Stay safe online — and know what to do if something goes wrong

Red flags to watch for

• A sense of urgency or threat (“your account will be closed”)
• A sender address that doesn’t match the real company
• Generic greetings, odd grammar, or slightly-off logos
• Links that don’t go where the text says (hover to check)
• Requests for passwords, codes, gift cards, or wire transfers
• Unexpected attachments — invoices, “voicemails,” shipping labels

Types you’ll run into

• Email phishing — the classic fake login or invoice
• Smishing — phishing by text message
• Vishing — phishing by phone call (“Microsoft support”)
• Business Email Compromise (BEC) — a spoofed boss or vendor changing payment details

If you clicked or replied

• Disconnect the device if you downloaded anything
• Change the password for that account right away
• Turn on multi-factor authentication
• Watch the account and your bank for unusual activity
• Report it (links below) and tell us — we can help

Build better passwords

• Make them long — a passphrase of four or more random words beats a short complex one
• Use a different password for every account
• Let a password manager create and remember them
• Never reuse your email password anywhere else

Turn on multi-factor authentication (MFA)

• MFA asks for a second proof — a code or a tap — when you log in
• An authenticator app or hardware key is stronger than text-message codes
• Passkeys (face or fingerprint) are even better where offered
• We will never call to ask for a one-time code — and neither will your bank

If a password may be exposed

• Change it immediately, and anywhere you reused it
• Check your email at Have I Been Pwned
• Turn on MFA if you haven’t already
• Switch to a password manager to fix reuse for good

Prevent it

• Keep Windows, macOS, and your apps patched and up to date
• Use reputable security software and a firewall
• Don’t open unexpected attachments or enable macros
• Limit administrator rights to people who truly need them

The 3-2-1 backup rule

• Keep 3 copies of important data
• On 2 different types of media
• With 1 copy off-site or offline
• Test that you can actually restore — an untested backup isn’t a backup

If you’re hit

• Disconnect the device from the network immediately
• Don’t pay first — paying doesn’t guarantee recovery and funds crime
• Report it at StopRansomware.gov and IC3
• Call us — we can help you contain it and restore from backup

Common scams

• Tech-support scams — pop-ups or calls claiming your PC is infected
• Business Email Compromise — a fake boss or vendor changing payment info
• Gift-card & crypto demands — no real agency asks for these
• Invoice and overpayment scams
• Romance and “too-good-to-be-true” investment scams

Universal red flags

• Pressure to act right now
• Requests for gift cards, wire transfers, or crypto
• Payment details that suddenly “changed” — verify by phone
• Anyone discouraging you from checking with someone else

Protect yourself

• Slow down and verify through a known phone number
• Confirm money or payment requests in person or by phone
• Never give remote access to an unsolicited caller
• When in doubt, ask us before you act

Safer browsing

• Keep your browser and devices updated — updates fix security holes
• Look for HTTPS, but remember it only means the connection is private, not that the site is trustworthy
• Be cautious with downloads and browser extensions
• Use a password manager so you only log in on the real site

Wi-Fi & your network

• Avoid logging into sensitive accounts on public Wi-Fi
• Consider a reputable VPN when you must use public networks
• Change the default admin password on your router
• Run a separate guest Wi-Fi for visitors and smart devices
• Keep your router’s firmware updated

Step 1 — Protect & contain

• Disconnect the affected device from the network or internet.
• Call HTDNET at 540-905-8111 — we can guide you in real time.
• Change your passwords from a different, clean device — start with email.
• Turn on multi-factor authentication (MFA).
• Contact your bank or card issuer if money or accounts are involved.

Walk through it step by step — open “Help, I’ve been hacked” →

Step 2 — Report the crime

• Document everything — screenshots, dates, amounts, and accounts.
• Report to the FBI at IC3.gov and scams to the FTC.
• If your identity was stolen, get a recovery plan at IdentityTheft.gov.
• File a local police report; businesses also report to CISA.

Step 3 — Notify & monitor

• Tell anyone who could be affected — customers, coworkers, family, friends.
• Watch your accounts and credit for weeks to months — fraud often shows up later.
• Set up bank and credit alerts; freeze your credit if your SSN was exposed.

How HTDNET can help

• Scan and clean affected devices.
• Restore your data from backup.
• Harden your accounts and network to make a repeat far less likely.
• Call us at 540-905-8111 — we’ll handle the heavy lifting.