Social media and AI tools make it easy to build credible-looking content, which is why checking the source matters. A website can look credible but still be misleading, and judging a site by its looks alone can fool people. Misinformation can be unintentional, an exaggeration or a joke, so a false post is not always a lie told on purpose. Deepfakes are fake images, videos and audio made with AI that can look and sound like a real person. Shocking content designed to make you angry or scared is often made for clicks, not because it is true, and headlines are often written to cause a strong feeling, because that gets clicks. Not everything online is true: people can post false or misleading things, and misinformation can spread. Some things you see online are out of date, wrong or not entirely true.
Professional fact-checkers use a strategy called lateral reading to judge whether a source can be trusted. Lateral reading means leaving an unfamiliar site and opening new tabs to see what trusted sources say about it, and it starts with opening a new tab to search for the website's title, its publisher or the article's author. In lateral reading, other websites such as search engines are tools to judge how reliable a source is, not sources to cite, and when you check a source, you should not rely only on what its creators say about themselves. Look at what other trusted sources say about them, and when a company sells a product, it is not the best judge of that product's benefits, so check who has an interest in the claim. A Stanford study found that 80 percent of undergraduates and 50 percent of doctoral historians who relied on their gut and website appearances were fooled by a misleading website.
The SIFT method has four moves: Stop, Investigate the source, Find better coverage, and Trace claims back to the original. SIFT was developed by Mike Caulfield, a researcher at the University of Washington's Center for an Informed Public. Click restraint means pausing before clicking the top search result so you decide on purpose where to click first. Fact-checking sites can help with step three of SIFT: many are non-profit and check whether claims rest on evidence. Tracing a claim means going back to the original source to see whether a quote or study was fairly represented or taken out of context, and research studies have shown that students in Civic Online Reasoning classrooms improved significantly at judging online sources. A good first step with a surprising post is to stop and notice how it makes you feel before sharing it.
Here is how those attacks work. Phishing is a form of social engineering: attackers use people's trust, rather than computer flaws, to get information. The internet gives a false sense of security because there is no physical interaction, so people may share more than they would face to face. Information can be used for social engineering: someone could use details about your hobbies and friends to pretend to be a trusted friend. Attackers use news events and times of year, such as holidays or disasters, to make their messages look timely. Texting scams are called smishing and voice-call scams are called vishing, and both are kinds of phishing. Caller ID can be spoofed, so a call that seems to come from a trusted number may not. Tell-tale signs of a scam include a claim of authority, urgency, emotion, scarcity and current events.
Poor spelling used to be a clue to a scam, but scams are getting smarter and some even fool experts, so do not rely on spelling alone. A message that pushes you to act right away, with warnings about what happens if you do not, is a common sign of phishing, and a message that asks you to send personal or financial information is a warning sign too. A real bank will never ask you to confirm your account details by email or a phone call it started, and scammers try to quickly gain trust and pressure you into acting without thinking. If a message is suspicious, stop and break contact. If a suspicious message could be real, look up the company's real contact details yourself instead of using the ones in the message. Reporting scam messages helps reduce how many you receive and protects other people.
As of November 2026, password guidance from NIST says services should not force complexity rules or regular password changes, and it also says a password should be changed if there is evidence it has been compromised. NIST also says a password used by itself should be at least 15 characters long, and that websites should accept long passwords of at least 64 characters, with spaces, so that a passphrase works. Guidance from the NCSC says the old advice to fill passwords with random symbols is not helpful, because people cannot remember so many complex passwords, and swapping letters for numbers, like o for 0, does not make a password much stronger because criminals know the trick. A password manager is a program that makes, stores and fills in your passwords, so you only remember one strong one, and password managers have been shown to help people choose stronger passwords, especially when they include a generator.
As of November 2026, passkeys let you sign in with your device's fingerprint, face check or passcode instead of a password, and guidance from the NCSC recommends them wherever offered. Two-step verification asks for a second proof that it is really you, such as a code sent to your phone, in addition to your password. It can stop a criminal who has your password from getting into your account, and the second step can be a code sent by text, a code made by an authenticator app, or your fingerprint or face. Multifactor authentication uses something you know, something you have or something you are. As of November 2026, password guidance from NIST says a code typed in by hand is not phishing-resistant, because a fake site could pass the code on to the real site and sign in. A criminal who gets into your email could read private information, send messages pretending to be you, and reset your other passwords.
Cookies track you only until you delete them, but fingerprinting uses more permanent identifiers such as hardware specifications and browser settings, and browser fingerprinting identifies a device by characteristics like screen resolution and installed fonts, so it keeps working even if you delete cookies. Cookies can be misused to link your visits and searches together, which is a privacy concern, and stronger privacy can cost convenience: stronger tracking protection often makes some websites work less well. Websites ask you about cookies because of a data privacy law, the European GDPR, which became a model for many other laws, and a privacy policy should say how your information will be used and whether it is shared with other organizations. Data brokers are companies that collect and sell personal information about people, including information bought from apps, loyalty programs and retailers, and scammers can sometimes get data sold by data brokers and use it to write more convincing phishing messages.
Posted information can survive removal: saved or cached copies may still exist on other people's machines. As of November 2026, companies and schools sometimes look up applicants online, so what you post can matter later, and most people are judged on authenticity, not perfection. An inappropriate comment or unflattering video can affect your relationships or future career. Think before you post: if you feel upset or angry, wait, because people do not always make good decisions when stressed. Security questions are safer when you answer them with something only you would know, because facts on social media are easy to guess. You can manage your digital footprint by limiting or deleting data browsers hold, deleting old accounts, and using private browsing. A self-audit means looking over your profiles from time to time and removing posts that no longer fit your values.
If someone shares an embarrassing or inappropriate image claiming it is you, tell a trusted adult, and report it to the site. If an online message is mean to you, do not answer it, and tell a trusted adult. Answering a mean message angrily often makes things worse, so take a break first. If you gave your password to a scammer, change it on every account that uses the same password. If bank or card details were shared with a scammer, the bank should be contacted straight away because it can help. If something online upsets a friend, help them and speak up to a grown-up you trust. If something online makes you feel sad, scared or confused, tell a trusted grown-up. Telling a grown-up about something that worried you online is the right thing to do, and you should not be in trouble for telling.
Words to know
- lateral: opening new tabs
- SIFT: four-move method
- fingerprinting: device tracking
- misinformation: false things spreading
