Field notes on staying safe online
Security guides you can finish in one sitting.
Step-by-step fixes for scams, hacked accounts, phone privacy and small-business IT. Written by an ICT engineer, checked against official documentation, dated, and honest about what we did not test.
Start here
Latest guides
-
AI Safety
What ChatGPT, Gemini, Claude and Copilot do with your chats, and how to opt out
Guide type Settings guide + checklist Risk if skipped Medium Time 10 min for all four Cost Free Works on Web, phone & desktop apps Last verified 2026-10-05 The short answer On personal accounts, all four can use your chats to improve their AI unless you switch it off. Each has a single setting for it, listed below. Turning training off does not mean "nothing is kept". Each company still stores chats for a while for safety, and some keep chats that a human reviewed for years. For anything sensitive, use the temporary or incognito chat mode. It stays out of your history and is not used for training. Whatever the settings say: never paste passwords, one-time codes, card or ID numbers, or other people's private details into a chatbot. The four chatbots compared Trains on your chats by default? Setting to turn it off Private mode Notes ChatGPT Yes (personal plans) Improve the model for everyone Temporary chat, kept up to 30 days for safety Deleted...
-
Small Business
3-2-1 backups for a small office on a small budget
Guide type Setup guide + worksheet Risk if skipped High Time 2 hours to set up Cost One external drive + cloud storage you may already pay for For Offices of 1–25 people Last verified 2026-10-05 The short answer 3-2-1 means three copies of important files (the original plus two backups), on two different types of storage, with one copy kept somewhere else. It is the rule CISA recommends. For most small offices: the original on your computers or cloud drive, an external drive that backs up automatically, and an off-site copy in a separate cloud backup or a second drive kept at home. Google Workspace and Microsoft 365 keep your files online, but neither is a full backup. A deleted or encrypted file can sync its damage everywhere. A backup you have never restored is a hope, not a backup. Test one restore every three months. What can go wrong without backups Event What you lose without a separate copy Ransomware Every file the infected computer can reach, includi...
-
Small Business
Deepfake calls and fake CEO requests: a payment verification policy for small teams
Guide type Policy template Risk if skipped High Time 20 min to set up Cost Free For Teams of 2–50 people Last verified 2026-10-05 The short answer Criminals now fake the voice, and even the video, of a boss or supplier to request urgent payments. You cannot reliably spot a good fake by looking or listening. What stops it is a rule , not a skill: every new payment, change of bank details or gift-card request is confirmed through a second channel you already know , such as calling back a saved number. Fill in the free one-page policy below, print it, and have everyone who can move money sign it. Why this is now a small-business problem Business email compromise, where criminals pose as a boss, colleague or supplier to redirect payments, caused $3.05 billion in reported losses in the US in 2025, according to the FBI's Internet Crime Complaint Center, up from $2.77 billion in 2024. The same report counts just over $30 million of BEC losses with a confirmed link to ...
-
Privacy
How to remove your personal information from people-search sites for free
Guide type Step-by-step + tracker Risk if skipped Medium Time 1–2 hours, then 15 min every 3 months Cost Free Works for US residents (most sites) Last verified 2026-10-05 The short answer People-search sites sell your address, phone number, relatives and age to anyone. Scammers use them to make calls and texts sound convincing. You can opt out of each site for free . Start with the largest ones in the tracker below, then use Google's Results about you to remove what remains from search results. In California? One request through the state's free DROP platform reaches every registered data broker, and since 1 August 2026 they must act on it. Listings come back. Set a reminder to check again every three months. Why this matters for your security A people-search report is a scammer's script. It gives them your full name, current and past addresses, phone numbers, email addresses and the names of relatives, often for a few dollars or for free. That is ho...
-
Privacy
Do you actually need a VPN? An honest answer, situation by situation
Guide type Decision guide Risk Low Time 5 min to decide Cost Free to about $10/month Works on Phone & computer Last verified 2026-10-05 The short answer At home, for security: usually no. Almost every website already encrypts your connection. A VPN does not stop phishing, scams, malware or hacked passwords, which is how most people actually get hurt. A VPN is worth it when you want to hide your browsing from the network you are on (hotel, airport, school, your internet provider), when you travel to countries that block sites, or when your job requires one. A VPN does not make you anonymous. It moves trust from your internet provider to the VPN company, which can see everything you do. Free settings in your browser give most people the same protection. They are listed at the end. What a VPN actually does A VPN app creates an encrypted tunnel from your device to a server run by the VPN company. From there, your traffic continues to the website as normal. Three...
-
Scams
QR code scams: how to check a QR code before you open it
Guide type Guide + free tool Risk Medium Time 5 min Cost Free Works on Phone & computer Last verified 2026-10-05 The short answer A QR code is just a link you cannot read. Before you open it, read the address your camera shows and check it is the real company's domain. Be most careful with codes that ask you to pay (parking, fines, invoices) or sign in . Type the official website or use the official app instead. Not sure? Upload a photo of the code to the checker below. It decodes the code on your device and shows where it really leads, without opening it. Where fake QR codes show up Place The trick What they want Parking meters and pay stations A sticker with a fake code is placed over the real one. The FTC has warned about this specifically. Your card number Emails ("quishing") A "security update", shared document or failed payment, with a QR code instead of a link so email filters miss it. Your work or email password Unexpected...
-
Passwords
How to recover a hacked Gmail account, step by step
Guide type Incident response Risk High Time 30–60 min Cost Free Works on Computer or phone Last verified 2026-10-05 The short answer Still signed in somewhere? Use that device now to change the password and sign out every other session, before the attacker locks you out. Locked out? Go to accounts.google.com/signin/recovery from a phone or computer you normally use, on your usual Wi-Fi, and answer every question with your best guess. Back in? Check Gmail's forwarding, filters and delegated access. Attackers hide there to keep reading your mail after you change the password. Google does not call people about account security and does not charge for recovery. Anyone who calls or texts offering to "recover" your Gmail is a scammer. Signs your Google Account was taken over Your password stopped working, or you get "password changed" or "new sign-in" emails you did not trigger. Friends receive messages from you that you did not se...