Why the basics matter most
Attackers go after easy targets: reused passwords, unpatched devices and people who click quickly. You do not need expensive tools to be a harder target than most.
Four habits do most of the work: strong unique passwords, two-factor authentication, updates, and backups.
Passwords and two-factor
Use a long, unique password for every account. A password manager makes this easy, because you only remember one master password. A long phrase of several random words is both strong and memorable.
Turn on two-factor authentication for email first, then banking, social media and business tools. Your email account can reset every other password, so protect it most.
- Never reuse a password between accounts.
- Prefer an authenticator app over SMS codes where you can.
- Do not share one-time PINs with anyone, including callers who say they are from your bank.
Updates and devices
Turn on automatic updates for phones, computers, routers and apps. Updates fix security holes that attackers already know about. Replace devices that no longer get updates.
Change the default password on your Wi-Fi router, and use a guest network for visitors and smart devices. Lock your screens with a PIN.
Phishing and scams
Phishing messages pretend to be a bank, courier, tax authority or your boss, and push you to act quickly. Slow down. Do not click links in unexpected messages. Open your bank's app or type the address yourself.
Be careful with invoices and payment requests. A common scam is an email that looks like your supplier saying their banking details have changed. Phone them on a number you already have and confirm.
- Check the sender's real address, not just the display name.
- Be suspicious of urgency, threats and prizes.
- Never install software because a caller told you to.
- Confirm any change of bank details by phone.
Backups
Keep copies of important files somewhere an attacker cannot reach from your computer, such as an external drive kept disconnected or a cloud backup with version history. Test that you can restore a file.
Backups are your answer to ransomware, theft, fire and ordinary mistakes alike.
For small businesses
Give each person their own login, remove access when someone leaves, and limit who can approve payments. Use two people for large payments. Keep customer data to what you really need, because data you do not hold cannot be stolen.
Write down who to call if something goes wrong: your IT person, your bank and your insurer. If you have information about a scam, SAPS Crime Stop (08600 10111) takes anonymous tip-offs.
If something goes wrong
Do not panic and do not hide it. The faster you act, the less damage is done. Change the password of any affected account from a clean device, turn on two-factor if it was off, and sign out of all sessions.
If money was sent, call your bank straight away and ask them to try to stop or recall the payment. If a device is infected, disconnect it from the network and ask a trusted IT person to check it before you use it again. Keep screenshots and emails as evidence, and report the fraud to the police. If personal information about customers or staff was exposed, POPIA requires you to notify the Information Regulator and the people affected as soon as reasonably possible. Afterwards, ask what allowed it to happen and fix that one thing first.
Protecting the family
At home, do the same for the whole family. Help older relatives turn on updates and two-factor, and agree that anyone who gets a worrying message asks someone else before acting. Scammers target people who feel rushed or embarrassed, so make it normal to check first.
A simple checklist
Go through this once a quarter:
- Password manager in use, no reused passwords.
- Two-factor on email, banking and business tools.
- Automatic updates on all devices and the router.
- A recent backup, with a tested restore.
- Staff know how to spot a phishing message and who to tell.
- Former staff and old accounts removed.
- A short plan for who to call after an incident.
Questions people ask
What is the single most useful thing I can do?
Turn on two-factor authentication on your email account, because it protects the reset route for everything else.
Do small businesses get targeted?
Yes, because they often have weaker defences. Many attacks are scams and stolen passwords rather than advanced hacking.
What should I do if I clicked a bad link?
Disconnect from the network if you can, change the passwords for affected accounts from another device, and tell your bank if money is involved.
Sources
Mtunzini Group is a family-run, PSiRA-registered guarding company in Cape Town that actively manages its officers with field supervision.