The Cyber Safety Myths I Keep Having to Correct

The Myth That Antivirus Software Is Enough

I still hear this one all the time. Someone installs an antivirus program once, ticks the box in their head, and assumes they're covered. Antivirus software catches known threats, but it's one layer in a much bigger picture. Scammers don't need to get past your antivirus if they can just get you to hand over a password or click a dodgy link yourself. Treat it as one part of your setup, not the whole thing. It also can't do much about scams that don't involve malware at all, a convincing phone call or a fake invoice doesn't trip any antivirus alert because there's no malicious file involved, just a person being persuaded to act.

The Myth That You'd Never Fall For It

This is the one that worries me most, because it's usually said by people who are otherwise switched on. Nobody plans to fall for a scam. The convincing ones don't look like the obvious ones from a decade ago, they're well written, well timed, and often arrive when you're distracted or in a rush. I've written before about how I spot phishing attempts, and the honest truth is even careful people get caught out occasionally. The goal isn't never making a mistake, it's catching it quickly when you do. The people I've seen catch a scam fastest aren't the ones who never get fooled, they're the ones who notice something's wrong within minutes rather than days, because they've built the habit of checking rather than assuming they're immune.

The Myth That a Strong Password Is Enough on Its Own

A strong password is a good start, not a finish line. If you reuse it anywhere, or it ends up in a data breach you never hear about, that strength stops mattering. I use a password manager like NordPass so every account gets its own long, unique password without me having to remember them, and I pair that with two factor authentication wherever it's offered. That combination does more for me than any password complexity rule ever did. A password manager also means I'm not tempted to reuse a memorable one across several accounts just because typing a long random string every time is tedious, which is exactly the shortcut that turns one breach into several.

The Myth That Public WiFi Is Fine for a Quick Check

Five minutes on a cafe's open network to check your bank balance feels harmless enough, and most of the time nothing happens. But you can't see who else is on that network or what they're doing with it, and that's exactly the point. I use a VPN like NordVPN any time I'm on a network I don't control, even for something as small as checking email. It's not about assuming the worst, it's about not needing to find out. The risk isn't that someone's definitely watching, it's that you have no way of knowing either way, and a VPN removes the guesswork entirely rather than asking you to judge how busy or trustworthy a particular cafe looks.

The Myth That Scams Only Target Older People

I hear this one from people in their twenties and thirties just as often as anyone else, usually right before they tell me about a scam that nearly caught them out. Younger people are actually targeted differently, not less, think fake concert tickets, rental scams on properties that don't exist, or a "recruiter" offering a remote job that asks for banking details before you've even had an interview. Comfort with technology doesn't translate into immunity from social engineering, since the trick isn't technical, it's psychological.

The Myth That You'd Know Immediately If You'd Been Hacked

Most compromises I hear about weren't dramatic, there was no locked screen or ransom note, just a slow trickle of odd signs that got explained away individually: an email in the sent folder you don't remember sending, a login notification from a country you've never visited, a friend mentioning a strange message from your account. Checking your accounts' recent activity logs occasionally, even when nothing feels wrong, catches this far earlier than waiting for something obvious to happen.

What Actually Keeps You Safe

None of this is about being paranoid or locking yourself away from the internet. It's a handful of habits that work quietly in the background: unique passwords, two factor authentication, a VPN on networks you don't control, and a healthy pause before you click something urgent. If you want a simple starting point, my Safety Toolkit has the tools I actually use and recommend. And if something feels off and you're not sure, get in touch and I'll take a look.