Cybersecurity Basics for Everyone: Spot Spear Phishing, Vishing, and Social Engineering, and Lock Down Your Org

Most of the write-ups on this site are about a specific bug in a specific product. This one is different. It's about the attacks that work regardless of what software you run, because they target people, habits, and permissions instead of code.

Year after year, the big breach reports land on the same conclusion: the human element (a clicked link, a phone call that sounded legitimate, a password reused from an old breach, an over-privileged account) is involved in the majority of breaches. AI has made those attacks cheaper, faster, and more convincing. A voice clone needs a few seconds of audio. A personalized phishing email takes seconds to write in perfect English.

The good news: the defenses are mostly free, mostly habits, and they work for a retiree, a five-person shop, a YouTuber, and a startup shipping code written with AI help.

🛑Editorial note: This is a defensive guide. We describe how attacks look so you can recognize them, not how to run them. No templates, scripts, or tooling for attackers.

The short version

If you only do…	Do this
One thing	Use a password manager and a unique password for every account
Two things	Add passkeys or a hardware key to your email, bank, and password manager
Three things	Adopt a verify-out-of-band rule: any urgent request for money, codes, or access gets confirmed through a channel you already trust
For a business	Add least privilege, offline backups, and a one-page incident plan
For creators	Lock down the email behind your channel and scrub your home address from data brokers
For vibe coders	No secrets in code, review what the AI wrote, and turn on database access rules

Part 1: Recognizing the attacks

Phishing vs. spear phishing vs. whaling

Phishing is the mass version: one generic message sent to millions. "Your package couldn't be delivered." "Your account is locked." It works on volume.

Spear phishing is targeted. The attacker researches you first, using your LinkedIn, your company's website, a conference you spoke at, a vendor you work with, and writes a message that only makes sense for you. It references a real project, a real colleague's name, a real invoice. That's what makes it dangerous: the details are correct.

Whaling is spear phishing aimed at executives, finance staff, or anyone who can move money or approve access. Business email compromise (BEC), where an attacker poses as a CEO or vendor to redirect a payment, is consistently one of the costliest cybercrimes the FBI tracks.

The red flags (they still work, even with AI)

AI has killed the old "look for bad spelling" advice. A modern phishing email can be flawless. Look for these instead:

Urgency or secrecy. "Needs to happen before end of day." "Don't mention this to anyone yet." Pressure is the attacker's main tool, because it stops you from checking.
A change in process. New bank details for a vendor. A gift card request. "Use my personal email for this." Legitimate processes rarely change by email.
A request for a credential, a code, or a payment. Real IT will never ask for your password. No legitimate service will call you to ask for the 2FA code it just texted you.
Mismatched sender details. The display name says your CEO; the actual address is a free webmail account or a lookalike domain like rnicrosoft (r-n instead of m) or paypa1 (a one instead of an L).
Links that don't go where they say. Hover (desktop) or long-press (mobile) to see the real destination before clicking. Watch for the real brand appearing in the wrong place, such as yourbank.account-verify.example, where the domain is actually the last part before the slash.
Unexpected attachments, especially HTML files, password-protected archives, or "secure documents" that ask you to log in to view them.
QR codes in emails or on stickers. "Quishing" moves the link to your phone, where it's harder to inspect and outside your company's email filters.
It's too relevant. If a message references something semi-private and asks you to act, that's a reason to slow down, not a reason to trust it.

💡The golden rule: Never use the contact details in the message to verify the message. Look up the number or website yourself, or use one you already have saved, and reach out that way.

Vishing and smishing

Vishing is voice phishing: a phone call. Smishing is SMS phishing: a text. Both are surging because phones have fewer filters than email and people trust voices.

Common scripts:

"This is the fraud department." They say there's suspicious activity and need you to "verify" by reading back a code. That code is your 2FA code, and they're logging in as you while you talk.
"This is IT / the help desk." They need you to install a remote-access tool, approve an MFA prompt, or reset your password "to fix an issue." Several of the biggest corporate breaches of the past few years began exactly this way, sometimes with the attacker calling the help desk pretending to be the employee.
"Your family member is in trouble." Bail, an accident, a kidnapping. Now often with a cloned voice built from a few seconds of social media video.
Government impersonation. The IRS, police, immigration, or a court threatening arrest unless you pay now, typically in gift cards, crypto, or a wire.
Toll, package, and delivery texts. A small "unpaid fee" link that harvests your card details.

How to defend:

Hang up and call back on a number you look up yourself. Real banks and agencies are fine with this.
Set a family safe word. A word only your household knows, to use when anyone calls claiming to be a relative in an emergency. It defeats voice clones instantly.
Never read out a code you received by text or app. The code is for typing into a site you went to yourself, never for telling a person.
Never approve an MFA push you didn't start. A flood of push prompts ("MFA fatigue") means someone has your password. Deny them, then change the password.
Businesses: require help-desk identity verification that doesn't rely on information an attacker could find online (employee ID and date of birth are not enough). Use a call-back to the number on file, or video verification with a manager.

Deepfakes and AI-assisted social engineering

AI makes impersonation cheap. Real cases now include employees joining a video call where every other participant was a deepfake, then wiring millions. Expect:

Cloned voices of executives leaving voicemails.
Fake video calls with "leadership" asking for an urgent transfer.
Perfect, personalized spear phishing generated at scale.
Fake job candidates (and fake recruiters) using AI-generated faces and scripted answers to get hired or harvest data.

The defense isn't spotting the fake, which gets harder every year. It's process: big payments and access changes require a second approver and a verification call on a known number, no matter how real the request looks or sounds.

Other social engineering tricks

Pretexting: a built-up cover story ("I'm the new auditor", "I'm from your ISP") to get information over several conversations.
Baiting: a free download, a USB stick in the parking lot, a "leaked salary spreadsheet."
Tailgating: following an employee through a badge door. Politely asking "Who are you here to see?" is not rude, it's the job.
Fake support: search ads and social media accounts posing as a company's customer support. Always reach support through the official website or app.
Romance and "pig butchering" scams: long-term relationship building that ends in a fake crypto investment. If an online friend you've never met introduces an investment opportunity, stop.
Fake browser "fix" prompts: a page claims something is broken and tells you to copy a command and paste it into a terminal or the Run box. No legitimate website will ever ask you to do this.

Part 2: Personal defenses that actually work

Passwords and password managers

Reused passwords are how one breach becomes ten. When a site you used in 2019 leaks, attackers try that email and password everywhere else ("credential stuffing").

Use a password manager. It generates and remembers a unique password for every site, and it won't autofill on a lookalike phishing domain, which is a quiet anti-phishing feature. Good options include Bitwarden, 1Password, and Proton Pass; Apple's Passwords app and Google Password Manager are fine starting points if you live in one ecosystem. See our Bitwarden vs. 1Password comparison.
One strong master password. Make it a long passphrase of four to six random words. It's the one password you memorize.
Check for breached passwords. Most managers flag reused and breached passwords. Have I Been Pwned tells you which breaches your email has appeared in.
Stop changing passwords on a schedule unless there's a reason. Current NIST guidance favors long, unique passwords changed when compromise is suspected, not forced rotation every 90 days.

Multi-factor authentication (and which kind)

Not all MFA is equal. From weakest to strongest:

SMS codes: better than nothing, but vulnerable to SIM swaps and phishing.
Authenticator app codes (TOTP): stronger, but can still be phished by a fake login page that relays your code in real time.
Push approval with number matching: good, if you never approve prompts you didn't start.
Passkeys and hardware security keys (FIDO2/WebAuthn): phishing-resistant. The key checks the website's real domain, so a lookalike site gets nothing.

Put passkeys or a hardware key (such as a YubiKey) on your email, password manager, bank, and domain registrar first. Your email is the master key to everything else, because every "forgot password" link goes there. More in our guide to 2FA apps and hardware keys.

Protect your phone number (SIM swap defense)

Add a port-out PIN or number lock with your mobile carrier. Most major carriers offer one.
Remove your phone number as a recovery method on important accounts where you have a stronger option.
If your phone suddenly loses service for no reason, call your carrier from another phone right away.

Data brokers and DeleteMe-style removal services

Spear phishing, vishing, doxxing, and SIM swaps all get easier when your home address, phone number, relatives' names, and age are sitting on hundreds of "people search" sites. Shrinking that footprint is one of the highest-value privacy moves you can make.

Removal services: DeleteMe, Incogni, Optery, Kanary, and Aura submit opt-out requests to data brokers on your behalf and repeat them, because brokers re-list people. Expect to pay a yearly fee. Optery offers a free scan that shows where you're listed.
Do it yourself: you can opt out manually for free. It's slow, it has to be repeated, and some sites make it deliberately painful, but it works. Start with the largest people-search sites that show up when you search your own name.
State tools: California's DELETE Act created the DROP platform, which lets residents send one deletion request to every registered data broker. Check whether your state offers something similar.
Google's "Results about you" tool can alert you when your phone number or address appears in search results and request removal.
Freeze your credit with all three bureaus (Equifax, Experian, TransUnion). It's free in the US, takes a few minutes, and stops new accounts being opened in your name. Unfreeze temporarily when you need to apply for credit.

Personal OPSEC

OPSEC (operational security) means thinking about what an attacker could learn from what you share, and sharing less of it.

Assume posts are permanent and public. Vacation photos in real time tell people your home is empty. Your pet's name and first school are classic security-question answers.
Make security questions fake. Store random answers in your password manager.
Strip photo location data before posting. Most phones can remove location when sharing.
Separate identities. Use different emails for banking, shopping, and public or creator work. Email alias services (such as SimpleLogin, Firefox Relay, or Apple's Hide My Email) give every site its own address, so a leak or a phishing email to an unexpected alias is obvious.
Think before you answer quizzes ("your rapper name is your street plus your first car").
Watch what's in the background of video calls, streams, and photos: whiteboards, mail with your address, badge photos, screens.

VPNs: what they do and don't do

A VPN encrypts traffic between your device and the VPN provider, and hides your IP address from the sites you visit.

A VPN helps with:

Untrusted Wi-Fi (hotels, airports, cafés), hiding your browsing from the network operator.
Hiding your activity from your internet provider.
Masking your home IP address from sites, games, and streams. This matters for creators who get targeted.

A VPN does not:

Stop phishing, malware, or scams.
Make you anonymous. You're shifting trust from your ISP to the VPN company, so pick one with a strong no-logs track record and independent audits, such as Mullvad or Proton VPN. See our Mullvad vs. Proton comparison.
Protect accounts with weak passwords.

Avoid "free" VPNs that make money from your data. For businesses, a traditional VPN that drops a user onto the whole internal network is increasingly being replaced by zero trust network access (ZTNA), which grants access to specific apps, not the entire network (more on that below).

Keep things updated

Turn on automatic updates for your phone, computer, browser, and router.
Replace devices that no longer get security updates, especially routers and old phones.
On your home router: change the default admin password, turn off remote administration and WPS, and update the firmware.
Back up your important files using the 3-2-1 rule: three copies, two different types of storage, one offsite or offline.

Part 3: For organizations of every size

These principles scale from a two-person business to an enterprise. The tools change; the ideas don't.

Identity and access management (IAM)

Identity is the new perimeter. Attackers increasingly don't "hack in", they log in with stolen credentials, tokens, or sessions. IAM is how you control who can do what.

One identity per person. No shared logins. Shared accounts make it impossible to know who did what, and impossible to remove one person's access.
Single sign-on (SSO) wherever possible, through Google Workspace, Microsoft Entra ID, Okta, or similar. One place to enforce MFA, one place to switch someone off.
Phishing-resistant MFA for everyone, starting with admins, finance, and IT.
Joiner, mover, leaver process. When someone joins, they get only what their role needs. When they change roles, old access is removed, not just new access added. When they leave, everything is revoked the same day, including SaaS apps, API keys, and shared vault items.
Review access regularly. Quarterly, ask each manager to confirm who on their team still needs what.
Watch non-human identities. Service accounts, API keys, OAuth apps, bots, and AI agents often outnumber people and are rarely reviewed. Give each one an owner, an expiry date, and the minimum permissions.

The principle of least privilege

Least privilege means every person, device, app, and AI agent gets the minimum access needed to do its job, and no more, for no longer than necessary.

Separate admin accounts. Admins use a normal account for email and browsing, and a separate admin account only for admin work. Phishing the daily account then doesn't hand over the keys.
No local admin rights by default on staff computers. This alone blocks a large share of malware.
Just-in-time access. Elevated access is granted for a few hours when requested and approved, then expires automatically.
Least privilege for data, too. Not everyone needs access to the shared drive with payroll in it. Check "anyone with the link" sharing settings.
Separation of duties. The person who adds a new vendor shouldn't be the same person who approves paying them. This one control stops most BEC fraud.

Zero trust in plain English

Zero trust means "never trust, always verify." Being on the office network, or on the VPN, doesn't automatically make a request trustworthy. Every request is checked: who is this, is their device healthy, should they have access to this specific thing right now? It's least privilege applied continuously. You don't buy zero trust as a product; you move toward it by putting SSO, MFA, device checks, and app-level access in front of everything.

Network segmentation

Network segmentation means splitting a network into separate zones so that a compromise in one zone can't easily spread to the others. Attackers who get a foothold almost always try to move laterally, from the receptionist's laptop to the file server to the domain controller to the backups. Segmentation puts walls in their path.

For a home or very small office, this can be as simple as:

A guest network for visitors.
A separate network (or VLAN) for smart devices and IoT: cameras, TVs, smart plugs, printers. These are often poorly secured and rarely updated.
Your work devices on their own network.

For a business:

Separate zones for staff devices, servers, guest Wi-Fi, IoT and building systems, point-of-sale or payment systems, and production versus development.
Deny by default between zones, and only allow the specific traffic that's needed (for example, staff laptops can reach the file server on its file-sharing port, and nothing else).
Isolate management interfaces. Router, firewall, hypervisor, and server admin panels should only be reachable from a dedicated admin network, never from the internet.
Protect backups especially well. Ransomware crews look for backups first. Keep at least one copy offline or immutable (it can't be modified or deleted for a set period), with separate credentials that aren't tied to your main directory.
Microsegmentation goes further, controlling traffic between individual workloads, and is common in cloud and data-center environments.
In the cloud, the same idea applies: separate accounts or projects for production and development, private subnets for databases, and tight security group rules.

Email and domain security

Set up SPF, DKIM, and DMARC for your domain. These DNS records make it much harder for attackers to send email that appears to come from your domain, and DMARC reports show you who's trying. Most email providers have step-by-step guides.
Tag external email with a visible "External" banner so a message from "your CEO" that arrived from outside stands out.
Lock your domain at the registrar with MFA and registrar lock. Losing your domain means losing your email and website.
Keep your inventory current: know what devices, accounts, SaaS apps, and domains you have. You can't protect what you don't know about.

Security awareness that isn't a checkbox

Short and frequent beats long and annual. Five minutes a month on the scam that's going around right now.
Run phishing simulations to teach, not to punish. Shaming people for clicking makes them hide mistakes.
Make reporting easy and celebrated. A "Report phish" button and a thank-you for every report. The employee who reports a phish after clicking, quickly, is your best early-warning system.
Practice the verification rule. Everyone, including the CEO, should expect to be called back to confirm a payment change, and nobody should be offended.

Small business essentials

If you have no IT department, start here. Most of these are free or included in what you already pay for:

Turn on MFA for business email, banking, payroll, and your accounting software.
Use a business password manager with shared vaults instead of a spreadsheet of passwords.
Turn on automatic updates everywhere and use the built-in protection (Microsoft Defender, macOS XProtect and Gatekeeper).
Back up to a service that keeps version history, and test that you can actually restore.
Require a call-back on a known number before changing any vendor's or employee's bank details.
Separate guest Wi-Fi from the business network.
Know who to call: your bank's fraud line, your IT provider, your cyber insurer if you have one, and local law enforcement. Write the numbers down somewhere that isn't your computer.
Use free frameworks like CISA's Cyber Essentials and the FTC's small business cybersecurity guides as a checklist.

Part 4: Incident response, before, during, and after

Every organization will have an incident eventually. The difference between a bad week and a business-ending event is usually preparation.

Before: prepare

Write a one-page incident plan. Who's in charge, who to call (IT, legal, insurer, bank, law enforcement), how you'll communicate if email is down, and where the backups are. Print it.
Keep an out-of-band contact list (phone numbers, a group chat on a separate platform) for when your main systems may be compromised.
Turn on logging and keep the logs long enough to investigate: sign-ins, admin actions, email forwarding rules, cloud audit logs.
Run a tabletop exercise once a year: "It's Monday morning and every screen shows a ransom note. What do we do?" Walk through it for an hour.
Know your obligations. Many industries and regions have breach notification rules with tight deadlines. Your cyber insurer may require you to call them before hiring outside help.

During: the first hours

Don't panic, and don't destroy evidence. Don't wipe or reimage machines yet. Disconnect affected devices from the network (unplug the cable or turn off Wi-Fi) rather than powering them off, if you can, since memory can hold useful evidence.
Contain. Isolate affected systems and accounts. Disable compromised accounts, revoke active sessions and tokens, and reset passwords from a known-clean device. Changing the password alone doesn't always kill an attacker's existing session.
Check for persistence. Attackers leave themselves ways back in: email forwarding rules, new admin accounts, new MFA devices registered to an account, OAuth app grants, scheduled tasks, remote-access tools.
Communicate on a clean channel. Assume the attacker can read your email. Coordinate by phone or a separate platform.
Bring in help. Your IT provider, an incident response firm (often through your cyber insurer), and law enforcement. In the US, report to the FBI's IC3 and to CISA; for fraud affecting individuals, the FTC.
If money was sent, call the bank immediately. Wire recalls are time-sensitive, sometimes measured in hours.
Write everything down with timestamps: what you saw, what you did, who you talked to.

After: recover and learn

Restore from known-good backups, after you're confident the attacker is out. Restoring onto a still-compromised network just gets you encrypted twice.
Rotate secrets broadly: passwords, API keys, service account credentials, and certificates the attacker may have touched.
Notify affected customers, partners, and regulators as required, honestly and promptly.
Hold a blameless post-incident review. What happened, what helped, what slowed you down, what will change. Then actually make those changes.

For individuals: if you think you've been scammed or hacked

Money sent? Call your bank or card issuer right away using the number on the back of your card.
Account taken over? Use the service's official account recovery, change the password, sign out all other sessions, check for new recovery emails, phone numbers, and forwarding rules, then turn on stronger MFA.
Identity theft? Freeze your credit and, in the US, file at IdentityTheft.gov, which builds a recovery plan for you.
Malware? Disconnect from the internet, back up important files, and get help, or reset the device to factory settings.
Report it to the FTC or IC3 in the US, Action Fraud in the UK, or your country's equivalent. Reports help shut down scams even when your money can't be recovered.
Don't be embarrassed. These scams are built by professionals to fool smart people. Telling others is how the next person avoids it.

Part 5: Content creators and public figures

If you have an audience, you're a target, because your account itself is valuable: it can be sold, used to push crypto scams to your followers, or held for ransom.

Lock down the email behind your channel. It controls everything. Use a dedicated email address for your accounts (not the one on your business inquiries page), with a passkey or hardware key.
Be suspicious of sponsorship offers with attachments or "download our software to review it." Fake sponsorship deals carrying malware are one of the most common ways creator channels get hijacked, because the malware steals your logged-in browser sessions, bypassing MFA entirely.
Never open "contracts" or "media kits" that are executables, archives, or require disabling security. Real brands send PDFs or share through known platforms.
Separate devices or browser profiles for channel admin work versus everyday browsing and downloads.
Use platform roles. Give editors and managers their own accounts with limited permissions instead of sharing your password.
Protect your location. Use a PO box or virtual mailbox for business mail, a removal service for data brokers, and check your streams and photos for identifying windows, street signs, and reflections.
Prepare for doxxing and swatting. Know your platform's emergency contacts. Some police departments let at-risk people register their address in advance.
Watch for impersonators in your comments and DMs ("Congrats, you won! Message this account"). Pin a post telling followers you'll never DM them asking for money.

Part 6: Vibe coders and anyone shipping AI-written code

AI coding tools let more people build and ship apps than ever. That's great. It also means more apps go live with mistakes an experienced developer would have caught. If you're vibe coding, letting an AI write most of the code while you steer, these are the issues that show up again and again:

Secrets in code. API keys pasted directly into source files, then pushed to a public repository or shipped in front-end JavaScript where anyone can read them. Bots scan public repositories for leaked keys within minutes. Keep secrets in environment variables or a secrets manager, add your env file to .gitignore, and turn on GitHub secret scanning and push protection.
Anything in the browser is public. API keys, "hidden" admin checks, and pricing logic in front-end code can all be read and changed by users. Real authorization has to happen on the server.
Open databases. Backend-as-a-service tools like Supabase and Firebase are safe when access rules are configured, and wide open when they're not. Turn on row-level security or equivalent rules, and test that one user can't read another user's data.
Missing authorization checks. The AI built a login page, but does every API route actually check who is asking and whether they're allowed? Try changing an ID in a URL to another user's ID. If you see their data, so can anyone.
Hallucinated or malicious packages. AI assistants sometimes suggest packages that don't exist, and attackers register those names ("slopsquatting"). Before installing anything, check it exists, is widely used, and is the one you meant. Pin versions and use a lockfile. Our LiteLLM supply chain write-up shows what happens when a trusted package goes bad.
Over-permissioned AI agents. Coding agents and MCP tools that can run commands, read files, or touch production deserve least privilege too. Don't give an agent production credentials it doesn't need, review what it wants to run, and be wary of agents reading untrusted content (web pages, issues, emails), which can contain prompt injection that tries to hijack them.
No rate limits or cost caps. An exposed AI API key or an unprotected sign-up form can run up a huge bill overnight. Set spending limits with every provider.
Ask the AI to review, then review it yourself. Prompting "review this code for security issues like injection, broken access control, and exposed secrets" catches a lot, but it isn't a guarantee. Learn the basics of the OWASP Top 10, and get a human review before handling payments or sensitive data.

Our guide to Claude Code for security workflows covers safer ways to use AI coding agents.

Part 7: A free and low-cost toolkit

Need	Tools to look at
Password manager	Bitwarden, 1Password, Proton Pass, Apple Passwords
Phishing-resistant MFA	Passkeys, YubiKey, Google Titan Key
Authenticator apps	Ente Auth, Aegis (Android), 2FAS
Breach checking	Have I Been Pwned, your password manager's breach report
Data broker removal	DeleteMe, Incogni, Optery, Kanary, Aura; Google "Results about you"; California DROP
Email aliases	SimpleLogin, Firefox Relay, Apple Hide My Email, DuckDuckGo Email Protection
VPN	Mullvad, Proton VPN, IVPN
Secure messaging	Signal
Encrypted DNS and filtering	Quad9, NextDNS, Cloudflare for Families
Link and file checking	VirusTotal (don't upload confidential files)
Backups	Your OS's built-in backup plus a versioned cloud backup, and an offline drive
Code and secrets	GitHub secret scanning and push protection, Dependabot, OWASP resources
Business checklists	CISA Cyber Essentials, FTC small business guides, NIST CSF 2.0 small business resources

We don't have affiliate relationships with any of the tools above. They're listed because they're widely used and well regarded.

A 30-minute checklist

If you do nothing else this week:

Install a password manager and change your email password to a unique passphrase.
Add a passkey or hardware key to your main email account.
Check your email on Have I Been Pwned and change any reused passwords that show up.
Set a port-out PIN with your mobile carrier.
Freeze your credit with all three bureaus.
Agree on a family safe word.
Turn on automatic updates on your phone, computer, and browser.
Run a free data broker scan and start removals.
Businesses: write down who to call in an incident, and make the call-back rule for payment changes official.

Learn more

Want to go deeper? The Google Cybersecurity Certificate and ISC2 Certified in Cybersecurity both cover these fundamentals from scratch, and TryHackMe's Cyber Security 101 lets you practice in a hands-on lab.

🧭Bottom line: Attackers go after the easiest path, and that's usually a person, a password, or a permission, not a piece of code. Unique passwords, phishing-resistant MFA, a habit of verifying through a trusted channel, least privilege, segmented networks, offline backups, and a plan for the bad day will stop the overwhelming majority of real-world attacks.

Sources

← All Write-ups