The Online Safety Myths I Wish Would Finally Disappear

The short answer: the online safety myths that catch people out most are that scams are easy to spot by bad spelling, that your bank will always refund you, that iPhones can't be scammed, that a strong password is enough on its own, that public Wi-Fi is fine for "unimportant" browsing, and that you're not worth targeting. Each one used to be at least half true. None of them hold up any more.

Why These Myths Refuse to Die

I hear the same handful of myths again and again, from people who are switched on about most things and still repeat advice that stopped being true years ago, if it ever was. I've written before about the classic myths around antivirus and passwords, but this time I want to tackle a different batch, the ones that catch out otherwise careful people. None of these myths came from nowhere. They usually started as something reasonable, then got stretched past the point of being useful. The trouble is they make people feel safer than they actually are, and that gap is exactly where scammers do their best work.

Myth: Scammers Are Easy to Spot by Their Bad English

This one used to hold up. A lot of it doesn't any more. AI tools have sorted out the spelling mistakes and dodgy grammar that used to give a scam email away in the first line, so a badly written message is only one clue among many now, not proof either way on its own. I've seen phishing emails that read better than some of my own drafts, if I'm honest. What still gives them away is more subtle, an odd sense of urgency, a request that doesn't quite match how the organisation normally contacts you, a link that goes somewhere slightly off when you hover over it. I've written before about the exact red flags I check on every message that lands in my inbox.

Myth: My Bank Will Always Refund Me If I'm Scammed

Banks do refund a lot of fraud cases now under the newer reimbursement rules, and that's genuinely good news for anyone who gets caught out. But "always" is doing a lot of heavy lifting in that sentence. If you authorised the payment yourself, even because you were tricked into it, the bank can still investigate whether you took reasonable care before deciding to refund you, and that's a judgement call that doesn't always go your way. The Financial Ombudsman Service publishes decisions on exactly this kind of dispute, and reading a few of them was enough to convince me I'd rather not find out the hard way where that line sits. I still treat every payment like it's final the second I send it.

Myth: iPhones and Macs Don't Get Hit by Scams

Apple devices are genuinely good at blocking traditional viruses, and that's where this myth comes from. But most of what catches people out now isn't a virus at all, it's a scam text, a fake login page, a phishing email asking you to verify your Apple ID. None of that cares what phone you're holding. I know several people on iPhones who've had their Apple ID phished in the last year alone, which is its own kind of expensive problem given how much banking and photo history usually lives behind it. Two factor authentication and a proper password manager close most of that gap regardless of which phone is in your pocket.

Myth: A Strong Password Alone Is Enough to Keep You Safe

A strong, unique password genuinely matters, but on its own it isn't the finish line people treat it as. Passwords get exposed all the time through data breaches that have nothing to do with how strong yours was, a company you trusted gets hacked and your details end up in a leak regardless of how many symbols you used. That's exactly why two factor authentication matters so much, it means a leaked password alone still isn't enough to get into your account. I check my own email address against known breaches every so often, and I've been caught up in a few over the years despite never reusing passwords. The password is one layer, not the whole wall.

Myth: Public Wi-Fi Is Fine As Long As You're Not Doing Anything Important

"Not doing anything important" is doing a lot of work in that sentence, and most people don't realise how much actually counts. Checking your email, logging into a shopping account, even just staying signed into apps in the background can all leak more than you'd think on a network you don't control. The risk isn't usually someone watching you type your banking password, it's the quieter stuff, an unencrypted app quietly sending your login details in the clear, or a fake hotspot set up to look exactly like the real one. I use NordVPN whenever I'm on a network I don't control, coffee shops, hotels, airports, it's an easy habit that closes the gap without me having to think about which sites are "important" enough to bother protecting.

Myth: I'm Not Important Enough to Be Targeted

I hear this one more than any other, usually from people who'd never think of themselves as a target. The truth is most scams aren't personal at all. They're sent to thousands or millions of people at once by automated tools, and the scammer has no idea who you are until you reply or click. Your email login, your WhatsApp account and your savings are worth something to a criminal whoever you are. Being ordinary doesn't make you invisible, it just means you're one of the many people the net is thrown over.

Myth: Private or Incognito Browsing Keeps Me Anonymous

Incognito mode does one thing well. It stops your own browser saving your history, cookies and searches on that device. That's useful on a shared computer. But the websites you visit can still see you, your internet provider can still see where you go, and if you log into an account, that account knows it's you. It's privacy from the next person who uses your laptop, not privacy from the internet.

Myth: You'd Know Immediately If You'd Been Hacked

Most compromises I hear about weren't dramatic, there was no locked screen or ransom note, just a slow trickle of odd signs that got explained away individually: an email in the sent folder you don't remember sending, a login notification from a country you've never visited, a friend mentioning a strange message from your account. Checking your accounts' recent activity logs occasionally, even when nothing feels wrong, catches this far earlier than waiting for something obvious to happen.

Myth: Scams Only Target Older People

I hear this one from people in their twenties and thirties just as often as anyone else, usually right before they tell me about a scam that nearly caught them out. Younger people are actually targeted differently, not less, think fake concert tickets, rental scams on properties that don't exist, or a "recruiter" offering a remote job that asks for banking details before you've even had an interview. Comfort with technology doesn't translate into immunity from social engineering, since the trick isn't technical, it's psychological.

Myth: Deleting an App or Closing an Account Gets Rid of My Data

Deleting an app from your phone removes the icon, not necessarily what it collected while it was there. Closing an account doesn't always trigger a full deletion of your information either, and even when it does, a copy may already sit in a backup or with a data broker who bought it months earlier. I'm not saying this to make you paranoid about every app you've ever installed, just to explain why the safest move is being careful about what you hand over in the first place, rather than assuming you can tidy it up later. If I've genuinely shared something I regret, the more useful step is a formal data deletion request to the company itself, most are legally required to act on it, rather than assuming an uninstall did the job.

The Padlock Icon Doesn't Mean What Most People Think

For years the advice was simple: look for the little padlock in the address bar before you trust a site. That padlock only tells you the connection between your browser and the site is encrypted, nothing about who actually runs the site or whether they're being honest with you. Free encryption certificates are trivial to get, and most phishing sites now use them as a matter of course precisely because people still associate the padlock with safety. A fake banking page with a padlock is no safer than one without it, it just looks more convincing to someone who was taught the wrong lesson. I still check for it, but it's the last thing I check, not the first. What actually matters is the domain itself, spelled out carefully, checked for the extra letter or the swapped word that a genuine site would never have, not the icon sitting next to it.

Online Safety Myth Questions I Get Asked

What is the biggest online safety myth?

That you'd definitely spot a scam. Almost everyone who's been caught out thought the same, and modern scams are built to feel completely normal until the moment they ask for money or a password.

Do I still need antivirus software?

For most computers, yes, even if it's the free one built into Windows. I've set out how I choose the best antivirus software if you're weighing up whether to pay for one.

Does a VPN make me anonymous online?

No. A VPN hides your traffic from the network you're on and from your internet provider, but the sites and accounts you log into still know it's you. It's a privacy tool, not an invisibility cloak.

How can I check if my details have been in a data breach?

Have I Been Pwned is a free, well-respected site where you can check whether your email address has turned up in a known breach. If it has, change that password and any others that match it.

What Actually Keeps You Safer Than Any Myth

None of these myths are stupid, they're just out of date, and the fix isn't panic, it's a handful of boring habits done consistently. A password manager so you're not reusing the same password everywhere, I use NordPass myself and recommend it to almost everyone I talk to. Two factor authentication switched on for anything that matters. And a healthy pause before you click, type, or pay anything you weren't expecting five minutes ago. If you want the fuller list I actually use myself, I've put it together on my Safety Toolkit page, and if something doesn't sit right, get in touch and I'll have a look with you.

I also share printable checklists and quick safety tips as pins, so follow me on Pinterest too.