you travel. A VPN does not make an illegal act legal, and it may violate the terms of a streaming service.

Your next step

List the systems your staff reach from outside the office and how they connect to each one. For every remote connection that relies on a password alone, add multi-factor authentication this month. Cerberus Cybersecurity reviews remote access as part of our risk and compliance assessments and writes remote work policies your team can follow. Contact us to get started.

By J. Mesa

An email lands in your inbox at 4:45 on a Friday. Your mailbox is full, it says, and you will stop receiving messages unless you sign in now. You click, type your password, and go home. By Monday, a stranger has read three months of your email and sent an invoice to your largest customer. Most break-ins at small businesses begin this way, with one message and one tired person.

What is phishing?

Phishing is a fraudulent message that poses as a trusted sender to trick you into giving up a password, sending money, or opening a malicious file. Email carries most of it. Text messages, phone calls, and social media carry the rest.

How does a phishing attack work?

The attacker wants one of three results.

• Your credentials. The message links to a fake sign-in page for Microsoft 365, Google, your bank, or a shipping company. Whatever you type goes to the attacker.
• Your money. The message poses as a vendor, a boss, or a customer and asks for a payment, a gift card, or a change of bank details.
• Your computer. The message carries an attachment or a link that installs malware, including the kind that leads to ransomware.

What are the warning signs of a phishing email?

1. The sender address does not match the name. The display name says “Microsoft Support,” and the address behind it ends in a domain you have never seen. Click or tap the name to reveal the full address.
2. The domain is close but wrong. Look for swapped or added characters: “rn” in place of “m,” a zero in place of the letter o, or an extra word such as “-secure” or “-billing.”
3. The message creates urgency. Your account closes today. The invoice is overdue. The boss needs it in ten minutes. Pressure exists to stop you from thinking.
4. The request is unusual. A vendor changes its bank account by email. The owner asks for gift cards. Payroll gets a request to move a direct deposit.
5. The link goes somewhere else. Hover over the link on a computer, or press and hold on a phone, and read the real address. A Microsoft sign-in page does not live on a random website.
6. The attachment was not expected. Treat surprise invoices, voicemails, scans, and shipping documents as suspect, above all files that ask you to “enable content” or sign in to view them.
7. The greeting is generic. “Dear customer” from a bank that knows your name.
8. The tone is off. A colleague who writes in short bursts sends three formal paragraphs. Trust that instinct.
9. The message asks for secrets. No legitimate company asks for your password, your verification code, or your full card number by email.

Spelling mistakes used to be a reliable sign. They are less reliable now, because attackers use better tools and copy real company emails word for word. A clean, well-written message can still be a fake.

What are the common types of phishing?

• Bulk phishing. One message to millions of people, posing as a bank, a streaming service, or a delivery company.
• Spear phishing. A message written for one person, using details from LinkedIn, your website, or an earlier breach.
• Whaling. Spear phishing aimed at owners and executives.
• Business email compromise. A message that poses as a boss or a vendor to redirect a payment. It often contains no link and no attachment, which lets it pass through filters.
• Smishing and vishing. The same tricks by text message and by phone.
• Clone phishing. A copy of a real email you received before, with the link or attachment swapped.

Our post on how hackers get in covers the psychology behind these attacks.

How do I check a link safely?

• Hover first, and read the address from right to left. The part just before “.com” or “.org” is the real owner. In “microsoft.com.account-verify.net,” the owner is account-verify.net.
• Do not trust the padlock. Fake sites have them too.
• When in doubt, skip the link. Open your browser and type the company’s address yourself, or use the bookmark you already have.
• Be careful with shortened links and QR codes, which hide the destination.

What should I do when I get a suspicious email?

1. Do not click, reply, or open the attachment.
2. Report it. Use the “Report phishing” button in Outlook or Gmail, and forward it to whoever handles your IT.
3. Verify through another channel. Call the sender at a number you already have. Do not use the phone number in the message.
4. Delete it.

If the message poses as a coworker or a vendor you know, tell that person. Their account may have been hacked, and they may not know yet.

What should I do if I clicked a phishing link?

Speed matters more than embarrassment. Tell your IT contact right away.

• You clicked but entered nothing. Close the page. Run a scan with your security software. Watch the account for a few days.
• You entered a password. Change it at once from a different device. Change it on every other account where you used the same one. Turn on multi-factor authentication. Ask IT to sign out all active sessions and check the mailbox for forwarding rules the attacker may have added.
• You opened an attachment or enabled content. Disconnect the computer from the network and call IT. Do not keep working on it.
• You sent money or bank details. Call your bank immediately and ask for a recall, then report the fraud to the FBI at ic3.gov.

How do I protect my business from phishing?

• Turn on multi-factor authentication for email first, then for banking, payroll, and remote access. A stolen password alone then gets the attacker nowhere.
• Use the email filtering you already pay for. Microsoft 365 and Google Workspace include phishing and attachment protections that many businesses never switch on.
• Tag outside email. A banner that marks messages from outside the company exposes a fake “boss” at a glance.
• Set a payment verification rule. No change to bank details and no new payee without a phone call to a known number and a second approver.
• Use a password manager. It fills passwords only on the real site, so a look-alike page gets nothing.
• Limit what staff post. Job titles, vendor names, and travel plans on public pages help an attacker write a convincing message.
• Make reporting easy and safe. One button or one address. Thank the people who report, including the ones who clicked first.

Does phishing training work?

Yes, when you repeat it. A one-hour lecture once a year fades within weeks. Short sessions through the year, paired with simulated phishing emails, build the habit of pausing before a click. Track two numbers: how many people click, and how many people report. The second number matters more, because one fast report lets you warn everyone else.

Treat a failed test as a coaching moment. Staff who fear punishment hide their mistakes, and a hidden click does the most damage. Our cybersecurity training covers phishing for every role, from the front desk to the owner.

Can email filters stop all phishing?

No. Filters catch most bulk phishing. Targeted messages, messages sent from a real hacked account, and messages with no link or attachment still arrive. Your people are the last check, so give them the knowledge and the permission to slow down.

Your next step

Forward this list of nine signs to your staff, and ask each person to find the “Report phishing” button in their mail program today. To build a training program and a payment verification policy that fit your business, see our services or contact Cerberus Cybersecurity.

By J. Mesa

Social media is great for catching up with friends, watching funny pet videos, and picking up a kådu recipe or two. Like any busy place, it has a few shady characters. They want your personal information, your money, or your account.

You can outsmart them. Here are ten habits that keep you safe, plus what to do if something goes wrong.

What are the most common social media scams?

• Fake friend or follow requests from copied or invented profiles
• Phishing messages that link to fake login pages
• Marketplace and shopping scams with deals that never ship
• Giveaway and prize scams that ask for a fee or your details
• Romance and investment scams that build trust over weeks, then ask for money
• Impersonation of someone you know, asking for urgent help

Every one of them works by getting you to trust the wrong person.

1. How do I spot a fake friend request?

Don’t accept requests from people you don’t know. Check the profile first.

• Few photos, or photos that look like stock images
• An account created in the last few weeks
• No friends in common
• A second request from someone who is already your friend

That last one means a scammer copied your friend’s profile. Decline it, and tell your friend through another channel.

2. What do phishing messages look like?

Scammers send private messages that look real. Be careful with any message that:

• Pressures you. “Act now” and “limited time offer” are meant to stop you from thinking.
• Has odd spelling or grammar. Real companies proofread.
• Contains a link. Hover over it on a computer, or press and hold on a phone, to see the real address before you open it.
• Asks for your password or a code. Real platforms never ask for these in a message.

3. Should I trust a deal that looks too good?

No. A price far below normal, a seller who wants payment by gift card or wire, or a buyer who “overpays” and asks for a refund are all scams. Pay through the platform’s own checkout, which offers buyer protection.

4. How do I check before I share?

False stories travel fast. Before you share a post that makes you angry or afraid, look for the same story on a news source you trust. If you can’t find it, don’t pass it on.

5. Why should I avoid clickbait?

Headlines built to shock often lead to sites that install malware or collect your data. If a headline looks too wild to be true, it is. Skip the link.

6. How do I lock down my profile?

• Privacy settings. Control who sees your posts, your friend list, and your contact details. Set them to friends only.
• Passwords. Use a strong, different password for each account. A password manager helps.
• Two-factor authentication. Turn it on. It works like a second lock on your door.
• Personal details. Keep your birthday, address, and phone number off your public profile.

7. How much sharing is too much?

Posting where you are in real time tells strangers when your house is empty. Details such as your pet’s name, your school, and your hometown answer common security questions. Share trip photos after you get home, and keep the answers to security questions to yourself.

8. Are quizzes and giveaways safe?

Be careful. “Which character are you?” quizzes often ask for the same facts banks use to verify you. Giveaways with huge prizes collect personal details or ask for a “shipping fee.” Research any contest before you enter, and never pay to claim a prize.

9. What is like-farming?

Scammers post content designed to collect likes and shares, such as “Share if you love your mom.” Once the page has a large audience, they change it to promote scams or sell it. Don’t like or share suspicious posts to help someone gain followers.

10. How do I report a scam or a fake account?

Every major platform has a report button on profiles, posts, and messages. Use it. Reporting gets fake accounts removed and protects the next person. You can also report fraud to the Federal Trade Commission at reportfraud.ftc.gov.

What should I do if my account gets hacked?

1. Change your password right away. If you can’t log in, use the platform’s account recovery page.
2. Log out of all other devices in the security settings.
3. Turn on two-factor authentication.
4. Check for changes: a new email address or phone number on the account, new posts, new messages.
5. Tell your friends, so they ignore messages the attacker sent as you.
6. Change the password on any other account that used the same one.

What should I do if I sent money to a scammer?

Act fast. Call your bank or card company and ask to stop or reverse the payment. Report the scam to the platform, to reportfraud.ftc.gov, and to the FBI at ic3.gov. Keep screenshots of the profile and the messages. The sooner you report, the better your chance of getting money back.

How do I help kids and older relatives stay safe?

Teach your friends and family, and pay special attention to our Manåmko’. Scammers target older adults with fake family emergencies and prize notices.

• Agree that any request for money gets a phone call to confirm, on a number you already have.
• Set up privacy settings and two-factor authentication on their accounts with them.
• Remind them that a real friend will not mind waiting while they check.

For kids, keep accounts private, know who they talk to, and make it easy for them to tell you when something feels wrong.

Is it safe to log in to other sites with my social media account?

It is convenient, and it ties those sites to one account. If someone takes over that account, they reach everything connected to it. Protect it with a strong password and two-factor authentication, and review the list of connected apps in your settings once or twice a year. Remove the ones you no longer use.

What habits keep me safe over time?

• Trust your gut. If something feels off, ignore the message or block the person.
• Stay updated. Platforms change their security settings often. Check yours a few times a year.
• Spread the word. The more people who know these tricks, the fewer victims scammers find.

Your next step

Spend ten minutes today on your privacy settings and turn on two-factor authentication. If your business uses social media, your team needs these skills too. Cerberus Cybersecurity teaches them in our cybersecurity training. Contact us to set up a session.

By J. Mesa

Most security incidents don’t start with a brilliant hacker. They start with a habit: a reused password, a skipped update, a quick click. The same seven habits show up again and again, in homes and in businesses.

Here is each one, why it puts you at risk, and how to fix it.

1. Why are weak passwords dangerous?

Passwords such as “password” and “123456” sit at the top of every attacker’s list. Software tries them in seconds.

The fix: Use a long passphrase made of several unrelated words. Words from another language make it harder to guess. Something built around a phrase like “Biba Mes CHamoru” means a lot to me and nothing to a cracking tool. Don’t copy an example from a blog post, mine included. Make your own, and use a different one for every account. A password manager keeps track of them.

2. Is it safe to share passwords?

No. Sharing a streaming login to catch the latest episode of a show feels harmless. Once you share a password, you no longer control where it goes. The other person may reuse it, save it somewhere unsafe, or fall for a phishing email.

The fix: Give each person their own account. For family services, use the plan’s built-in sharing feature. At work, never share a login. If several people need the same system, give each one a separate account, so you can see who did what and remove access when someone leaves.

3. Is public Wi-Fi safe?

Public Wi-Fi in an airport, hotel, or café is a shared network. An attacker on it can set up a fake hotspot with a similar name or try to intercept traffic that is not encrypted.

The fix:

• Confirm the network name with staff before you join
• Use your phone’s hotspot for banking and work
• Use a virtual private network (VPN) when you handle sensitive or business data while traveling
• Turn off automatic connection to open networks

4. What happens if I click a suspicious link?

Phishing is a common way for attackers to get into accounts. A link can lead to a fake login page that captures your password, or it can install malware on your device.

The fix: Check the address before you click. Don’t open attachments you did not expect. If you doubt an email, call the business or person using a phone number from their official website. Do not use the contact details in the email.

If you already clicked, change the password for that account from a different device and tell your IT contact.

5. Why do software updates matter?

Updates carry security patches that fix known flaws. Skip them, and attackers can use those flaws against you. Updates take time and interrupt your day. They also close the holes that criminals are using right now.

The fix: Turn on automatic updates for your operating system, browser, apps, and phone. Restart when asked. Replace devices that no longer receive updates.

6. Why should I change default settings?

Many routers, cameras, and other devices ship with a standard username and password such as “admin” and “admin.” Lists of those defaults are published online. Attackers scan the internet for devices that still use them.

The fix: Change the default username and password on every device as soon as you set it up. Start with your home or office router. Turn off features you don’t use, such as remote management.

7. What if I don’t back up my data?

Without a backup, a ransomware attack, a failed drive, or a stolen laptop means the data is gone.

The fix: Back up to an external drive or cloud storage. Follow the 3-2-1 rule: three copies, two types of storage, one offsite. Test that you can restore a file. It is better to have a backup and not need it than the alternative.

What other bad habits should I watch for?

• No multi-factor authentication. A second step at login blocks most attacks that use stolen passwords. Turn it on for email and banking first.
• Oversharing online. Birthdays, pet names, and travel plans help attackers guess security answers and write convincing scams.
• Using an administrator account for daily work. Malware runs with the rights of the account that opens it. Use a standard account for everyday tasks.
• Ignoring old accounts. Close accounts you no longer use. Each one is a breach waiting to happen.

Which habit should I fix first?

Start with passwords and multi-factor authentication. Stolen and weak passwords open more accounts than any other cause. Then turn on automatic updates, which takes a few minutes and keeps working without you. Backups come third.

How do I change habits across a whole team?

• Make the safe way the easy way. Provide a password manager and turn on automatic updates for everyone.
• Explain the reason behind each rule. People follow rules they understand.
• Train in short sessions through the year.
• Praise people who report a suspicious email or admit a mistake.
• Write the rules into a short policy that new hires read on day one.

How do I know if a bad habit already caused harm?

• Search your email address at haveibeenpwned.com to see if it appears in a breach
• Review the login history on your email and bank accounts
• Look for email forwarding rules you did not create
• Check that your backups ran

If you find a problem, change the password, turn on multi-factor authentication, and tell anyone who may be affected.

Are these habits a problem for businesses too?

Yes, and the stakes are higher. One employee’s reused password can expose a customer database. One unpatched server can stop operations for a week. The same seven fixes apply, and a business should add written policies and regular training.

Your next step

Pick the habit from this list that describes you and fix it today. Cybersecurity is a priority for everyone, at home and at work. If you want your whole team to build better habits, Cerberus Cybersecurity offers cybersecurity training for every audience. Contact us to learn more.

By J. Mesa

Each new year brings new technology and the same old threat. Phishing sounds like a tired topic. It keeps coming up because it still works, and criminals reach for it first.

This guide shows you how to recognize a phishing message, the forms it takes, and what to do when one lands in your inbox.

What is phishing?

Phishing is a scam where a criminal sends a message that appears to come from a source you trust, such as a bank, a delivery service, a coworker, or a vendor. The goal is to get you to click a link, open a file, share a password, or send money.

Why does phishing still work?

• It targets people. Software can be patched. A busy person in a hurry can be rushed.
• It is cheap. A criminal can send thousands of messages for almost nothing.
• It looks better every year. Attackers copy real logos and layouts, and writing tools remove the spelling mistakes that used to give them away.
• One click is enough. A single response out of thousands pays for the campaign.

What are the types of phishing?

• Email phishing. Mass messages that imitate well-known companies.
• Spear phishing. A message written for one person, using details about their job or life.
• Business email compromise. A message that poses as an owner, executive, or vendor and asks staff to send money or change bank details.
• Smishing. Phishing by text message.
• Vishing. Phishing by phone call, often with a fake caller ID.
• QR code phishing. A code that leads to a fake login page.

What are the red flags of a phishing email?

1. You didn’t expect it. Be wary of any unsolicited message that asks for information or payment.
2. It creates urgency. “Your account closes in 24 hours” is meant to stop you from thinking.
3. It asks for personal information. Legitimate companies don’t ask for passwords or card numbers by email.
4. The sender address is off. Look at the full address, not the display name. Watch for swapped letters and odd domains.
5. The link doesn’t match. Hover over it to see where it goes.
6. It has an unexpected attachment. Invoices, shipping notices, and “scanned documents” you didn’t ask for are common lures.
7. The greeting is generic. “Dear customer” from a company that knows your name is a warning.
8. The request is unusual. Gift cards, wire transfers, and secrecy are scam hallmarks.
9. Something feels wrong. Odd tone, odd timing, or an odd request from someone you know deserves a second look.

Spelling and grammar errors are still a sign. Their absence proves nothing.

How do I verify a sender?

Before you respond, confirm who sent the message. Contact the company or person through a phone number or address you already know to be real. Don’t use the contact details in the message, and don’t reply to it.

For any request that involves money or a change to payment details, make a phone call. This one habit stops most business email compromise.

What should I do if I receive a phishing email?

1. Don’t click, reply, or open attachments.
2. Report it with your email program’s “Report phishing” button.
3. At work, tell your IT contact so they can warn others.
4. Delete it.

What should I do if I clicked a phishing link?

Act right away. Speed matters more than embarrassment.

1. Disconnect the device from the network if you opened a file or installed something.
2. Change the password for the affected account from a different device, and for any account that shares it.
3. Turn on multi-factor authentication.
4. Tell your IT contact or manager at work.
5. Call your bank if you entered payment details or sent money.
6. Run a security scan on the device.
7. Report it to the FBI at ic3.gov and to the Federal Trade Commission at reportfraud.ftc.gov.

How do I protect my business from phishing?

• Train your team. Use real examples. Repeat through the year.
• Run simulated phishing tests and use the results to teach, never to punish.
• Turn on multi-factor authentication for email. It limits the damage when a password is stolen.
• Use email filtering and turn on the security features your email provider offers.
• Set a payment verification rule. Any change to bank details gets a phone call to a known number.
• Make reporting easy. One button, no blame.

How does my online information help phishers?

Attackers research their targets. Your social media tells them your employer, your job title, your coworkers, and where you spent the weekend. They use those details to write messages that sound real.

• Keep your home address and phone number off public profiles
• Limit what you share about your role and your workplace
• Use strong, unique passwords for every account

You would be surprised how much a criminal can learn from a public profile.

Does multi-factor authentication stop phishing?

It stops most of it. If you give away a password, the attacker still needs the second step. Some attacks trick people into approving a login prompt or typing a code into a fake page, so never approve a prompt you did not start. Security keys and passkeys resist phishing best, because they only work on the real website.

Can phishing happen by phone or text?

Yes. A text about a missed delivery or a call from “your bank’s fraud team” follows the same pattern as a phishing email. Hang up, and call the number on your card or the company’s official website.

How do I teach my family?

Share three rules: don’t click links in unexpected messages, never give a code or password to anyone who contacts you, and confirm any request for money with a phone call.

What does a real example look like?

Picture an email from “Microsoft 365 Support” that says your mailbox is full and will stop receiving mail today. A button reads “Increase storage.” The sender’s address ends in an unfamiliar domain, and the button leads to a login page that looks right and sits at the wrong web address. That one message shows urgency, a mismatched sender, and a mismatched link.

Your next step

Stay informed about the latest phishing methods, and teach yourself and your team how to spot them. Cerberus Cybersecurity offers training and awareness programs that use real examples and hands-on practice. Contact us to see how we can help your organization. Stay alert, stay safe, and keep your digital life secure.