Cybercrime aimed at ordinary people — not just corporations — has grown steadily: AI-generated phishing emails that read far more convincingly than the broken-English scams of a decade ago, SMS scams impersonating banks and delivery services, credential leaks from breaches you had nothing to do with, and malicious apps disguised as legitimate tools.
The good news is that a small number of habits block the overwhelming majority of these attacks. You don't need security expertise — you need to actually do the following, consistently, rather than just knowing about them.
1. Stop Reusing Passwords — This Is the Single Biggest Risk
Reusing the same password across multiple sites is the most common mistake, and it's the one that turns a minor breach into a major one. If a low-security site you signed up for years ago gets breached, attackers don't just try that password there — they run it against major email, banking, and shopping sites automatically, betting you reused it. This is called credential stuffing, and it works often enough that it remains one of the most common attack methods.
What to actually do:
- Use a password manager (Bitwarden, 1Password, or your browser's built-in manager) to generate and store a unique password for every account. You genuinely cannot remember unique strong passwords for 50+ accounts, so don't try.
- Where a service offers passkeys instead of passwords, use them. Passkeys are tied to your device and biometrics, and can't be phished the way a typed password can — there's no password to trick you into typing into a fake site.
2. Turn On Multi-Factor Authentication Everywhere It's Offered
Multi-Factor Authentication (MFA) means even if someone gets your password, they still need a second factor — a code from an app, a physical security key, or a biometric check — to get in.
A meaningful distinction most guides skip: not all MFA is equally strong.
- SMS-based codes are better than nothing but are vulnerable to SIM-swapping attacks, where an attacker convinces your mobile carrier to transfer your number to their SIM card.
- Authenticator apps (Google Authenticator, Authy, Microsoft Authenticator) are meaningfully more secure than SMS, since they don't depend on your phone number at all.
- Physical security keys (like a YubiKey) are the strongest option and worth the cost for your most critical accounts — primary email and financial accounts — since email is usually the recovery path attackers use to take over everything else.
Prioritize enabling MFA on your primary email account first. It's the account attackers target hardest, because controlling it lets them reset passwords on nearly everything else you own.
3. Learn to Spot AI-Generated Phishing — The Old Advice Is Outdated
Older cybersecurity advice told people to watch for spelling mistakes and awkward grammar as a sign of a scam. That advice is now unreliable, because AI writing tools let scammers produce fluent, professional-sounding phishing emails with no red flags of that kind at all.
What still works as a red flag:
- Urgency and pressure — "your account will be suspended in 24 hours," "verify immediately or lose access." Legitimate companies rarely create this kind of artificial time pressure.
- Mismatched sender addresses — the display name may say "PayPal Support," but the actual email address behind it is unrelated. Always check the real address, not just the name shown.
- Requests to click a link and enter credentials rather than logging in directly through the app or a bookmarked URL. When in doubt, navigate to the site yourself instead of clicking the email's link.
- Unexpected attachments, even from contacts you know — their account may have been compromised and used to send you something malicious.
4. Check If Your Data Has Already Been Breached
Sites like Have I Been Pwned let you check whether your email address has appeared in known data breaches. This won't prevent a breach, but it tells you which specific old passwords you need to change immediately if you haven't already moved to unique passwords everywhere.
The Realistic Bottom Line
None of this requires technical expertise — it requires actually doing four things: unique passwords via a password manager, MFA on your important accounts (especially email), skepticism toward urgency in messages rather than trusting fluent writing, and periodically checking whether your credentials have leaked. Most successful attacks on individuals exploit the absence of these basics, not sophisticated technical hacking.