This might sound obvious, but your Vassar account’s password isn’t the only one that you should follow strong password practices for. Every password you use online should follow the guidelines of being long, unique, and complex, even ones that you think are “unimportant.” This is especially true for using unique passwords. If you use the same passwords for even some of your accounts, one becoming compromised means that all of them are at risk of being compromised.

In addition, it’s a good idea to set up multi-factor authentication on any accounts that allow you to. More and more sites are implementing multi-factor authentication, so go take a look in the settings of accounts you have to see if you can turn it on! A lot of sites are even requiring multi-factor authentication, so if you start using it now, your accounts will be more secure and you’ll be able to get used to adding it to your login routine.

There’s also some common sense guidelines you should follow when it comes to passwords. Don’t make them anything obvious, like “password” or “myname123.” Don’t write your passwords in notebooks on on post-its that others could easily see, steal, or take a picture of (it’s better to not write them down at all, but more on that in a bit!). It’s also a good idea to turn off the option to show passwords as you’re typing them, and make sure no one is watching you enter your password. Finally, don’t ever send passwords in plaintext (like in an email or a text message) or enter it in any forms other than to login. Remember, if someone contacts you asking for your password, to change your password to something specific, or to enter it into a form, it’s probably phishing!

While these guidlines should apply to all of your accounts, here are some of the most important ones to cover:
– banking accounts
– insurance accounts
– health related accounts
– shopping accounts and other places that might store credit card information
– anything with lots of valuable and/or personal information

Now you might be thinking that this sounds like too much to manage, but that’s where password managers come in. You don’t have to limit your password managers to having just your school accounts or even your most important ones. Password managers can and should be used for all of your accounts, which will make managing this much easier and more secure!

If you visit the Phishing Attempts section of this website, you’ll see lots of examples of phishing emails that people have received on their Vassar emails. It’s pretty common to get phishing messages through those emails, however it is far from the most common type. In fact, you’re probably more likely to come across phishing in your day-to-day life and on personal messaging platforms than you are on your school/work account. This means it’s important to always keep the skills you can learn on this website handy to recognize phishing wherever it appears.

First and foremost, you should always be keeping a lookout for phishing emails on your personal accounts. These are sometimes more common than on school accounts, as it’s easier to pretend to be someone when not sending to an email with a more specific domain like vassar.edu. However you can still keep an eye out for suspicious email addresses, ones that try to hide a domain in the account name that doesn’t match with the actual domain, and email addresses with different names than who the body of the email claims sent it. Some phishing emails will be blatant on personal email accounts, as they can get through filters of other email providers easier, such as ones that are just random words or even strings of letters. However there are still sometimes ones that can almost pass as real, which is when you want to start asking the questions listed on our page on how to spot and deal with phishing: Phishing Tips.

Phishing can also easily happen over other messaging services, such as text and Instagram DMs. These will look slightly different from email phishing, but all of the same clues will be there. To start, look out for unfamiliar and/or unlikely phone numbers and account names. In the actual message, watch for typos and unusual spacing. Also pay attention to a lack of details; some of the most common phishing texts will talk vaguely about “your recent package” or “a payment” that could be referring to any number of things, so that they can try to get many people to fall for it. Most official messages of this kind will very clearly state what they are referring to and who the message is from, so this vagueness should be a red flag, much like in phishing emails. In addition, these messages will often ask you to click on a link or engage with them in some other way. Just like phishing emails, never click on these links or follow phishing message’s instructions! These messages will often try to establish urgency, importance, or even clout to get you to interact with them, but use the tips you’ve learned from email and critical eye to spot when these messages are not real.

Another thing you might not realize is that phishing can also happen over the phone. Whenever you get a phone call where some stranger is claiming to be your bank, employer, government official, or someone else of authority (and very clearly isn’t), that’s phishing! (Fun fact, it’s also sometimes called “vishing” for voice phishing.) These phishing attempts will also have similar clues to the other kinds. Look out for a caller ID that doesn’t match who the caller says they are, and even area and country codes that don’t match with their supposed organization/location. These phishing attempts will also particularly rely on trying to create urgency, as they can only trick you as long as you are on the phone, so if someone seems to be unusuallt pressuring you to take an action that seems like it should have had more warning or steps to the process, then it’s very likely a phishing attempts. These often will look like trying to get you to send money to someone to prevent some action or giving information under the guise of being from a company you have an account in. The cool thing about these phishing attempts is you can easily ask questions back, so you should always ask where someone is calling for and any other identifying information or credentials that could identify a scam. More often than not, if it’s phishing, they’ll hang up on you for asking before you even have to decide yourself!

One of the most common things people do online today is shop. While online shopping is super convenient and generally quite secure, there are certain steps you can and should take to make it as secure as possible.

To start, always know the websites that you are buying from, and if they are unfamiliar, so a quick search online to see if they are a reputable site. There are some websites that have reviews of other websites that can be a good place to find an online store’s reputation, as well as seeing if this is a well-known brand. You should also always check that the url in the search bar begins with https, not just http. If it’s not showing either of these, try copying and pasting the url into a new tab. Only websites that use https are secure to buy things on. Some browsers will also show a little lock next to the url, which will be unlocked or even red if the site isn’t secure.

Next, when buying online it’s best to use a credit card or third-party payment service (like Paypal, Apple Pay, or Shop Pay) instead of a debit card. Credit cards and third-party payment sources will make it easier to get your money back in the case of fraud, and are not linked to accounts that may have as much money as a debit card.

Cybersecurity actually isn’t just relevant when you’re shopping online, though. Technically, everytime you pay for something in a real store using a card, you are engaging with a computer, which means there are ways to be safer with your money. A good way is to use the tap feature that many credit and debit cards are starting to allow. This lets you pay without having to put in a pin, which means no one can potentially steal that pin, and also have strong encryption and a much lower chance that the card reader may be compromised and steal your information. Similarly, you can use Apple or Google Pay so that you can tap your phone to pay.

On the topic of storing your credit and debit card information on devices, let’s talk about when it is and is not safe. Apple and Google Pay are definitely safe to add your payment to; they’re entire model relies on secure payments, and so you can trust they are using the best practices to keep your accounts secure. Another way devices might try to store your payment information is in your browser, similar to build-in password managers. Much like those password managers, it’s pretty secure to save your information like this, as long as you have to enter a password or even better provide biometrics like a fingerprint. However, any time a browser starts saving or autofilling your payment information with no verification needed is a big problem. If anyone got access to your browser, they could then access this information. This is why you should never enter your payment information in any form other than a legitimate, secured payment form, and if you notice your information popping up in autofill in other places, immediately find out how to clear the autofill on your browser and do so.

Lastly, it’s a good idea to just keep an eye on payments being made under your account. There are times when you should specifically check this, such as if you believe you accidentally entered your information somewhere unsafe or made a suspicious purchase. However it’s also a good idea to set up alerts through your bank for things like out-of-country purchases and ones made on new devices. You can probably get an app that will alert you of these things, and also set up emails and/or texts, so that you can easily check on your accounts periodically just to make sure everything looks in order.

There are countless things that we can do on our phones, and a lot of the time it seems like there’s no reason to even pull out our laptops. However, when it comes to cyber- and infosecurity, it can be valuable to sometimes take a pause and bring something up on a larger screen.

One of the most relevant uses for this is when examining a potential phishing email. Most of us check our emails on our phones a good portion of the time, and phishing emails rely on this. A lot of the time those sending the phishing attempt will try to create a sense of urgency that makes you think you have to react to it right now. When just skimming an email on your phone, it can be easy to get caught up in this urgency and end up falling for the phishing attempt. This is why it’s so important to use your skills in spotting phishing messages to tell when an email seems suspicious. If you receive an email from an unfamiliar person or that seems to be asking for something very unexpected and urgent or just unusual, that means it’s time to bring up the message on a larger screen. It’s best to do this on a laptop or desktop, and if you don’t have one of those, there are public computers available for use in the library and college center (just make sure you sign out when you’re done!). This can allow you to take a better look at the message, as well as provide features like being able to see the sending address and hover over any links in the message to see if they really go where they claim. While it might take a bit of extra time, it’s better to take that extra care than to fall for a phishing attempt!

This also applies to other situations that may be risky for your information or online accounts. For example, it’s a good idea to make important purchases from a larger screen. This will allow you to make sure that you are on a reliable site, not providing or saving information you don’t want to at any point, and are actually buying what you want. It also will help you slow down and be more intentional about the purchase so that you don’t make any mistakes that might compromise your account or information. In general, when you’re in doubt, it’s a good idea to save anything important or suspicious to be done on a larger screen, just to be safe.