Useful videos

Hello everyone, and welcome to today’s talk on supporting others to be safe online. My name is Michael and today I’ll be covering three important areas of how to stay safe online. And that’s password security and then dealing with fake emails and fake websites. And there’ll be a focus on how we can stay secure as well as how we can help others stay secure, especially as the usual security advice can create barriers for those with low IT skills and also for disabled people.

Passwords. Passwords are everywhere. You need them for accessing your email, your banking, your Amazon account, your social media, amongst many other things. They keep potentially sensitive data safe, for example, I might have sent a copy of my National Insurance number via email to my employer. And passwords are also important because they confirm that you are you online.

If a fraudster had the password of any of my shopping accounts, they could buy things using my card. If they had access to my email password, they could send emails to whoever they wanted. If they had access to my banking password, they could drain my funds, apply for a loan in my name, and drain that too.

So, at a basic level, passwords are important because they allow you to access services, access records of how you’ve interacted with services and verify your identity online.

So how can we keep ourselves safe online? There are two aspects of password security that work together here. And those are strong passwords and unique passwords.

Now strong passwords are passwords that are difficult to guess. And although it’s tempting to think that hackers are sat there trying to get your password one attempt after the other, it’s sadly much more advanced than this. Hackers can use software to try passwords at a rate which a person can’t match. Using a standard desktop, hacking software can easily surpass 2.8 billion guesses per second.

So how can we keep ourselves one step ahead of hackers? We need to consider the following things when we create a password. And those are upper case letters, lower case letters, numbers, special characters, length. So, your password should be at least nine characters long, but the longer it is, the safer it will be.

Now the reason for this is using that hacking software that I was talking about, if you have eight characters, it would take a hacker just over nine hours to crack. But if you have nine characters, so one extra character, it would take about four weeks. If you add a further character to make it 10 characters, it will take six years. So that illustrates why we need to have a long password and as long as you can feasibly manage.

And the final thing to consider is un-obviousness. So, don’t use things that are easily guessed, like special dates, names, or places, so, for example, Michael1! is a really weak password, despite the fact that it complies with the above rules, because it could quite easily be guessed.

Now, strong passwords are only half the battle. To keep yourself safe, you must also use unique passwords. A unique password is a password that’s only used once and therefore not used across multiple accounts. Using unique passwords means that if an account is compromised, hackers won’t be able to access your other accounts.

The average internet user has over 200 online accounts. And this shows the importance of having unique passwords - using the same password for everything could give a hacker unfettered access to your life.

So, now that we know what goes into a password, how do we actually make them?

One way which we can do that is we can use a password generator. Now password generators are pieces of software which can create strong, unique passwords instantly. So, for example, here’s one with 12 characters, and it’s capital K, capital T, 8, capital G, lower case x, capital Y, lower case q, lower case c, equals, 2, @, capital F. And for 16 characters, 8, lower case u, capital T, dollar sign, lower case j, lower case e, open brackets, 1, &, lower case w, capital T, lower case a, the power sign, capital T, capital Y, capital X.

People with learning impairments, dyslexia and low literacy skills might all find a generated password really quite difficult to read and also to rewrite. So, how can we balance the need for strong, unique passwords with the barriers that they can actually create? I think the solution to this is to use a barrier-- a solution to this barrier, sorry, is to use a memorable short phrase or collection of words as a password.

So, for example, KeithElginForres, 1, 5, percentage sign, or The Jungle Book, 88, asterisk. These passwords have the benefit of being strong and the format can easily be adapted to make them personally meaningful. For example, the first example there are the first three stations heading north from Huntly, but you could use three memorable points for any journey and that can be tailored to any individual. To ensure that this meets all the requirements of creating a strong password, I would add a number and a special character to the end. Now this pattern of three words, number, special character might be slightly more easily guessed than a generated password, but it does strike the balance between security and accessibility.

But, however you choose to create your passwords, we still have an issue. How do we remember all of these passwords?

A secure way of keeping passwords safe is to use a password safe. Now password safes are software that allow you to add account details, such as usernames and passwords. They’re password protected, so this will keep your password safe in the event of a hacker gaining access to your computer. And another way of keeping passwords safe is to write them down on paper and keep this in a safe place. It’s better to risk accounts being compromised like this than to use a weak, non-unique password for everything that you do online.

However, if we can use a password safe, I really would recommend it. And the benefit of password safes is you only need to remember the one password to access the database that you create. This password will, of course, need to be strong and unique. But it does mean that users could generate a password using a password generator, copy and paste it into your password safe and then copy and paste it from there to the login box when you next need it. This helps overcome barriers with learning impairments and low literacy skills because you don’t need to be able to read or rewrite the password if you can just copy and paste it.

So, to recap, you need to create a strong, unique password for each online account that you have. Use a password generator or create your own with three words, a number, and a special character and keep them in a safe place.

The next part of the talk’s going to be looking at fake emails. And there are really two types of fake email scam that we’re going to be concerned with. The first are malware scams. These entice you to click a link or download an attachment and this can infect your computer with malware.

The other is phishing. Phishing involves a scammer sending emails to you to try and trick you into revealing details. Closely related to phishing emails are 419 scams where a scammer promises you a substantial return for minimal effort.

So, malware scams. Malware emails, as I said, often try to trick you into opening links and downloading documents. Accordingly, malware emails often look innocuous - but usually purport to come from legitimate companies or organisations, such as banks, local authorities, utility providers, credit card providers, big names, such as Amazon, and so on.

And malware scams can also come from people saved in our contacts list if they have been a victim of a malware themselves. For example, if my brother had been a victim of malware email, his email may then send me a scam email to try and infect my computer too. So, it’s just worth remembering it’s not only the big names that can do it. It could be from anyone or anything.

And phishing and 419 scams. So phishing emails try and seduce us with an offer that’s too good to be true or worry us into giving details or making payments. Phishing emails might claim to be from your bank warning you about suspected fraud and asking you to move money into a secure holding account. Or an energy provider explaining there’s been an error with your bill and either you’re due a rebate or else you owe them money.

And 419 scams are a type of phishing scam. They usually work where you’re contacted by someone who claims to be the agent of someone fabulously wealthy with a proposition for you. They’ve got 30 million pounds in a bank account, but they don’t have access to it. If they could put it into your bank account and then take it out a few days later, they’ll let you keep 3 million pounds or something like.

So, we’re going to have a look at how we can recognise scam emails now. The first thing to consider is: is the sender’s email address right? Reputable companies usually register a domain. A domain is the part of the email address after the ‘@’. For example, the domain for my work email is @lead.org.uk.

If you have an email which you’re not sure about, first hover your mouse over the sender’s email address and make a note of the sender’s domain. Now, search for the actual company’s email address. Do they match? If not, then the email is likely to be spam.

In the example on the screen, the domain is ‘@service.outlook.com’, which is a spoof of the Microsoft Outlook’s legitimate domain ‘@outlook.com’. The email here is asking you to follow a link to change your password. And this is a scam in which they gain sensitive information about you because you type in your old password and presumably your new password and then the scammer’s got your passwords.

The next thing to consider is: do they know who you are? Is the email addressed to you? So that would be James McDonald, Mrs. Miller, et cetera or does it have a generic opening, like customer, Sir, or Madam? And does this match with what the sender has previously called you?

In this example, the greeting ‘customer’ is used and the recipient is then asked to download a file and update their login details as their account’s been restricted. This scam might both download malware to your computer and also pass sensitive information, such as your new password, on.

The third thing to consider are spelling and grammar mistakes. If you’ve received an email that’s full of spelling mistakes, it could be a scam. Companies put a lot of effort into appearing professional. If you’re unsure about the spelling or grammar, try reading it aloud. Grammatical errors are easily noticed when reading aloud and it’s therefore quite a good way of catching some scam emails.

The reason for this is that many scams originate in countries where either British English isn’t spoken as the first language or English isn’t spoken at all. If British English isn’t spoken as the first language, the sentences might sound a bit peculiar. So, in the example in the presentation here, the sentence ‘truth you are doing well’ is quite odd. If English isn’t spoken at all, then the scam will usually put it through translation software, like Google Translate, to reach an English-speaking market. Google Translate is good, but it’s not flawless.

A fourth thing to consider are links in the email. Before you click on any links, hover your mouse over it. This will bring up the destination URL. Does this look right to you? If it looks strange, perhaps it’s very long, or the domain looks wrong, it could well be spam.

The example on the screen is an ad for a Visa credit card. You are guaranteed to be accepted, it says, even if you have poor credit. However, the URL, with the arrow pointed towards it, doesn’t resemble anything to do with Visa. It’s very long and Visa is not mentioned in it at all. So that’s quite likely to be a scam as well.

Another thing to consider is: is the email life changing? As the saying goes, if it seems too good to be true, it probably is. Many phishing 419 scams promise you a vast sum for minimal effort - you can have 3 million pounds for letting someone put money in your bank account for a few days, or for the payment of a modest fee, you can access your winnings in a lottery you don’t remember playing.

In the example on the screen at the moment is an email which claims to come from the United Nations and they say that they’ve got 4.8 million dollars to put into your bank account. These sorts of things don’t happen in real life.

And a final thing to consider is whether or not you’ve been contacted at all. Some organisations, such as HMRC, will never contact you via your email about fines, charges or bills. This example claims that you’ve got a tax refund of 243 pounds and 18 pence and requests you follow the link to get your refund. Again, this may involve malware being downloaded, sensitive information being passed to scammers, such as your National Insurance number, bank details, and those sorts of things. Or it could be both.

Now, those six things that we’ve covered, any of them by themselves should be enough to make you wary and if two or more are present, I would suggest just deleting the email. But deleting emails can be difficult if you’ve got anxiety and finding spelling issues or peculiarities in domains can be difficult if you have learning impairments, dyslexia, or low levels of literacy.

So, how can we look at making the standard email security more accessible? I’d suggest if there’s an email which seems like it might be a little bit suspicious, the best thing to do is just to contact the organisation or person it claims to be from. However, don’t use any contact details that are present in the email.

Search for the contact page for their website and then phone or email them using these details. This means that if the email is fake, you won’t simply be contacting a scammer. The organisation can then tell you if the email is fake, and if it’s not, they’ll be glad to know that their correspondence is causing concern. You should never open links or download attachments until you’ve done this.

So, how can we avoid scam emails then? Well, the first thing that we can do is make sure our spam filters are turned on. Whilst they’re not perfect, using spam filters to help catch fake emails is a very good way of getting rid of the majority of them. For example, today my spam filters have intercepted 17 spam emails.

And the second thing that we can do is to make sure we keep our email addresses safe. This means not putting them online. So, for example, in the personal information sections on social media, by making sure we tick ‘do not share my data’ boxes when filling in forms online.

And the final part of today’s talk is going to be looking at fake and fraudulent websites. Now fraudulent websites are the website equivalent of phishing emails. They might try and trick you into entering sensitive information, particularly card details. Fake websites are the website equivalent of malware emails. They might try and trick you into installing software that seems legitimate but is in fact some malware.

So, the first thing to consider with any website is: is it secure? When you are loading a website up, look in the URL bar and see if the address starts with ‘https’ or ‘http’. The ‘s’ stands for secure and indicates that the website uses encryption when transferring data. This encryption protects your data from hackers.

However, whilst ‘https’ doesn’t guarantee security, it is a good start. So just because it’s got ‘https’ in there, it doesn’t mean that it is definitely right, but it is a good start. If it doesn’t have ‘https’, if it’s just ‘http’, then you should be concerned.

If you use Chrome, it will have a black padlock for ‘https’ up in the bar and a red warning triangle for ‘http’ instead of showing it.

The next thing to consider: does the domain look right? So many fraudulent websites try and mimic the domain of legitimate companies. For example, tesc0.co.uk and that’s Tesco spelt with a zero instead of an ‘o’. Although these can be obvious if you’re looking, if you’re not paying attention then it can easily be missed.

Something which makes these sorts of things more tricky is that scammers can use both spoofing and code to make fake domains appear legitimate. Now this can be in on screen links as well as in the URL bar itself. Don’t click on links without first making sure that the domain looks correct by hovering your mouse over the link. If you use Chrome, the URL will then appear in the bottom left-hand corner.

If you use a site-- if you’re on a site, sorry, which appears to have a legitimate domain, but you’re not sure, then select the URL and copy and paste it into another tab. This will reveal the actual URL if you use Chrome.

Third thing to consider: how complete is this website? Legitimate websites often have extra features on their site like an ‘about us’ section, privacy policies and shipping and returns information if it’s a shopping website. Check these pages to make sure that they’re fully populated.

The example on the screen is from legitimate shopping website Free People. As you can see, there’s a plethora of different pages, which should give you confidence that the website itself is legitimate. However, if these didn’t exist, then it should raise alarm bells. And most importantly, check the ‘contact us’ page. There’s several ways of contacting the company?

Next thing, how secure are payments? You should never buy anything online using non-refundable payment methods like BACS. Make sure you use payment systems like card payments or PayPal, as these both allow chargebacks. However, chargebacks aren’t legally required - they’re part of a voluntary set of rules that banks sign up to and if scammers have withdrawn money and closed accounts, your chargeback won’t be successful. And therefore, you are better off just leaving a suspicious website rather than risking losing your money.

The fifth thing we’re going to look at, again: is it too good to be true? If you’re being offered a new iPhone for 100 pounds, or something like that, then you should be suspicious. You can get deals online which far exceed what you can get on the high street, but as we said earlier, if it seems too good to be true, it almost certainly is.

The advice that we’ve just talked about has similar accessibility issues as fake emails do. Checking the domain can be difficult for people with learning impairments, dyslexia and low literacy levels. However, the best advice is to talk to someone you trust about your concerns. If once you’ve done that, you’re not sure or they’re not sure, just don’t proceed.

Fraudsters can cause irreparable damage and that’s never going to be worth an iPhone for 100 pounds. Fake websites can be managed by simply closing the program, restarting your computer and running your antivirus software. Remember, you lose nothing by walking away.

How can we avoid fake and fraudulent websites? Well, there are a couple of practical steps which you can take to avoid entering them to begin with. And the first I would say is to make sure you’ve got antivirus software. Now antivirus software is a bit like a spam filter. It flags up suspicious websites before you can access them. And as a good rule, if your antivirus software is flagged up, don’t continue.

And the second thing to do is to make sure that you update your programs. Do this by turning your computer off when you’ve finished with it for the day rather than leaving it on standby.

Now the reason for this is when software is newly released, it’s often not completely finished and there are lots of bugs and flaws in it and as time goes on, those get discovered. But if you’ve just downloaded something, it could be quite out of date within a couple of weeks with new security updates and stuff, so do make sure that everything is updated.

Okay. So, we’ve looked at how we can make password, email and website security more accessible. Passwords can be made more accessible by removing the cognitive load of having to remember dozens of passwords by using a password safe, which only needs the one password. Email scams and website scams can be avoided by double checking that everything looks right. And if there’s still uncertainty, you lose nothing by asking either the person the email claims to be from or someone you trust for advice, and if you’re still not sure, you lose nothing by just walking away.

Thank you very much for coming along to today’s talk on supporting others to be safe online and I hope you have a wonderful day. Take care.