Personal cyber security handbook

Staying secure online means protecting yourself in different ways. Build good habits such as:

• browsing securely
• using safe home and private networks
• managing what you share on public profiles 
• staying alert when using social media and online games. 

These habits help protect your money, privacy and identity from cybercriminals.

Use secure, and trusted websites

Always use secure and trusted websites, especially when entering personal or financial information. Avoid sites with pirated or illegal content, as they may carry malware.

Fake websites can look real, but their web address is often slightly different. For example, auspost.live instead of auspost.com.au. If you know the correct website address, type it carefully into your browser’s address bar to avoid landing on a fake site.

Manage your online identity

Review the privacy settings on your social media and messaging apps so you control who can see your information. Anything you post can be used by others, including cybercriminals who may try to scam you or steal your identity. Check your settings often, especially after updates.

Consider keeping your profiles private and only talking with people you know and trust. If you get an unusual message from someone you know, contact them directly to make sure it’s really them.

To help protect your privacy online, consider these tips:

• Say ‘no’ to optional cookies.
• Use a reputable ad blocker to stop websites from tracking you.
• Use a reputable web browser and search engine that enforces privacy.
• Turn off automatic image downloads in your emails.
• Avoid using in-built social media web browsers.

Limit what you post online

Once you post something online, it's out there for anyone to see and can be very difficult to remove. Be careful of sharing information such as your:

• phone number
• email address
• home address
• date of birth
• bank and credit card details
• employment details
• school or university (including where your children go for school or childcare).

Also, be aware of what your photos and videos can reveal about you. Avoid including location details such as check-ins, street signs and metadata. You can go one-step further by changing your settings so your friends and family can’t tag you in their photos.

Delete your unused accounts

Consider deleting any social media and messaging accounts you no longer use. Leaving them active can expose your information if you're not checking them.

Remember that uninstalling an app doesn't delete or deactivate your account. You will need to do this first through the official app or website before uninstalling the app.

Protect your accounts

Protect your accounts to keep your personal information, money and identity safe from cybercriminals. 

Follow these simple tips to protect your accounts:

• Use strong and unique passwords.
• Turn on multi-factor authentication.
• Delete suspicious messages or links.

By adding simple layers of protection, it can be much harder for anyone to misuse your accounts. 

Protect your social media and gaming accounts

Social media and online gaming are common targets for scammers. These accounts can be valuable because they may include game licenses or linked payment details.

Protect these accounts the same way you protect your bank or email accounts. Cybercriminals may try to scam you, steal your information, or install malware through social media or games.

Many of the same tips apply across social media, messaging apps and online games:

• Turn on MFA, use passkeys, and when passkeys are not available use strong, unique passwords for each account.
• Lock your devices when not in use and never save logins on shared or public devices.
• Be cautious with third‑party apps, mods and plug‑ins. Only install from official stores or trusted developers.
• Use trusted networks. Avoid logging in or making purchases on public Wi‑Fi and use mobile data if possible.
• Don’t click links sent in direct messages (DMs) or chats - even from friends.
• Limit what you post and share. Review privacy settings, disable location sharing, and avoid oversharing personal details.
• Be wary of giveaways, trades and offers that seem too good to be true. Keep transactions inside official marketplaces.
• Watch for warning signs of compromise (unexpected password resets, new logins or messages you didn’t send).

Extra tips for gaming

• Use legitimate game clients and keep games, launchers and consoles up to date.
• Back up your game saves and important files.
• If a gaming device is compromised (crashes, popups, unknown apps), reset it and change your passwords.

Extra tips for social media & messaging

• Review who can find, tag or message you.
• Review privacy and messaging settings, including limiting direct messages, friend requests and other contact from unknown accounts on platforms where this is not enabled by default.
• Regularly remove unused accounts and revoke third-party app permissions.

Secure your email account

There are several ways to make your email account more secure.

• Start by using a passkey, or a strong password where passkeys are not available.
• Use multi-factor authentication
• Set up account recovery options
• Keep your devices and software up to date.

Improving your email account security is only the first step. You also need to be aware of what to do and what not to do when using your email at home and in public. This includes:

• checking your recent login activity
• using public Wi-Fi securely by ensuring you are connecting to the right hotspot; checking you are visiting secure webpages; disabling fire sharing and thinking twice about what you access.
• consider deleting unused accounts that are no longer required.

Know the warning signs of email compromise:

• Your login details don’t work.
• Your password recovery details have changed.
• You notice multiple login attempts at unusual locations or times.
• You get an unexpected email to reset your password.
• Your contacts are receiving emails from you that you didn’t send.

If you notice any of these signs or suspect your email is compromised, reset your password and sign out of all sessions.

Use your own personal and work accounts

Create different user accounts

On your personal computer you should have different user accounts for work and personal use. Avoid using an admin account for everyday tasks such as emailing or web browsing. A standard user account limits access to files, programs and settings on your device.

Change your user account type

Check your account type in your computer’s settings. On Microsoft Windows, use Control Panel or Settings to switch from an administrator account to a standard one. On a Mac, you can manage standard accounts in System Settings.

Keep a separate administrator account for tasks that need extra access, like creating new users. Protect it with a strong password and don’t share it.

Make sure everyone who uses your computer has their own standard user account. This limits how much access a cybercriminal could get if one account is compromised.

Set up accounts for children with limited permissions and use parental controls. These tools help you manage what they can see and do online, reducing the risk of cyberattacks.

Change default admin logins

A user account is the login you use on your computer at home, school, or work. Cybercriminals often target accounts with weak or default settings to gain access and steal information.

Changing default admin logins and using stronger security habits can help protect your accounts and reduce the risk of a cyberattack.

Use administrator accounts only when needed

If cybercriminals access an administrator account, they can control your whole computer, which is why these accounts are a major target. Giving everyone admin access increases the risk of lost files, accidental changes, or malware from clicking fake links.

Think of an admin account like a master key. If someone uses it for everyday tasks and it falls into the wrong hands, everything becomes exposed. The same is true when you use an administrator account for daily computer use.

Secure your login

Adjust your settings to automatically lock your account when you’re not using it. A shorter lock time keeps your account more secure.

Consider alternative login features such as Windows Hello or Apple’s Touch ID. They provide a more secure way to login using fingerprint or facial recognition. You can also use physical security keys with a fingerprint or PIN instead of a username or password. Learn more about alternative login features from Windows and Apple.

Use networks safely

Staying safe online also means protecting the networks you use. Learn how to secure your connection and use public Wi-Fi securely to keep your information and devices safe.

Secure your Wi-Fi and router

A Wi-Fi router is a small box that lets your devices connect to the internet. It acts like a doorway between the internet and your private digital space. Securing your Wi-Fi and router stops threats from getting into your network and stealing your data. 

To improve your network security, you should:

• change your default Wi-Fi network name and password
• change your router’s default username and password
• use the strongest Wi-Fi encryption available
• keep your router up to date
• disable remote management and Universal Plug and Play
• enable guest Wi-Fi if required.

Consider segmenting your network by purpose or device. For example, connect smart home devices to a separate network from your main network to reduce the risk if they are compromised.

Turn on your firewall

Check if the firewall on your router is on. It is a built-in feature with most routers. Firewalls help to prevent suspicious traffic from entering your network. It will allow or deny traffic based on security rules.

Use public Wi-Fi networks securely

Public Wi‑Fi is convenient when travelling or dealing with poor reception, but it does come with risks. These networks are often insecure or poorly configured, making it easier for cybercriminals to access your data. Where possible, use your mobile hotspot for internet connectivity.

You can use public Wi-Fi if you’re careful. Avoid sensitive tasks, like online banking or other financial activity, while connected to public networks.

Tips to protect yourself when using public Wi-Fi

Connect to the right Wi-Fi network 

• Confirm correct network name on signage or with staff at the venue or location.

Disable file sharing

• Turn off file sharing over Wi-Fi before you connect to a public network.

Think twice about what you access 

• Avoid accessing sensitive information, such as online banking, on public Wi-Fi networks. Use your mobile hotspot where possible. 

Secure your online shopping and banking  

Be cautious when shopping online. Do your research before you buy and stick to trusted companies and websites. If you're not confident about how the website will use your information, shop elsewhere.

Stick to well-known businesses and cross-check information on their website. You can research online shops by checking their:

• customer reviews
• fine print such as privacy, warranty, refund and complaints policies
• Australian Business Number (ABN) through ABN Lookup, if they’re a local business.

Spotting a safe site for online shopping

You should also do some research on online shopping websites before buying from them. You can find website domains by carefully typing them into your web browser. You can also use your favourite, trusted search engine to search for them. Avoid any search results that are advertisements or sponsored links.

Online auctions

Online auctions can be fun and help you find good deals, but they also attract scammers. A common scam happens when someone claims the auction winner backed out and offers the item to you if you pay outside the auction site. Once you pay, the scammer disappears and the auction site cannot help you.

Here are some tips to help protect yourself:

• Always make your transaction within the auction website. Don’t contact buyers or sellers in private.
• Keep printed and electronic records of all bids. Make sure you have noted down the item’s description. Save emails to and from the seller, and transaction records or receipts.
• Consider using a reputable third-party escrow service if you're buying something expensive. These services hold the funds until you receive your goods.
• Check reviews and rating scores if the website uses a feedback rating system.
• Read the terms and conditions before using an online auction site. Marketplaces like eBay have dispute resolution processes if something goes wrong.

Online shopping scams

The best way to avoid being a victim of cybercrime is to stay informed. Learn how to secure your device and recognise a fake website or scammer.

Warning signs when shopping online

If something looks too good to be true, it probably is. Watch for these warning signs before you buy:

• The website looks unprofessional or poorly designed.
• The prices seem unrealistically low or claims impossible benefits.
• The seller asks for payment by wire transfer, gift cards, digital currency or other unsafe methods.
• There is no clear contact information (phone, email, or address).
• The privacy details, terms and conditions, return policies, or dispute processes are missing or unclear.
• The seller won’t let you use secure payment options.
• Your credit card details are requested for reasons unrelated to your purchase.
• The shipping costs or extra fees look unusual.
• The website link or the back button does not work.

More warning signs on social media, classifieds and marketplaces

• New pages with low engagement are a red flag. Look at the page’s age, followers, and posting history.
• A one‑way conversation with little community interaction can indicate a fake store.
• New seller accounts with multiple very cheap listings may be scams.
• Private pages can be suspicious. True sellers keep their pages public.
• Scammers often copy real pages. Watch for small spelling changes or added symbols in business names.
• Don’t use PayPal ‘friends and family’ for purchases, as it offers no buyer protection

Security tips for online shopping 

Consider the following tips when shopping online:

• Use secure payment methods like Apple Pay, Google Pay, PayPal, BPay or your credit card. You can dispute a payment through these methods if something goes wrong.
• Avoid sending your bank or credit card details by email.
• Avoid clicking on payment links or sending payment details in an SMS.
• Check your bank statements for unusual transactions and report them to your bank.
• Limit how much personal information you share when making an online purchase (only fill in mandatory fields).

Also make sure you know how to pay securely when paying online. Scammers might ask you to use payment methods such as:

• direct bank deposits
• money transfers
• digital currencies (like Bitcoin).

Those payment methods are an easy way for them to steal from you. It's unlikely you will get your money back if you pay a scammer through one of these methods.

Choosing secure online payment methods 

Apple Pay/Google Pay

Apple pay and Google pay are digital wallets that let you pay online safely without sharing your real card information with stores. Using a digital wallet reduces the risk of data theft. 

PayPal

There are two payment types to choose from if you’re sending funds to someone using PayPal. Use the ’goods and services’ payment option if you’re paying for an item you’ve agreed to buy online. This option has purchase protection.

If a seller insists on the 'friends and family payment' option, this could signal a potential scam. You won’t be able to recover any money sent this way.

BPay

Use a legitimate biller code and customer reference number if you use BPay. Don’t pay by direct transfer to a bank account.

Credit cards

You may want to set up a second card with a low credit limit and use it only for online purchases. This will minimise your financial losses if these card details are ever compromised after shopping online.

If you need to cancel your card, you’ll still be able to use your primary credit or debit card.

Protect your information after an online purchase

Once you’ve made an online purchase, you still need to remain vigilant. Cybercriminals can target you even after you’ve made a purchase on a legitimate website.

Follow our tips to learn what to be aware of after you’ve bought something online.

Don’t click on suspicious links

Genuine websites won’t ask you to click on links in emails to verify your order.

If you’re asked to do this, contact the buyer directly using details from their website. Don’t reply to the email or click on any links.

Check the sender’s address on emails about online orders

Scammers try to impersonate brands or sellers by copying their email branding. The best way to identify if it’s a genuine email is to check their email address. Check if the email address matches with the contact details on the online store’s official website.

Ignore and report suspicious contact

Scammers may contact you about an online purchase to try to steal your personal or financial details. Stay alert to strange calls, messages or emails about your orders.

Be cautious if an order confirmation looks wrong, doesn’t use your name, or asks you to click a link to fix or verify your order. Fake messages may also mention orders you didn’t make or show the wrong currency.

If someone contacts you about a problem with your order, stop the conversation and reach out to the organisation using the contact details on their official website. Ignore and report any SMS or instant message you receive that seem suspicious.

Learn how to report and recover from scams.

Be careful saving your payment details 

Avoid saving your payment details to your online shopping accounts or browser.

This includes:

• credit or debit cards
• bank account details
• payment services such as PayPal.

Storing your payment details online increases the risk of someone stealing them if your account is hacked.

If you do save your payment details, protect your accounts where possible with:

• a strong and unique password
• a strong multi-factor authentication such as passkeys.

Be on the lookout for fake delivery scams

Don’t let your guard down while you're waiting for your goods to arrive.

Cybercriminals can send fake parcel delivery notifications asking you to click on links to verify your delivery details. They might trick you into downloading malware or giving away your personal details.

You might get an email or text message pretending to be a parcel delivery service. It could say you have an 'undelivered package' waiting for pick up. You should be cautious if the message:

• doesn’t use your name
• doesn’t have many details about your order
• threatens to charge you more than you’ve already paid.

Australia Post will never ask you to click a link to fix parcel collection issues. They also won’t ask you to update or verify your information.

Call the organisation if you’re unsure. Remember to use contact details from an official website or other trusted source.

Use artificial intelligence responsibly

Artificial intelligence is a way of making computers perform tasks that usually require human thinking. It allows computers to learn, solve problems, understand language, and make decisions. AI works by using data and simple rules called algorithms. In short, it’s like teaching a computer to be smart so it can help make life easier.

You’ll see AI in many everyday tools and apps, such as:

• chatbots and virtual assistants
• translation tools
• apps that recommend music, videos or products
• tools that help write, plan or summarise information.

When you use AI, there are some important things to think about. You should not share personal information, like passwords or bank account numbers. Most AI systems are not designed to handle confidential information, and that information could be used by AI systems in ways you did not intend - such as for system improvements. When using AI it is recommended you review the policy on how your personal information will be handled.

There are steps you can take to engage with AI securely. Use the questions below to find AI risks and manage them:

• Does this AI system have a good reputation?
• Do I need to share this information with the AI system?
• How will the AI system use my information?
• What does its privacy policy say?
• What can I do to ensure the output of the AI system is accurate and appropriate for use?

Consider your privacy. AI can analyse large sets of data which can attract cybercriminals. Even when data is anonymised, there is a risk that cybercriminals may still be able to identify who the data belongs to.

Try to limit oversharing, read the fine print, and treat AI like any online service, helpful, but not always private or unbiased.

Be selective with what you share

• Avoid entering sensitive information into AI tools unless you fully trust the provider. Assume it can store everything you share.

Check data policies

Review the privacy policy of the AI service you’re using. Look for:

• what data is collected
• how it is used
• whether it’s shared with third parties
• whether your data is used to train the AI tool/service.

Control your digital footprint

• Where possible, use AI tools that allow you to delete your history or turn off data storage. You can also use separate accounts or email addresses to limit the link to your identity. 

Watch for bias and accuracy

• Be cautious if an AI tool gives advice or recommendations. AI outputs can be biased, inaccurate, incomplete or even made up (known as hallucinations). Always cross-check important decisions with trusted sources.

Security first

• Be wary of entering personal information into free/public AI tools and follow your employer’s advice on entering confidential work information and approved tools.

Check where your data is stored

• Data processed overseas may not be protected under Australia’s privacy laws. If possible, use AI providers that store data locally or comply with strong regulations.

Use AI agents securely

Some AI tools can act on your behalf by completing tasks automatically, such as organising information, sending messages or interacting with other apps. These tools are called AI agents. While they can be helpful, they may also increase security and privacy risks if they are given too much access. AI agents may find shortcuts or loopholes that technically achieve an objective but conflict with the user’s intention or introduce security vulnerabilities

If you use AI agents, only turn on features you understand and need. Check what accounts, apps or data the agent can access. Avoid giving it permission to make important changes without your approval. Where possible, start with limited access and review settings regularly.

Individuals should maintain a human-in-the-loop to review, approve and monitor agent actions, particularly where interactions with third-party services or other users may occur.