Pause before you click
Urgency is a common pressure tactic. Stop and look at the sender, the spelling and where a link really goes.
A friendly guide to safer digital life
Stay curious. Stay safer.
Cybersecurity is not just for experts. It is the everyday habit of pausing, checking and choosing wisely — at home, at work and on your phone.
No jargon · No scare tactics · Short lessons you can use today
Start here
Three habits do a lot of work.
Most online scams use the same few tricks. Learn the pattern, and you will be ready for the next message — even when it looks convincing.
Protect your logins
Use a different long passphrase for every important account. Turn on two-step verification whenever it is available.
Ask through a second channel
If a message asks for money, a code or private information, contact the person or company using a number you already trust.
Learn by doing
Small games. Useful instincts.
Every challenge is optional and all learning content is open to everyone. Try one or follow the recommended three-game path to build confidence and earn a badge.
Level
Monthly challenge set · Beginner
Overall score 0Challenges 0Level Beginner
Beginner points by challenge: Phishing Detective 0 · Password Builder 0 · What Would You Do? 0
Games are optional: explore the lessons freely or follow the recommended three-game path. Beginner earns 1 point, Intermediate earns 2, and Advanced earns 3. Complete all three challenges at a level to earn that level’s Cyber Defender badge.
0 of 3 challenges completed
Recommended path: Complete all three challenges at your chosen level to earn the Cyber Defender badge. You can stop, skip, or return at any time.
Shared scoreboard Top five Cyber Defenders Separate fair rankings for Beginner, Intermediate and Advanced.
Choose a level to see its top five scores. Public entries show only an alias and score.
| Rank | Alias | Score |
|---|---|---|
| Loading scores… | ||
Your private score profile Save or retrieve your scores Create a display alias and private PIN. No real-world identity is requested.
Optional · create after playing
Choose your display name
You can create your own alias or leave it blank and we’ll suggest one. Your alias is public; your PIN stays private.
Signed in for this tab only. Your submitted scores remain on this service.
Cyber Defender badge earned
You completed the full challenge set. Keep returning for the next monthly rotation.
Ready for the next level?
You have completed this level’s three challenges. Review any explanations, then try the next difficulty for a deeper test.
✓ Phishing detective✓ Password builder✓ What would you do?
Current guidance
Build your digital safety net.
Good security is a series of small layers. These habits reflect current public guidance from CISA and NIST, translated into actions anyone can take.
Use a password manager and MFA
Let a reputable password manager create and store unique passwords. Turn on multifactor authentication, and prefer a passkey or security key when a service offers one.
Update automatically
Keep phones, computers, browsers, apps and routers updated. Automatic updates help close known security weaknesses before criminals can use them.
Verify unexpected requests
Do not trust a display name, caller ID or familiar logo by itself. Open the official app or use a known phone number instead of the link or number in the message.
Keep a backup and a plan
Back up important photos and documents to a separate location. Know how to contact your bank, email provider and workplace if an account is taken over.
Five-minute check: review your email and banking account recovery details.
Turn on MFA for email first — it can unlock many other accounts.
Remove apps you no longer use and review which apps can access your location, camera and contacts.
Need help after an incident?
Use your organisation’s approved reporting process, contact your bank through its official number, or report to the relevant local authority. Do not use contact details supplied by a suspicious message.
Guidance checked against CISA Secure Our World and NIST SP 800-63B. This page is educational, not a substitute for professional incident response.
Keep this page
Your quick reference.
You do not need to remember everything. Save these three moves for the moment something online feels off.
Check the real address
Look for the official domain, not just a familiar logo or display name.
Never share a one-time code
A bank, employer or friend should never ask you to read a login code back to them. You may enter a code yourself during a sign-in you started, but keep it private.
Report, then delete
Tell the platform, your bank or your IT contact. Reporting helps protect the next person.
Message check
Email scams are built to rush you.
A scam email may look like it came from your bank, a delivery company, your workplace or someone you know. The goal is usually to steal a login, money or personal information.
- Unexpected urgency“Act now,” threats of account closure or pressure to keep the request secret.
- A strange sender or linkSmall spelling changes, unfamiliar domains or a link that does not match the company.
- A request for secretsPasswords, one-time codes, card details, gift cards or identity documents.
- An unusual payment requestWire transfers, cryptocurrency, prepaid cards or a new bank account.
If you think you clicked something bad
Do not panic. Move quickly and tell someone.
Disconnect if malware may be running, change the affected password from a clean device, contact your bank if money is involved, and report the message. Asking for help early is a strength.
Questions, answered
Cybersecurity without the mystery.
Start with the question that sounds most like your situation. If you are unsure, pause and ask a trusted person or your organisation’s IT contact.
What is phishing?
Phishing is a fake email, text, social-media message or phone call designed to make you click, pay, share information or reveal a code. The safest response is to stop, avoid the link, and verify through an official app, website or known contact.
Is a message safe because it uses my name or looks professional?
No. Scammers copy logos, writing styles and public details. A familiar name or caller ID can be spoofed. Treat the request itself as the clue: unexpected urgency, secrecy, payment, login details or one-time codes deserve independent verification.
What makes a password strong today?
Use a unique password or passphrase for each account. A password manager can generate and remember them. Length and uniqueness matter more than predictable substitutions such as replacing “o” with “0”. Never reuse your email password anywhere else.
What is MFA, and why should I turn it on?
Multifactor authentication asks for an additional proof after your password, such as an authenticator-app approval, security key or passkey. It can stop an attacker who has your password. Protect the second factor, and never approve a sign-in you did not start.
Are passkeys safer than passwords?
Passkeys are designed to resist phishing because your device proves access without sending a reusable password to the website. When available, a passkey or hardware security key is a strong option. Keep account recovery methods current as well.
What should I do if I clicked a suspicious link?
Stop interacting with the page. If you entered a password, change it immediately from a trusted device and sign out other sessions. If you shared banking details, contact your bank using its official number. Tell your workplace or service provider, and report the message. If malware may have installed, disconnect the device from networks and seek technical help.
Should I pay a ransom or scammer?
Do not negotiate alone or rush. Disconnect affected systems if safe, preserve evidence, contact your organisation’s incident-response lead or a qualified professional, and notify law enforcement or the relevant service provider. Payment does not guarantee recovery or deletion of stolen data.
How do I know whether a website is real?
Check the full domain and spelling, but do not rely on the padlock alone — HTTPS encrypts a connection; it does not prove the site is honest. For banking, government and shopping, type the known address yourself or use an official app rather than following an unexpected link.
Do I need antivirus software?
Keep your device’s built-in security protections enabled, install updates, and use reputable security software when recommended for your device or workplace. Antivirus is one layer, not a replacement for safe clicking, MFA, backups and software updates.
What information should I never share in a message?
Do not share passwords, MFA codes, recovery codes, full card details or private identity documents in response to an unexpected request. A legitimate organisation will give you a safe, official way to sign in or update details.