Glossary

Account takeover

When someone else gains control of one of your online accounts, usually by using a leaked or guessed password, or by tricking you into handing over a code.

Authenticator app

An app that shows a six-digit code that changes every 30 seconds, used as a second step when you sign in. Safer than codes sent by SMS.

Backup

A separate copy of your files. A good rule of thumb is three copies, on two different kinds of storage, with one kept away from home or in the cloud.

Business email compromise

A scam where criminals pose as a boss, supplier or tradie by email, usually to have an invoice paid into their own bank account.

Credential stuffing

Attackers taking email and password pairs leaked from one website and trying them automatically on many others. It works because people reuse passwords.

Data breach

When information a company holds about you is accessed or released without permission. In Australia, many organisations must tell you if a breach is likely to cause you serious harm.

Deepfake

Fake audio or video made with AI to look or sound like a real person. Used in scams that imitate family members, executives or celebrities.

Encryption

Scrambling information so only someone with the right key can read it. End-to-end encryption means only the people in a conversation can read it, not the company running the service.

HTTPS

The padlock in your browser’s address bar. It means your connection to the site is encrypted. It does not mean the site is honest: scam sites use HTTPS too.

Identity theft

Using your personal details, such as your licence, passport or date of birth, to open accounts, take out loans or commit fraud in your name.

Malware

Any software designed to cause harm: to steal information, spy on you, or damage or lock your device.

Multi-factor authentication (MFA)

Needing two or more kinds of proof to sign in, such as a password plus a code from your phone. Also called two-factor authentication (2FA).

Passkey

A replacement for passwords, stored on your device and unlocked with your fingerprint, face or PIN. Passkeys only work on the real website, so they can’t be phished.

Passphrase

A password made of several random words, such as kettle-orbit-velvet-ninety. Long, and easier to remember than a jumble of symbols.

Password manager

An app that creates, stores and fills in a different strong password for every account, so you only have to remember one.

Patch

A software update that fixes a security weakness. Installing updates promptly is one of the most effective things you can do.

Phishing

Messages pretending to be from someone you trust, designed to get you to click a link, open an attachment or hand over details. Smishing is the SMS version; vishing is by phone.

Ransomware

Malware that locks or encrypts your files and demands payment to release them. Backups are the best protection.

Recovery codes

One-time codes you’re given when you turn on two-factor authentication. They get you back in if you lose your phone, so store them somewhere safe.

Remote access scam

A scammer, often posing as tech support, your bank or the NBN, who talks you into installing software that lets them control your computer.

SIM swap

When a criminal convinces your mobile provider to move your number to their SIM card, so they receive your calls and SMS codes.

Social engineering

Manipulating people rather than computers: using urgency, fear, authority or kindness to get someone to do something they otherwise wouldn’t.

Spyware

Software that secretly monitors what you do on a device, such as your messages, location or keystrokes.

VPN

A virtual private network encrypts your internet traffic between your device and the VPN company. Useful on public Wi-Fi, but it doesn’t make you anonymous or protect you from scams.

Vulnerability

A weakness in software or a device that an attacker could use. A zero-day is one the maker doesn’t know about yet, so there’s no fix available.

Missing a term? Suggest one.