Digital Self-Defense

Voice cloning technology requires as little as three seconds of audio to create a clone with 85% voice match to the original speaker. Deepfake fraud cases surged 1,740% in North America between 2022 and 2023, with financial losses exceeding $200 million in Q1 2025 alone.

The attacks are sophisticated. Engineering firm Arup lost $25.5 million when a finance worker approved 15 transfers during what appeared to be a routine video call with their UK-based CFO—except every participant was AI-generated. Similar attempts targeted Ferrari CEO Benedetto Vigna through AI-cloned voice calls that perfectly replicated his southern Italian accent; the call was only terminated when an executive asked a question only Vigna would know.

Make it a habit: Any request for money, passwords, or sensitive actions—regardless of how legitimate the voice or video appears—triggers a verification callback via a number you already have on file. At work, insist on two-person sign-off for any fund transfers. Establish a family safe word for emergency calls.

2025 marked the year passkeys went mainstream. Passkey authentications have more than doubled in a year, reaching 1.3 million per month, while 40% of users now store at least one passkey. 75% of global consumers are now aware of passkeys, and the passwordless authentication market reached $24.1 billion in 2025.

The shift is accelerating because passkeys work. Over 95% of all iOS and Android devices are passkey-ready, and major platforms are making them mandatory: Gemini made passkeys mandatory as a second authentication factor for all users in May 2025, producing a 269% rise in authentications. Microsoft made passkeys the default sign-in for all new accounts in May 2025, and the UAE Central Bank issued a directive requiring all financial institutions to eliminate SMS and email OTPs by March 2026.

Where passkeys aren’t yet available, hardware security keys (YubiKey, Feitian, Google Titan) remain phishing-resistant alternatives far superior to SMS codes.

Make it a habit: Enable passkeys on every service that offers them. For critical accounts without passkey support, use a hardware security key rather than SMS-based verification.

Your smartphone is the master key to your digital life. Both iOS and Android now include theft-protection features that deserve activation.

iPhone (iOS 18+): Stolen Device Protection requires biometric authentication (Face ID or Touch ID) for sensitive operations when your device is away from familiar locations—no passcode fallback available to thieves. For highly sensitive changes, the system requires an initial biometric authentication, imposes a wait of approximately one hour, and then requests a second biometric authentication to complete the adjustment. Additionally, iOS 18 ties device components to your Apple ID, making stolen parts harder to resell.

Android 15+: Theft Detection Lock uses AI to auto-detect when a phone has been stolen by recognising common motion associated with theft. The Offline Device Lock feature automatically locks the device if it has been offline for a prolonged period or after multiple failed login attempts. Private Space creates a separate, secure area for sensitive apps protected by additional authentication.

Make it a habit: Enable Stolen Device Protection (iOS) or Theft Detection Lock (Android). Switch to an alphanumeric passcode of at least 10 characters. Practice remote-locking using Find My (Apple) or Find My Device (Google) so you know the process before you need it.

Ransomware remains a persistent threat—ransomware was present in a notable rise of all breaches compared to last year’s report. Your backup strategy determines whether an attack is an inconvenience or a catastrophe.

The modern backup rule: Three copies, on two types of storage, one off-site, one immutable (read-only snapshot that cannot be encrypted or deleted), zero errors after a test restore.

Cloud services including OneDrive, Google Drive, and iCloud all offer ransomware-protected version history—but you must enable it. Business users should consider dedicated backup services with immutable storage.

Make it a habit: Enable version history on all cloud storage. Schedule a quarterly test restore to verify your backups actually work. For critical data, maintain an offline copy updated monthly.

Windows Defender and macOS XProtect stop most modern malware when kept current. The days of needing heavyweight third-party antivirus suites are largely past for most users.

Keeping your software updated is one of the most critical personal cybersecurity best practices because it closes the security gaps that cybercriminals actively seek to exploit.

Make it a habit: Confirm auto-updates are enabled for your operating system’s built-in protection. Run an on-demand scan (Malwarebytes Free, ESET Online Scanner) monthly as a second opinion. Remove any legacy antivirus software that conflicts with modern built-in defences.

Your home network is your perimeter. A compromised router gives attackers a position to intercept traffic and pivot to other devices.

Router security:

• Switch to WPA3 encryption (or WPA2-AES minimum)
• Disable WPS (Wi-Fi Protected Setup)—it has known vulnerabilities
• Disable UPnP (Universal Plug and Play)—it can expose internal devices
• Enable automatic firmware updates
• Change default admin credentials

IoT segregation: Create a separate network (most modern routers support guest networks or VLANs) for smart devices—cameras, doorbells, thermostats, bulbs. A compromised smart device on a segregated network cannot reach your laptop or phone.

Make it a habit: Log into your router quarterly to verify firmware is current and no unfamiliar devices are connected.

Full-disk encryption ships by default on iOS, Android, macOS, and Windows 11 with BitLocker. Verify it’s enabled—this protects data on lost or stolen devices.

For sharing sensitive files, use end-to-end encrypted messengers (Signal, WhatsApp) or expiring cloud links rather than password-protected ZIP files, which most email security gateways block anyway.

Make it a habit: Verify encryption status: Windows (Settings → Privacy & Security → Device Encryption), macOS (System Settings → Privacy & Security → FileVault), mobile devices (enabled by default with passcode set).

HTTPS is near-universal, but hostile networks can still harvest metadata about your activity. When travelling or using untrusted networks, a reputable VPN provides meaningful protection.

Select VPN providers that publish independent security audits, support modern protocols (WireGuard), and have clear no-logs policies verified by third parties. Free VPNs typically monetise your data—avoid them.

Make it a habit: Install a trusted VPN before you travel. Enable it automatically on networks you don’t control.

In nearly half of all cyberattacks, credentials or data were stolen, highlighting a growing challenge in securing both data and identities. Early detection limits damage.

Register with breach notification services:

• Have I Been Pwned (haveibeenpwned.com)
• Mozilla Monitor (monitor.mozilla.org)

These services alert you when email addresses appear in known breaches.

Make it a habit: When notified of a breach, change that password immediately—or revoke and recreate the passkey. If you reused that password elsewhere (don’t), change those too.

Security degrades without maintenance. A brief quarterly review prevents accumulated vulnerabilities.

Checklist:

• Apply all pending updates (OS, applications, router firmware)
• Review and remove unused applications and browser extensions
• Verify backups completed successfully; test a restore
• Confirm security keys and passkeys still work
• Audit shared folders and family album permissions
• Review connected third-party applications in major accounts

Make it a habit: Block 30 minutes quarterly. The modest effort prevents the 15-day identity-theft recovery process.

Browsers are your primary attack surface. Hardening them reduces exposure to tracking and drive-by exploits.

• Block third-party cookies (most browsers now support this natively)
• Install a reputable ad blocker (uBlock Origin)
• Enable HTTPS-Only Mode
• Enable DNS-over-HTTPS

Alternatively, switch to a privacy-focused browser: Firefox, Brave, or Safari all offer stronger defaults than Chrome.

Applications request far more permissions than they need. Location data is particularly sensitive—it reveals patterns of life, routines, and associations.

iPhone: Settings → Privacy & Security → Location Services Android: Settings → Privacy → Permission Manager

Set most applications to “While Using” or “Never.” Disable Bluetooth and Wi-Fi scanning when travelling—these can be used to track movement even without GPS.

The infamous 2017 Equifax breach, which exposed the data of 147 million people, was caused by the company’s failure to apply a known security patch. Delayed patching remains one of the most exploited weaknesses.

Enable automatic updates on:

• Laptops and desktops
• Mobile devices
• Routers and network equipment
• NAS devices
• Smart home hubs

When purchasing new devices, favour those with committed security support (five years minimum). Reboot after major updates—some fixes only activate on restart.

Identity theft often targets credit applications. Freezing your credit files prevents fraudulent accounts from being opened in your name.

In the UK: Contact all three credit reference agencies:

• Experian
• Equifax
• TransUnion

Each offers free security freezes or fraud alerts. Thaw only when you need to apply for credit.

Additionally:

• Enable instant transaction alerts from your bank
• Consider virtual card numbers for online purchases from unfamiliar merchants
• Review credit reports annually via free services

Strong security can lock you out if you lose access. Plan for recovery scenarios.

Recovery codes: Store them in both your password manager AND a physical backup (encrypted USB in a safe, sealed envelope with solicitor).

Legacy contacts: Major platforms offer the ability to designate trusted contacts who can access or memorialise accounts:

• Apple ID: Legacy Contact
• Google: Inactive Account Manager
• Microsoft: Account closure delegation
• Facebook: Legacy Contact

Documentation: Maintain a simple “Where my digital life lives” document listing critical accounts, recovery methods, and contacts. Update it twice yearly.

Old devices are data goldmines. Proper disposal prevents the next owner from accessing your information.

Before selling, donating, or recycling:

• Factory reset the device
• Remove all account associations (Find My, iCloud Lock, Google account)
• Remove SIM cards and external storage

For drives with sensitive data: If you cannot verify secure erasure, physical destruction is the only guarantee.

Critical: Before wiping a phone, transfer your authenticator apps and passkeys to your new device. Failing to do this can lock you out of accounts.

Your security posture is only as strong as the least security-aware person sharing your network and accounts.

Family practices:

• Run a phishing awareness discussion annually (share examples of current scams)
• Place children’s devices behind DNS filtering (CleanBrowsing, Cloudflare for Families at 1.1.1.3)
• Establish family rules for app downloads and account creation
• Create a household response plan for suspected compromises

The 60-second recap on the fridge creates shared vocabulary. Security scales when everyone participates.