Stay safe online. No tech knowledge needed.

A simple guide to the most common online dangers and exactly what to do about them. Start with the basics, then go deeper whenever you want.

Start with the basics I think I've been hacked
Beginner Always visible. Simple steps for everyone.
Intermediate Open "Go deeper" boxes.
Expert Technical detail inside the boxes.

Start Here: The 6 Golden Rules

If you only read one part of this site, read this. These rules stop most online attacks.

  1. 1. Stop and think before you click

    Scammers want you to act fast. If a message says "urgent", "your account will be closed" or "you've won", pause. Real companies do not rush you.

  2. 2. Don't trust links you didn't ask for

    If a link arrives by message, email or pop-up, don't tap it. Instead, open the official app or type the website address yourself.

  3. 3. Never open files from unknown sources

    Even if a friend sends it, ask: "Did you really send this?" Friends' accounts can be hacked. Only install apps from the official app store.

  4. 4. Use a different strong password for each account

    Use a long phrase (4 random words is great). A password manager remembers them for you.

  5. 5. Turn on two-step login (2FA)

    It sends a code to your phone when you log in. Even if someone steals your password, they can't get in. Never share this code with anyone.

  6. 6. Keep your phone and computer updated

    Updates fix security holes. Turn on "automatic updates" and you're protected without lifting a finger.

Quick test: Is this link safe?

  1. Did I expect this message?
  2. Is it making me feel scared, rushed or excited?
  3. Does the web address look exactly right? (paypal.com is real, paypa1-secure.com is fake.)
  4. When in doubt: don't click. Go to the official site yourself.

The Main Threats

Tap a topic to see what it is, how to spot it, and what to do.

Scams & Fraud

What it is: Someone tricks you into giving them money or information by pretending to be someone you can trust.

Common types

  • Prize scams: "You won a lottery you never entered."
  • Fake support: A pop-up or call says your computer is infected and you must pay or install something.
  • Romance scams: A stranger builds a relationship, then asks for money.
  • Job scams: Easy work from home, but you must pay a "fee" first.
  • Payment scams: "Accidentally sent you money, please send it back" or a request to scan a QR code to receive money (you never need to scan or enter a PIN to receive money).

What to do

  • Never pay to receive a prize or a job.
  • Never share OTPs, PINs or passwords. Real banks never ask.
  • Hang up and call the company on its official number.
  • Ask a family member before sending money to anyone new.
Go deeper Intermediate

Most scams use social engineering: they attack human emotions (fear, greed, love, urgency) instead of computers. Common red flags: payment by gift card, crypto or bank transfer; pressure to keep it secret; a story that changes when you ask questions. Reverse-image-search profile photos to spot fake profiles, and search the scam's wording online. Chances are others have reported it.

Phishing

What it is: A fake email, text or website that looks real, designed to steal your passwords or bank details.

Spot the fake: an example email

  1. Sender address is almost right (the number 1 instead of "l").
  2. Urgent threat to make you panic.
  3. Generic greeting: they don't know your name.
  4. Asks you to click and "verify" immediately.
  5. The button's real destination is hidden. Hover over it (or long-press on a phone) to see the true address.
  6. Spelling and grammar mistakes.

What to do

  • Don't click. Open the official app or type the website yourself.
  • Report it as phishing/spam, then delete it.
  • If you already entered a password, change it now (see "I Think I've Been Hacked").
Go deeper Intermediate Expert
  • Variants: smishing (SMS), vishing (voice calls), spear phishing (targeted at you personally), quishing (malicious QR codes).
  • Lookalike domains: homograph attacks use characters from other alphabets (e.g. Cyrillic "а" instead of Latin "a"). Check the domain after the last dot before the first single slash: in https://login.bank.example.com/ the real domain is example.com, not bank.
  • Email headers: the "From" name can be faked. Check Return-Path and the SPF/DKIM/DMARC results in "Show original" to see whether the sender is authenticated.
  • Passkeys and hardware security keys are resistant to phishing, because they only work on the genuine website.

Malware (Viruses & Bad Software)

What it is: Harmful software that can steal your data, spy on you, lock your files or take over your device.

Real example: the "free subscription" file

A hacked account sends everyone in its contact list a file ending in .apk promising a free streaming subscription. On Android, installing it can give attackers access to messages, contacts and banking apps. iPhones can't run .apk files, but that is luck, not a safety plan. Scammers also use fake links and other file types.

How you get infected

  • Opening attachments or files you didn't expect, even from friends.
  • Downloading "free" cracked software, games or movies.
  • Installing apps from outside the official app store.
  • Clicking fake pop-ups ("Your device has a virus!").

What to do

  • Install apps only from Google Play or the App Store.
  • Message the sender on another channel: "Did you send this?"
  • Never allow "install from unknown sources" on Android.
  • Keep your device updated and use built-in protection (Google Play Protect, Windows Security).
  • Close a scary pop-up through the browser's tab, not by clicking inside it.
Go deeper Intermediate Expert
  • Types: ransomware (encrypts files for payment), spyware/stalkerware, trojans (pretend to be useful software), keyloggers, botnets, infostealers (take saved browser passwords and cookies).
  • Dangerous extensions: .apk, .exe, .msi, .scr, .bat, .js, .vbs, .lnk, and double extensions like invoice.pdf.exe. Turn on "show file extensions" in Windows.
  • Check a file: compare its SHA-256 hash with the publisher's, or scan it at VirusTotal. A clean scan lowers risk but does not guarantee safety, especially for brand-new malware.
  • Test unknown software in a virtual machine or sandbox, never on your main system.
  • Back up (3-2-1 rule): 3 copies, on 2 types of storage, 1 offline or off-site. Backups are the best defence against ransomware.

Identity Theft

What it is: Someone uses your personal details (name, ID numbers, bank info) to open accounts, borrow money or pretend to be you.

Warning signs

  • Bills, loans or accounts you don't recognise.
  • Unexpected password-reset emails or login alerts.
  • Being refused credit for no clear reason.

What to do

  • Share ID numbers only when truly required, and only on official sites.
  • Don't post your birthday, address, ID documents or tickets publicly.
  • Check bank statements regularly.
  • Shred or black out documents with personal details before throwing them away.
Go deeper Intermediate Expert
  • Check whether your email appeared in a data breach at haveibeenpwned.com, and change reused passwords.
  • In countries with credit bureaus, consider a credit freeze so no one can open credit in your name.
  • Use email aliases or separate emails for banking, shopping and social media to limit damage from one breach.
  • Be careful with SIM-swap fraud, where attackers take over your phone number to intercept codes. Ask your carrier for a SIM lock/port-out PIN.

Cyberbullying

What it is: Using messages, posts, photos or group chats to hurt, threaten, embarrass or exclude someone.

If it's happening to you

  • Don't reply or fight back. It often makes things worse.
  • Save evidence: take screenshots with names, dates and links.
  • Block the person and report them on the platform.
  • Tell someone you trust: a parent, teacher, friend or counsellor. You don't have to handle it alone.

If you see it happening to someone else

  • Don't share, like or join in.
  • Check in with the person privately and support them.
  • Report the content.
Go deeper Intermediate

Forms include harassment, doxxing (publishing private details), impersonation with fake accounts, "outing", exclusion from group chats, and sharing private images without consent. Serious threats, blackmail or sexual content involving minors are crimes: keep the evidence and report to the police or your country's cybercrime service. If you're struggling emotionally, please speak to a trusted adult or a local helpline.

Privacy

What it is: Controlling who can see your information, photos and location.

What to do

  • Set social media accounts to private and review who can see your posts.
  • Check app permissions: does a torch app really need your contacts?
  • Avoid banking or entering passwords on public Wi-Fi.
  • Don't post your live location or holiday plans publicly.
Go deeper Intermediate Expert
  • Photos can contain EXIF metadata (GPS location, device). Most big platforms strip it, but sending the original file might not.
  • A VPN hides your traffic from the local network and your location from sites, but it doesn't stop phishing or malware, and you're trusting the VPN company instead. Pick a well-audited provider.
  • Use privacy-respecting browser settings and review which sites hold cookies and tracking permissions.

Protect Yourself: Step by Step

Make a strong password

  1. Pick 4 or more random words: purple-bicycle-ocean-lamp.
  2. Make it different for every important account (email, bank, social media).
  3. Don't use names, birthdays or "123456".
  4. Store them in a password manager so you only remember one.
Go deeper Expert

Length beats complexity: each extra character multiplies the guesses an attacker needs. Reusing passwords enables credential stuffing: attackers try leaked passwords on other sites. Prefer passkeys where offered.

Turn on two-step login (2FA)

  1. Open the Security settings of your email first (it unlocks everything else).
  2. Choose "2-Step Verification" or "Two-factor authentication".
  3. Prefer an authenticator app over SMS if you can.
  4. Save the backup codes somewhere safe.
  5. Repeat for banking and social media.
Go deeper Expert

SMS codes can be intercepted via SIM swapping. Authenticator apps (TOTP) are better and hardware keys / passkeys (FIDO2) are best. Real-time phishing sites can still relay one-time codes, so never type a code into a site you reached through a link.

Browse and shop safely

  • Look for https:// and the padlock. It means the connection is private, but not that the site is honest.
  • Shop on sites you know. If a price looks too good to be true, it is.
  • Pay by card or a trusted payment service, never by gift card or direct transfer to a stranger.
  • Download software only from the official website.

Safe messaging

  • Be suspicious of forwarded "free gift" or "urgent help" messages.
  • If a friend suddenly asks for money or sends a strange link, call them to check.
  • Turn on two-step verification in your messaging app.
  • Never share the 6-digit code your messaging app sends you.

I Think I've Been Hacked or Scammed. What Now?

Stay calm. Acting quickly helps. Choose what happened:

I clicked a suspicious link
  1. Close the page. Don't enter any information.
  2. If you did enter a password, change it right away (and anywhere you reused it).
  3. Run a security scan on your device.
  4. Watch your accounts for strange activity over the next few weeks.
I opened or installed a strange file or app
  1. Turn on airplane mode or disconnect from Wi-Fi.
  2. Uninstall the app (Settings → Apps) and run a scan.
  3. From a different, clean device, change your email, bank and social media passwords.
  4. Contact your bank if you use banking apps on that device.
  5. If problems continue, back up photos and contacts, then do a factory reset.
My account was hacked
  1. Use "Forgot password" to regain access.
  2. Set a new, unique password and turn on 2FA.
  3. Log out all other devices (in security settings).
  4. Warn your contacts: tell them not to open anything you sent.
  5. Check your email's forwarding rules and recovery details for changes.
I sent money or shared bank details
  1. Call your bank immediately (use the number on your card) and ask to block the card or transaction.
  2. Report to your national cybercrime service (see below).
  3. Keep screenshots, messages and receipts as evidence.
  4. Don't pay "recovery agents". They are usually a second scam.
I shared a code (OTP) or PIN
  1. Call your bank/service provider at once and tell them.
  2. Change the PIN and password.
  3. Check recent transactions and report any you don't recognise.

Where to report (examples)

  • India: cybercrime.gov.in or helpline 1930
  • United States: reportfraud.ftc.gov and ic3.gov
  • United Kingdom: Action Fraud (actionfraud.police.uk)
  • Elsewhere: search "report cybercrime" + your country, and contact your bank.

Contact details can change, so check the official site for your country.

Test Yourself

Five quick questions. See how safe you already are.

About This Guide

Frope was created as an MYP Personal Project to help people of all digital-literacy levels become more confident and responsible internet users. The guide is layered: the basics are for everyone, and the "Go deeper" boxes expand on each topic.

Sources and further reading

  • Kaspersky Resource Center
  • Malwarebytes Cybersecurity Basics
  • UNESCO: Digital literacy definition
  • Gitnux: Global internet-access statistics

Some of these sources belong to security companies, so I cross-checked them against each other. This guide gives general advice, not professional or legal advice.

Feedback & Contact

Have a suggestion, spotted something unclear, or want to share what helped? Your feedback helps improve Frope.

Email fropeonline@gmail.com or write your feedback below.