Avoid malware, and what to do if you click

If you do not work in IT, this is the page for you. It is short enough to actually read, and it applies at home as much as at work.

Managers: it is free to link, paste into an intranet or print, and there are posters as well.

The four things that matter

Almost everything that goes wrong comes back to one of these.

1. Do not open attachments you were not expecting. Not even from someone you know, because their account may not be theirs today. Ring them.
2. Never log in from a link in an email. Type the address in yourself, or use a bookmark. This one habit defeats most attacks outright.
3. Never act on a payment or bank-detail change from email alone. Ring the supplier on a number you already had. Not a number in the email.
4. Tell someone immediately if something feels wrong. Speed is the whole game. See below.

Six signs an email is not what it claims

• It is urgent, and something bad happens if you do not act now.
• It arrived unexpectedly, with an attachment you did not ask for.
• The link text and the real destination do not match. Hover and look.
• It asks you to log in, or to confirm your password.
• The sender address is almost right. Almost.
• It asks you to keep it quiet, or to skip the usual process.

Urgency plus secrecy is the combination to be most suspicious of. Real colleagues will wait five minutes while you check.

If you think you clicked something

Do these in order, and do them now rather than after lunch.

1. Do not turn the computer off. Its memory holds the evidence your IT team needs. Turning it off destroys that.
2. Disconnect from the network. Unplug the cable, or turn off Wi-Fi.
3. Ring IT. Ring, do not email, in case email is the problem.
4. Do not delete anything, including the suspicious message.
5. Write down what you saw and what time you saw it. Deadlines under Australian law run from when the organisation became aware, so that note is genuinely useful later.

If you entered a password, say so. It is the single most important detail and the most tempting one to leave out.

Passwords and codes

• Use a password manager. Long and unique beats clever and reused. You cannot remember 80 good passwords and you should not try.
• Turn on multi-factor authentication everywhere it is offered. If you get a choice, a passkey or a security key is much stronger than a code by text message.
• Nobody legitimate will ever ring and ask you for a code. Not IT, not your bank, not the tax office. If someone asks, that is the attack.
• If you get an approval prompt you did not trigger, deny it, then tell IT. Somebody has your password.

Downloads and devices

• The top search result can be a paid advertisement for a fake installer. Go to the software vendor’s own site.
• Cracked or “free” paid software is the most common way passwords get stolen from home machines.
• Do not plug in a USB stick you found. Hand it in.
• Keep your phone and laptop updated. Most attacks use a hole that was already fixed.
• Do not sideload phone apps, and never grant accessibility permissions to a delivery or messaging app.

At home

The same rules apply, and you are your own IT team. Two additions worth the effort: turn on automatic updates everywhere, and check your email address on Have I Been Pwned so you know which of your accounts have been in a breach.

If you have lost money or your identity has been misused, ring IDCARE on 1800 595 160. It is free.

The one number to remember

1300 CYBER1 (1300 292 371). The Australian Cyber Security Hotline, free, 24 hours a day. It is for individuals as well as organisations, and you do not need to know whether something is serious before you ring.

Check what stuck

Take the quiz. Six questions, the reasoning shown for each answer, an instant score, and nothing stored.