Digital Safety Glossary
Every term Hygi. lessons use, in plain language. Inside a lesson you can tap any underlined word to read its definition without leaving the page — this glossary is the complete list.
Scams and manipulation
- Impersonation scam
- What it means: A scam in which someone pretends to be a trusted person, company, bank, employer, or government agency.
Example: “Mom, I lost my phone — this is my new number, can you help me pay something?”
What to do: Contact the real person or company on their known number before sending anything.
Important: Requests for gift cards, wire transfers, or crypto are almost always fraud.
- Phishing
- What it means: A deceptive email or message designed to make you click, share information, send money, or give account access.
Example: An “unpaid delivery fee” text with a link to a page that looks like the post office.
What to do: Don't tap links in unexpected messages — open the company's app or type its address yourself.
Important: Real companies never ask for your password or a login code by message.
- QR-code scamalso: quishing, QR code scam
- What it means: A scam that uses a QR code to direct someone to a fraudulent site or payment request.
Example: A sticker placed over the genuine QR code on a parking meter.
What to do: Prefer typing the official address or using the official app to pay.
Important: Read the address preview before continuing, and never pay via a QR you didn't expect.
- Smishing
- What it means: Phishing conducted through text messages or messaging apps.
Example: A text claiming your bank card is locked, with a shortened link to “unlock” it.
What to do: Delete it and call the number printed on the back of your card instead.
Important: A familiar sender name or number can be faked, so it proves nothing.
- Spoofing
- What it means: Making a phone number, email address, website, or sender name appear legitimate or familiar.
Example: Caller ID showing your bank's real customer-service number during a scam call.
What to do: Treat caller ID, sender names, and reply addresses as unverified and check separately.
Important: Seeing the correct name or number is not evidence that the contact is real.
- Suspicious link
- What it means: A link whose destination, sender, wording, or context may be deceptive.
Example: A login page at “paypa1-secure.com” instead of the real domain.
What to do: Long-press or hover to preview the real destination before opening it.
Important: Shortened links and QR codes hide where you are actually going.
- Urgency tactic
- What it means: Pressure to act immediately so that you do not stop and verify.
Example: “Your account will be closed in 30 minutes unless you confirm now.”
What to do: Give yourself five minutes and one verification call before doing anything.
Important: Genuine organizations always leave you time to check.
- Verification
- What it means: Confirming a request through a separate, trusted method.
Example: Calling the number on the back of your card instead of the one in the message.
What to do: Save official phone numbers and app logins now, before you need them.
Important: Never verify using contact details supplied in the suspicious message itself.
- Vishing
- What it means: Phishing conducted through telephone or voice calls.
Example: A caller claiming to be “tech support” who asks you to install remote-access software.
What to do: Hang up and call the organization back on a number you look up yourself.
Important: No legitimate company asks for remote control of your device out of the blue.
Passwords and account protection
- Account recovery
- What it means: The process of regaining access to an account after losing credentials or experiencing a compromise.
Example: Using a backup email address to get back into a locked account.
What to do: Check that the recovery email and phone number on your key accounts are current.
Important: Attackers target recovery options first, so protect them as carefully as passwords.
- Authenticator app
- What it means: An app that generates temporary login codes or supports account-approval methods.
Example: A six-digit code that changes every thirty seconds.
What to do: Install one, then enable its backup so a lost phone doesn't lock you out.
Important: No support agent ever needs you to read a code from this app aloud.
- Compromised account
- What it means: An account that an unauthorized person may have accessed or controlled.
Example: Messages in your sent folder that you never wrote.
What to do: From a trusted device, change the password, sign out all sessions, and turn on MFA.
Important: Also check for new email forwarding rules and connected apps left behind.
- Credential stuffing
- What it means: Automated attempts to use leaked username-and-password combinations on other websites.
Example: An old leaked password still unlocking your shopping account years later.
What to do: Give every account its own unique password.
Important: One reused password can expose dozens of accounts at once.
- FIDOalso: FIDO2, FIDO Alliance
- What it means: A family of open authentication standards designed to enable stronger, phishing-resistant sign-in methods.
Example: A tap-to-approve security key described as “FIDO2 compatible”.
What to do: Where a service lists FIDO or passkey sign-in, treat it as its strongest option.
Important: FIDO is the standard behind passkeys and security keys, not a brand or an app.
- MFA fatiguealso: push fatigue, MFA bombing
- What it means: Repeated login-approval prompts sent to pressure someone into approving a sign-in they did not start.
Example: A stream of “Approve this login?” notifications at 2 a.m.
What to do: Don't approve it. Change the password from a trusted device and review account activity.
Important: Repeated prompts usually mean someone already has your password.
- Multifactor authenticationalso: MFA
- What it means: Using more than one type of authentication evidence before an account grants access.
Example: Entering your password and then approving the login through an authenticator app.
What to do: Turn it on first for your email, financial, social-media, and cloud accounts.
Important: Never give an unexpected login code to someone who contacts you.
- One-time passwordalso: OTP
- What it means: A temporary code intended for a single authentication event, and never for sharing.
Example: A code texted to you while paying online.
What to do: Use it immediately, then let it expire.
Important: Never read it out to anyone, including someone claiming to be support.
- Passkey
- What it means: A phishing-resistant way to sign in using cryptographic credentials stored or managed by a trusted device or credential provider, instead of typing a reusable password.
Example: Unlocking an account with your fingerprint, face, or device PIN — nothing to type.
What to do: Consider a passkey when an important account offers one, starting with your email.
Important: Keep a device lock and a backup sign-in method in case you lose the device.
- Password manager
- What it means: Software that generates, stores, and fills unique account passwords, and may also manage passkeys or other credentials.
Example: The manager generating and filling a 20-character password you never have to recall.
What to do: Set one up and move your email, banking, and cloud passwords into it first.
Important: Protect it with one strong passphrase plus MFA, and never share that passphrase.
- Password reuse
- What it means: Using the same or similar password for multiple accounts.
Example: The same password on your email and on an old forum that was breached.
What to do: Replace reused passwords on email, banking, and cloud storage first.
Important: Adding a “1” or “!” to the end does not make it a different password.
- Phishing-resistant authentication
- What it means: Authentication designed so credentials cannot simply be entered into, or replayed through, a convincing fake website.
Example: A passkey that refuses to work on a lookalike login page.
What to do: Choose it for email, banking, and other important accounts when it is offered.
Important: Codes you type by hand are not phishing-resistant, even when they come from an authenticator app.
- Recovery code
- What it means: A backup credential some services supply for regaining access when your normal authentication method is unavailable.
Example: The list of ten one-use codes shown when you first switch on MFA.
What to do: Save them in your password manager or print them and store them somewhere safe.
Important: They work like passwords, so never email them or store them in shared albums.
- Security key
- What it means: A physical FIDO-compatible device used to provide strong, phishing-resistant authentication.
Example: A small USB or tap-to-approve key you use when signing in.
What to do: Register two keys: one for daily use and one kept in a safe place.
Important: Among the strongest practical options — no method makes an account impossible to compromise.
- SIM swap
- What it means: An attack in which a criminal tries to take control of your phone number, which can affect text-message codes and account recovery.
Example: Your phone loses service, and password reset texts start arriving somewhere else.
What to do: Ask your mobile carrier to add a PIN or port-out lock to your account.
Important: It's one reason phishing-resistant sign-in is preferable to SMS where a service offers both.
- Two-factor authenticationalso: 2FA
- What it means: A form of MFA that uses two authentication factors.
Example: Your password plus a rotating six-digit code from an app.
What to do: Choose a passkey, security key, or app over text-message codes when a site offers both.
Important: Text codes are weaker than phishing-resistant options, but still better than a password alone.
- Verification code
- What it means: A temporary code used to verify a login or action. Don't provide an unexpected code to an incoming caller or message.
Example: “Your verification code is 481920.”
What to do: Only enter a code on a page or app you opened yourself.
Important: A code you didn't request often means someone has your password — change it from a trusted device.
- WebAuthn
- What it means: A web authentication standard used by browsers and websites to support public-key credentials such as passkeys and security keys.
Example: A site asking your browser to “use your passkey” — WebAuthn is what makes that work.
What to do: Keep your browser and phone updated so passkey sign-in works reliably.
Important: You rarely see the word in daily use; it's the plumbing behind passkeys.
Devices and harmful software
- App permissions
- What it means: The access an app receives to features such as location, contacts, photos, camera, or microphone.
Example: A flashlight app asking to read your contacts.
What to do: Review permissions and set location to “while using the app”.
Important: Grant only what the app genuinely needs to do its job.
- Automatic updates
- What it means: A setting that allows security and software updates to install with little or no user action.
Example: Your phone updating overnight while it charges.
What to do: Enable it for the operating system, your browser, and your apps.
Important: Check occasionally that it really ran — silent failures are common.
- Factory reset
- What it means: Returning a device to its original settings and usually erasing personal information.
Example: Wiping a phone before you sell or recycle it.
What to do: Back up first, then sign out of your accounts and reset.
Important: Remove the device from your account (such as Find My) or the new owner can't use it.
- Malware
- What it means: Software designed to damage, spy on, disrupt, or gain unauthorized access to a device.
Example: A “free video player” download that quietly installs something else.
What to do: Install apps only from official stores and keep automatic updates switched on.
Important: Pop-ups warning that your device is infected are usually the scam itself.
- Ransomware
- What it means: Malware that locks or encrypts information and demands payment.
Example: Your files renamed and a payment note left on the screen.
What to do: Keep a backup that is disconnected or version-protected so you can restore instead of pay.
Important: Paying often does not return your files — disconnect and report it.
- Security patch
- What it means: An update specifically intended to fix a security vulnerability.
Example: An emergency browser update released after a flaw is found.
What to do: Restart your device when it asks, so the patch actually takes effect.
Important: Publicly known flaws are exploited within days, so don't postpone these.
- Software update
- What it means: A change that may repair security weaknesses, fix problems, or add features.
Example: Your phone or laptop offering a new system version.
What to do: Install it promptly, or switch on automatic updates so you don't have to decide.
Important: Only update from system settings or the official store — never from a pop-up link.
- Spyware
- What it means: Software that secretly collects information about a person or device.
Example: An app logging what you type or where you go without telling you.
What to do: Review installed apps and their permissions, and remove anything you don't use.
Important: Sudden battery drain, heat, or data use can be an early signal.
- Supported device or software
- What it means: A product that still receives security updates from its manufacturer.
Example: An older phone that no longer gets any system updates.
What to do: Check the vendor's support end date before buying or keeping a device.
Important: An unsupported device stays vulnerable forever, no matter how careful you are.
- Virus
- What it means: Malicious software that can copy itself or spread between files and devices.
Example: An unexpected attachment that infects shared documents once opened.
What to do: Keep built-in protection enabled and don't open attachments you weren't expecting.
Important: A document asking you to “enable content or macros” is a red flag.
Privacy and personal information
- Data breach
- What it means: An incident in which protected or private information is accessed, exposed, stolen, or lost.
Example: A service emailing to say your password was exposed.
What to do: Change that password immediately, and anywhere you reused it, then enable MFA.
Important: Watch for “breach support” scams that arrive right after the news.
- Data broker
- What it means: A company that collects, combines, and sells information about people.
Example: A people-search site listing your address and relatives.
What to do: Send opt-out or removal requests to the largest brokers.
Important: Repeat it yearly — listings tend to reappear from new sources.
- Digital footprint
- What it means: The information about a person that exists because of their online activities.
Example: Old posts, forum accounts, and profiles still public years later.
What to do: Search your own name and clean up or lock down what you find.
Important: Deleting something doesn't remove copies, screenshots, or archives.
- Doxxing
- What it means: Publishing someone's private or identifying information without permission, often to threaten or harass them.
Example: Someone posting your home address in a harassment thread.
What to do: Lock down profiles, remove address details, and screenshot everything as evidence.
Important: Report it to the platform and to police rather than engaging with the harasser.
- Location services
- What it means: Device features that allow apps to determine or estimate where you are.
Example: A weather app set to track your location “always”.
What to do: Set apps to “while using” or off, and turn off precise location where it isn't needed.
Important: A continuous location history reveals your home, work, and daily routine.
- Metadata
- What it means: Information attached to a file, photo, or message, such as time, location, device, or author.
Example: A holiday photo that also carries the GPS coordinates of your home.
What to do: Turn off location tagging in your camera and strip metadata before sharing.
Important: Metadata can reveal where you live even when the picture doesn't.
- Personal information
- What it means: Information that identifies or can be connected to a person.
Example: Your full name together with your birthdate and home address.
What to do: Share only the minimum a form actually requires.
Important: Small details combined are enough for identity theft.
- Privacy settings
- What it means: Controls that determine what information is collected, shared, or visible to others.
Example: Setting a social profile so only friends can see your posts.
What to do: Review them after every major app redesign or update.
Important: Updates sometimes reset choices back to more public defaults.
- Sensitive information
- What it means: Information that could cause greater harm if exposed, such as financial, health, identity, or login information.
Example: Your national ID number, medical records, or banking logins.
What to do: Keep it in an encrypted place and never send it by plain email or text.
Important: Legitimate organizations don't ask for full ID numbers or passwords by message.
- Tracking
- What it means: Collecting information about a person's online behavior across websites, apps, or devices.
Example: Ads for a product following you from site to site.
What to do: Turn on your browser's tracking protection and limit ad tracking on your phone.
Important: The same profiles are also used to make scams feel personal and believable.
Internet and communication safety
- Backup
- What it means: An additional copy of information that can be restored if the original is lost, damaged, or encrypted.
Example: An external drive copy plus a cloud copy of your photos.
What to do: Keep one copy disconnected, and test restoring a single file so you know it works.
Important: Ransomware encrypts backups that stay permanently connected.
- Cloud storage
- What it means: Saving files on an internet-based service rather than only on a local device.
Example: Photos syncing automatically from your phone.
What to do: Protect the account with a unique password plus MFA, and review your sharing links.
Important: Syncing is not a backup — a deletion or infection syncs everywhere too.
- Encryption
- What it means: Converting information into a protected form that unauthorized people cannot easily read.
Example: The storage on your locked phone, unreadable without the passcode.
What to do: Turn on device encryption and use a passcode or biometric lock.
Important: Encryption won't help if someone learns your account password.
- End-to-end encryption
- What it means: Communication protection intended to allow only the sender and intended recipient to read the content.
Example: Messages in an app where even the provider cannot read them.
What to do: Use an end-to-end encrypted app for sensitive conversations.
Important: Screenshots and unencrypted backups can still expose the content.
- Firmware
- What it means: Software built into hardware such as routers, cameras, and smart devices.
Example: A router update that closes a newly discovered flaw.
What to do: Enable automatic firmware updates, or check for them every few months.
Important: A smart device that no longer gets firmware updates should be replaced.
- HTTPS
- What it means: A protected connection between your browser and a website. It encrypts the connection but does not prove that the website itself is trustworthy.
Example: The padlock and “https://” shown in your address bar.
What to do: Read the domain spelling carefully, not just the padlock.
Important: Scam sites use HTTPS too — the padlock is not a trust badge.
- Public Wi-Fi
- What it means: A shared wireless network in a public place, such as an airport, cafe, or hotel.
Example: An open “Airport_Free_WiFi” network with no password.
What to do: Use your phone's hotspot or mobile data for banking and other sensitive tasks.
Important: Attackers can create networks with convincing names, so don't trust the name alone.
- Router
- What it means: The device that connects a home or office network to the internet.
Example: The box your internet provider installed.
What to do: Change its default admin password and keep its updates current.
Important: Put visitors and smart devices on a separate guest network.
- Virtual private networkalso: VPN
- What it means: A service that encrypts internet traffic between a device and the VPN provider. It does not make someone anonymous or protect against every scam.
Example: Turning one on before using hotel Wi-Fi.
What to do: Pick a reputable paid provider and use it when you're on networks you don't control.
Important: Free VPNs often sell your browsing data, and no VPN stops phishing.
AI and synthetic media
- AI chatbot
- What it means: Software that generates conversational responses to user prompts.
Example: A support assistant answering questions on a website.
What to do: Treat its answer as a helpful draft, not as an authority.
Important: Assume anything you type into it may be stored or reviewed.
- AI hallucination
- What it means: A confident-sounding AI response containing inaccurate or invented information.
Example: A chatbot citing a law, study, or link that doesn't exist.
What to do: Verify facts, figures, links, and any medical, legal, or financial advice elsewhere.
Important: Never paste passwords or sensitive personal data into a chatbot.
- AI-generated content
- What it means: Material created partly or fully by an artificial-intelligence system.
Example: Dozens of glowing product reviews written in the same voice.
What to do: Look for a named source, author, and date before trusting it.
Important: Fluent, confident writing is not evidence of accuracy.
- Bot
- What it means: An automated account or program that performs actions or communicates online.
Example: An account posting the same reply under hundreds of posts.
What to do: Check an account's age, history, and followers before trusting it.
Important: Bots are used to amplify scams, especially investment offers.
- Content provenance
- What it means: Information about where digital content came from and how it may have been created or edited.
Example: An image carrying an embedded label showing it was AI-generated.
What to do: Prefer platforms and outlets that publish provenance labels.
Important: A missing label doesn't prove content is authentic.
- Deepfake
- What it means: Artificially generated or altered video, audio, or imagery made to resemble a real person or event.
Example: A video call “from an executive” approving an urgent payment.
What to do: Confirm any money or access request by calling the person on a number you already have.
Important: Video and voice are no longer proof of who you are talking to.
- Manipulated media
- What it means: Real media that has been edited, removed from context, or misleadingly presented.
Example: A clip cut so the moments before and after change its meaning.
What to do: Find the full original before you share it.
Important: Genuine footage can still mislead, so context matters as much as authenticity.
- Reverse-image search
- What it means: A method of searching for where an image has previously appeared online.
Example: Finding a dating-profile photo on a modelling or stock-photo site.
What to do: Search suspicious profile photos and dramatic news images.
Important: An image reused elsewhere under another name is a strong scam signal.
- Synthetic media
- What it means: Audio, images, video, or text created or substantially changed using technology.
Example: An invented news photograph of an event that never happened.
What to do: Check whether reliable outlets report the same thing before believing or sharing it.
Important: Emotional content spreads fastest, and gets checked last.
- Voice cloning
- What it means: Using technology to imitate a person's voice.
Example: A distressed “grandchild” asking you to send money right away.
What to do: Agree on a family code word to use in real emergencies.
Important: A few seconds of public audio is enough to copy someone's voice.
Hygi. behavioral terms
- Digital boundary
- What it means: A personal rule that limits unwanted access, contact, tracking, pressure, or disclosure.
Example: Not answering unknown numbers, and never discussing money by text.
What to do: Write down two or three rules you'll keep, and tell your family about them.
Important: You never owe anyone an instant reply.
- Emotional trigger
- What it means: Fear, excitement, affection, shame, or urgency used to influence a decision.
Example: “Your account will be deleted today” or “you've won, claim within the hour”.
What to do: Notice the feeling first, then re-read the message calmly before responding.
Important: The emotion is the attack — not the story wrapped around it.
- Pause-and-verify
- What it means: Stopping before acting and confirming a request through a trusted second method.
Example: Hanging up on a “bank” call and dialling your bank yourself.
What to do: Build in a short pause for any request involving money, codes, or access.
Important: Almost every scam fails the moment you slow it down.
- Protective friction
- What it means: A deliberate extra step that slows an important decision and helps prevent mistakes.
Example: A personal 24-hour rule before any large transfer.
What to do: Add one deliberate delay to decisions involving money or account access.
Important: Scammers depend on speed, so friction is protection rather than inconvenience.
- Recovery plan
- What it means: A prepared set of actions for responding to account theft, scams, lost devices, or exposed information.
Example: Written steps plus saved bank and platform support numbers.
What to do: Write it now and keep a copy offline where you can reach it without your phone.
Important: The first hour after a compromise matters most, so don't improvise it.
- Risk signal
- What it means: A clue suggesting that a message, request, account, or situation may be unsafe.
Example: A payment request that arrives from a slightly different email address.
What to do: Keep a short list of your personal warning signs and act on them.
Important: One clear signal is reason enough to stop and check.
- Trusted channel
- What it means: A communication method independently known to belong to the person or organization.
Example: The number printed on the back of your bank card.
What to do: Save official contacts and app logins before you ever need them.
Important: Never use contact details supplied inside the suspicious message.
Missing a word? Tell us on the support page and we'll add it. Brought to you by NorthBridge.
Example: Someone posing as a new coworker who needs a shared password “quickly”.
What to do: Verify who you are talking to through a channel you already trust before acting.
Important: Pressure plus secrecy is the pattern to watch for, whatever the story.