Five Personal Cybersecurity Habits, Including the One Most People Forget

The breaches that make headlines involve millions of records, but most of the harm that reaches ordinary people is smaller and more personal: an account taken over because a password was reused, a payment made after a convincing text, an old laptop sold with years of documents still on it.

None of the defences require technical skill. They are habits, and five of them cover most of the risk. We make data erasure tools, so you will not be surprised that we think the fifth matters more than people realise.

Habit 1: Why should I assume I am a target?

Because most attacks on individuals are automated. Bots try leaked passwords on thousands of sites, scam messages go out in bulk, and malware spreads to whatever it reaches. You only need to be reachable, not interesting.

Slow down at the moments that matter: entering card or bank details, filling in forms that ask for personal information, answering unexpected messages that want you to log in or pay, and installing software or browser extensions from unfamiliar sources.

Habit 2: How do I stop reusing passwords?

Use a password manager so every account gets its own long, random password, and protect the manager with one strong passphrase. When a site is breached, nothing else falls with it.

Reused passwords are the most common way accounts are taken over. Criminals take email and password pairs from one breach and try them everywhere else. A password manager, whether built into your browser or phone or a standalone app, removes the temptation to reuse.

• For passwords you must remember, the UK's National Cyber Security Centre suggests three random words joined together.
• Avoid birthdays, pet names, football teams and other guessable details.
• Check whether your email address appears in known breaches using a reputable breach notification service, and change any affected passwords.

Habit 3: Which accounts need two-factor sign-in first?

Email first, because it can reset everything else, then banking and payments, social media and cloud storage. An authenticator app is stronger than text message codes, and passkeys are stronger still.

With two-factor sign-in, a stolen password is not enough on its own. Passkeys, now offered by many large services, replace the password altogether and cannot be phished in the usual way.

Habit 4: How do updates and sharing less protect me?

Most attacks exploit weaknesses that already have a fix, so install updates promptly and do not use systems that no longer receive them. Sharing less means less data to leak in the first place.

• Turn on automatic updates for your operating system, browser and apps.
• Replace or retire systems that are out of support. Our guide to Windows end of support explains what that means after Windows 10.
• Think twice before handing over personal details for loyalty schemes, competitions and sign-ups.
• Be careful on public Wi-Fi with anything sensitive.

Habit 5: Why should I wipe old devices before letting them go?

Because an old phone, laptop or external drive holds saved passwords, sessions, photos, identity scans and financial documents, and deleting files or a quick reset can leave much of it recoverable.

This is the habit people forget. Every device you sell, donate, trade in or recycle should be erased first:

• Windows PC: Reset this PC with Remove everything and clean data switched on, or a bootable erasure tool for older machines and desktops with several drives.
• Mac: Erase All Content and Settings on supported models; see our Mac wiping guide.
• Phones and tablets: remove your Apple or Google account first so the activation lock is released, then erase the device.
• External drives and memory cards: erase them too, or keep them.

Our checklist for selling an old laptop or PC walks through the full process.

What should I do if something goes wrong?

Change the affected password, starting with email, and sign out of other sessions. Call your bank straight away if money is involved, and report fraud to the police.

• England, Wales and Northern Ireland: Report Fraud, which replaced Action Fraud in December 2025, at reportfraud.police.uk or 0300 123 2040.
• Scotland: Police Scotland on 101.
• Suspicious emails can be forwarded to report@phishing.gov.uk, and scam texts to 7726.

How does RedKey USB help with the fifth habit?

RedKey USB erases computers from USB, outside the installed operating system, covering every selected disk on the machine. The Ultimate edition also erases selected Apple and Android phones and tablets connected by cable.

That makes Ultimate a good fit for a household clearing out a mix of laptops, phones and tablets. Mobile support depends on the exact model and software version, so check our guidance first. Home and Professional cover computers only; Home shows results on screen, while Professional and Ultimate also save PDF reports. Our article on erasing mobile phones explains the phone side in more detail.

Frequently asked questions

What is the most important cybersecurity step for individuals?

Stopping password reuse, ideally with a password manager, followed closely by two-factor sign-in on your email account.

Is a factory reset enough for an old phone?

On a modern encrypted phone a reset after removing your accounts is a reasonable start. A dedicated erasure tool adds confirmation of the result.

Where do I report fraud in the UK?

In England, Wales and Northern Ireland use Report Fraud. In Scotland, contact Police Scotland on 101.

Ready to erase your own devices? See RedKey USB Ultimate. Related reading: How to Erase Mobile Phones Before Disposal and What Is Secure Data Wiping?.