# Avoid malware, and what to do if you click > Plain-English malware advice for anyone, at work or at home. What to watch for, what to do if you have clicked something, and who to tell. Source: https://www.malware.com.au/avoid-malware/ Last updated: 2026-08-25 --- If you do not work in IT, this is the page for you. It is short enough to actually read, and it applies at home as much as at work. Managers: it is free to link, paste into an intranet or print, and there are [posters](/awareness/) as well. ## The four things that matter Almost everything that goes wrong comes back to one of these. 1. **Do not open attachments you were not expecting.** Not even from someone you know, because their account may not be theirs today. Ring them. 2. **Never log in from a link in an email.** Type the address in yourself, or use a bookmark. This one habit defeats most attacks outright. 3. **Never act on a payment or bank-detail change from email alone.** Ring the supplier on a number you already had. Not a number in the email. 4. **Tell someone immediately if something feels wrong.** Speed is the whole game. See below. ## Six signs an email is not what it claims - It is urgent, and something bad happens if you do not act now. - It arrived unexpectedly, with an attachment you did not ask for. - The link text and the real destination do not match. Hover and look. - It asks you to log in, or to confirm your password. - The sender address is almost right. Almost. - It asks you to keep it quiet, or to skip the usual process. Urgency plus secrecy is the combination to be most suspicious of. Real colleagues will wait five minutes while you check. ## If you think you clicked something Do these in order, and do them now rather than after lunch. 1. **Do not turn the computer off.** Its memory holds the evidence your IT team needs. Turning it off destroys that. 2. **Disconnect from the network.** Unplug the cable, or turn off Wi-Fi. 3. **Ring IT.** Ring, do not email, in case email is the problem. 4. **Do not delete anything,** including the suspicious message. 5. **Write down what you saw and what time you saw it.** Deadlines under Australian law run from when the organisation became aware, so that note is genuinely useful later. **If you entered a password, say so.** It is the single most important detail and the most tempting one to leave out. ## Passwords and codes - **Use a password manager.** Long and unique beats clever and reused. You cannot remember 80 good passwords and you should not try. - **Turn on multi-factor authentication** everywhere it is offered. If you get a choice, a passkey or a security key is much stronger than a code by text message. - **Nobody legitimate will ever ring and ask you for a code.** Not IT, not your bank, not the tax office. If someone asks, that is the attack. - **If you get an approval prompt you did not trigger, deny it,** then tell IT. Somebody has your password. ## Downloads and devices - **The top search result can be a paid advertisement for a fake installer.** Go to the software vendor's own site. - **Cracked or "free" paid software** is the most common way passwords get stolen from home machines. - **Do not plug in a USB stick you found.** Hand it in. - **Keep your phone and laptop updated.** Most attacks use a hole that was already fixed. - **Do not sideload phone apps,** and never grant accessibility permissions to a delivery or messaging app. ## At home The same rules apply, and you are your own IT team. Two additions worth the effort: turn on automatic updates everywhere, and check your email address on [Have I Been Pwned](https://haveibeenpwned.com) so you know which of your accounts have been in a breach. If you have lost money or your identity has been misused, ring [IDCARE](https://www.idcare.org) on 1800 595 160. It is free. ## The one number to remember **1300 CYBER1** (1300 292 371). The Australian Cyber Security Hotline, free, 24 hours a day. It is for individuals as well as organisations, and you do not need to know whether something is serious before you ring. ## Check what stuck [Take the quiz](/quiz/). Six questions, the reasoning shown for each answer, an instant score, and nothing stored. ## Common questions ### What should I do if I clicked a suspicious link? Tell your IT team straight away, and do not spend time working out whether it was really a problem. If you entered a password, say so, because that changes what they need to do. Reporting in the first ten minutes usually turns an incident into a non-event; reporting the next morning often does not. ### Will I get in trouble for clicking something? You should not, and any organisation that punishes reporting is making itself less safe. The people who design these emails are professionals and they are good at it. What causes real damage is not the click, it is the hour of silence afterwards. ### How can I tell if an email is fake? Look for urgency, an unexpected attachment, a request to log in, or a sender address that is almost right. Any one of those is enough to stop and check by ringing the person on a number you already had. Do not reply to the email to check. ## Primary sources - [ASD: Personal security guides](https://www.cyber.gov.au/protect-yourself) - [ASD: Report a cyber security incident](https://www.cyber.gov.au/report) --- General information only, not legal advice. Whether an obligation applies turns on facts about your organisation and the incident. Check the primary sources above and obtain legal advice. Emergency: Australian Cyber Security Hotline 1300 CYBER1 (1300 292 371), 24/7.