Phishing is a form of social engineering. Attackers use people's trust, rather than computer flaws, to get information. Phishing attacks use email or malicious websites to ask for personal information while posing as a trustworthy organization. The internet gives a false sense of security because there is no physical interaction. So people may share more than they would face to face. Information you post about yourself can make phishing messages more convincing. Someone could use details about your hobbies and friends to pretend to be a trusted friend. So think about what you and others post.

A scam message may claim to come from an authority, and it may push you to hurry. It may play on your emotions, suggest that a chance is running out, or lean on current events. A message that pushes you to act right away is a common sign of phishing. It warns about what happens if you do not. A message that asks you to send personal or financial information is a warning sign too. Poor spelling used to be a clue to a scam. But scams are getting smarter and some even fool experts, so do not rely on spelling alone.

Attackers use news events and times of year, such as holidays or disasters, to make their messages look timely. Texting scams are called smishing and voice-call scams are called vishing, and both are kinds of phishing. Caller ID can be spoofed, so a call that seems to come from a trusted number may not. QR codes can be used in scam emails, so be careful about scanning a QR code that comes in an email. A real bank will never ask you to confirm your account details by email or a phone call it started.

Phishing messages are often made to look like they come from a person or company you trust. Scammers try to quickly gain trust and pressure you into acting without thinking. If a message is suspicious, stop and break contact. If you think a message might be a scam, do not click its links or open its attachments. If a suspicious message could be real, look up the company's real contact details yourself. Do not use the ones in the message. Reporting scam messages helps reduce how many you receive and protects other people.

A strong password is long, random and different for each account. Three random words joined together can make a password that is long enough and strong enough. Your email password is especially important, because an email account can be used to reset the passwords of your other accounts. Two-step verification asks for a second proof that it is really you, such as a code sent to your phone, in addition to your password. Start by turning on two-step verification for your email, because email can reset your other accounts.

Posted information can survive removal: saved or cached copies may still exist on other people's machines. The default settings on some sites let anyone see your profile. You can change them to limit who can. Security questions are safer when you answer them with something only you would know, because facts on social media are easy to guess. You can manage your digital footprint by limiting or deleting data browsers hold, deleting old accounts, and using private browsing. A self-audit means looking over your profiles from time to time and removing posts that no longer fit your values.

Look at the link you are about to click. A link that does not match its text may be a fake. A website can look credible but still be misleading. Judging a site by its looks alone can fool people. Fake Wi-Fi hotspots can copy the name of a real one, so ask the place for its exact Wi-Fi name. Not everything online is true. People can post false or misleading things, and misinformation can spread. Lateral reading means leaving an unfamiliar site and opening new tabs to see what trusted sources say about it.

Text can be hard to read. Something meant as a joke can look like an insult online. Do not post comments, videos or photos that might hurt or offend someone, and ask a trusted adult if you are unsure. If you see someone being cyberbullied, do not join in and do not stay silent. Tell an adult. If something online makes you feel sad, scared or confused, tell a trusted grown-up. Telling a grown-up about something that worried you online is the right thing to do. You should not be in trouble for telling.

Words to know

• spoofed: faked
• smishing: texting scams
• vishing: voice-call scams
• cached: saved copies