The internet makes everyday life easier—but staying safe online requires a few simple habits.
We use the internet to manage our finances, shop, communicate, work, access government services and store personal information. That convenience also creates opportunities for fraudsters and cybercriminals to steal passwords, personal information, banking credentials and money. The good news is that you don't need to be a cybersecurity expert to improve your online security.
Start with four simple cornerstones:
These habits can help reduce your risk of phishing, account takeovers, malware and other online threats.
Your passwords are one of the most important lines of defence protecting your online accounts. One of the biggest mistakes you can make is using the same password for multiple accounts.If a fraudster obtains your username and password from one website, they may try those same credentials on other websites. This type of attack is known as credential stuffing.
Whenever possible:
The Canadian Centre for Cyber Security recommends using different passwords or passphrases for different accounts, particularly accounts containing sensitive information.
A strong password is important, but it shouldn't be your only layer of protection. Multi-factor authentication (MFA) requires two or more authentication factors when you sign in. This provides an additional layer of protection if someone obtains your password.
Enable MFA on important accounts whenever it is available, particularly for:
Where available, consider stronger authentication options such as authenticator apps or passkeys.
Remember: Never give your password, PIN or one-time verification code to someone who contacts you unexpectedly.
A website can look exactly like the real thing and still be fraudulent. Phishing scams often use fake websites designed to imitate legitimate financial institutions, retailers, government organizations and other trusted businesses.
A fraudulent website may copy:
The goal is to convince you to enter your username, password, banking information or other sensitive details.
If an email or text message asks you to sign in, don't automatically click the link.
Instead:
The Canadian Centre for Cyber Security specifically recommends avoiding links and attachments in unexpected emails or text messages unless you've confirmed the sender and the request.
Before entering sensitive information, look carefully at the website address.
Be cautious about:
No. HTTPS helps encrypt the connection between your browser and a website, but it does not prove that the website belongs to the organization you think it does. Fraudsters can create websites that use HTTPS too.
For sensitive activities such as online banking, the safest approach is to navigate directly to your financial institution's official website or use its official app.
Public Wi-Fi can be convenient when you're at a coffee shop, hotel, airport, library or other public location. But you shouldn't treat every public Wi-Fi network as trustworthy. Fraudsters can create fake Wi-Fi networks that imitate legitimate networks. These spoofed networks can potentially be used to intercept information or expose connected devices to additional risks.
If possible, avoid accessing sensitive accounts or conducting financial transactions over unknown or unsecured public Wi-Fi.
For activities such as online banking, consider using:
The Canadian Centre for Cyber Security recommends using a secure Wi-Fi network and suggests using cellular data or a VPN when using a public network.
Before connecting:
Convenience isn't worth compromising your financial information.
If you need to check your bank account while you're out, using your cellular data connection can be a simple alternative to an unknown public Wi-Fi network.
Software updates aren't just about new features. Updates frequently include security fixes that address vulnerabilities in operating systems, browsers, applications and other software. If you delay important updates, you may leave known security weaknesses unpatched.
Keep the following up to date:
Turn on automatic updates whenever they are available and appropriate. The Canadian Centre for Cyber Security recommends regularly updating and patching devices and software to address security vulnerabilities.
If your device tells you that an important security update is available, don't continually postpone it. If you're unsure whether an update notification is legitimate, go directly to the device manufacturer's or software provider's official website rather than clicking an unexpected pop-up or message.
The four cornerstones provide a strong foundation, but a few additional habits can make your online security even stronger.
Don't click links, open attachments or provide information simply because an email or text message looks legitimate. Fraudsters can spoof sender information and create convincing messages that appear to come from trusted organizations. If you're unsure, verify the request independently.
Think carefully before sharing personal information online, including:
This information can potentially be used to impersonate you or target you with more convincing scams. Your digital footprint can provide fraudsters with information they may use for identity theft or targeted social engineering attacks.
Be suspicious if someone unexpectedly contacts you and asks you to install software or give them remote access to your computer or phone. This is a common tactic used in technical-support scams. If you receive an unexpected warning that your device is infected, don't automatically call the number displayed in the pop-up. Instead, close the message and seek help through a trusted source.
Regularly review your bank and credit card accounts for transactions you don't recognize.
Also watch for unusual activity such as:
If something doesn't look right, act quickly.
Regular backups can help protect important photos, documents and other files if your device is lost, damaged, stolen or affected by malware. Keep backups protected and consider using a backup method that isn't continuously connected to your device.
Act quickly. If you believe someone has accessed your account:
Change the affected password immediately using a trusted device. If you used that password anywhere else, change it on those accounts too.
Turn on MFA if it is available.
If your banking or payment information may have been compromised, contact your financial institution immediately using a trusted phone number. Do not use contact information provided in a suspicious email, text or phone call.
Watch for unusual transactions, login attempts or changes to your account information.
In Canada, suspected fraud can be reported to the Canadian Anti-Fraud Centre (CAFC) at 1-888-495-8501 or through its online reporting system. The Canadian Centre for Cyber Security also recommends contacting your bank immediately if you've fallen victim to fraud or attempted fraud.
You don't have to remember every cybersecurity rule.
Start with these habits:
Passwords: Use a unique, strong password or passphrase for every important account.
MFA: Turn on multi-factor authentication wherever available.
Websites: Navigate directly to websites instead of clicking unexpected login links.
Wi-Fi: Use a trusted private network or cellular data for sensitive activities.
Updates: Install security updates and patches promptly.
Messages: Be cautious with unexpected emails, texts and attachments.
Personal information: Share only what is necessary.
Accounts: Monitor your financial and online accounts for unusual activity.
Scams: If something feels wrong, stop and verify it independently.
Online security doesn't have to be complicated. You can significantly improve your protection by developing a few simple habits:
Use unique passwords.
Turn on multi-factor authentication.
Verify websites before logging in.
Be cautious on public Wi-Fi.
Keep your devices and software updated.
Think before clicking, downloading, replying or sharing information.
And remember:
If something feels urgent, unusual or too good to be true, stop before you act.
Taking a few extra seconds to verify a request can help protect your money, identity, accounts and personal information.
The four cornerstones are using strong, unique passwords and multi-factor authentication, verifying websites before entering sensitive information, being careful when using public Wi-Fi, and keeping devices and software updated.
Use a strong, unique password or passphrase, enable multi-factor authentication where available, access your financial institution through its official website or app, avoid unexpected login links and use a trusted network or cellular data when accessing sensitive financial information.
It's better to avoid using unknown or unsecured public Wi-Fi for sensitive activities such as online banking. Use a trusted private network or cellular data instead. A reputable VPN can also provide additional protection when using a public network.
No. Using the same password on multiple websites increases your risk if one account is compromised. Fraudsters may try stolen credentials on other services in a credential-stuffing attack. Use unique passwords or passphrases for your important accounts.
A reputable password manager can help you create and store unique passwords and passphrases for different accounts. If you use one, protect the password manager with a strong primary password and multi-factor authentication where available.
No. HTTPS helps secure the connection between your browser and a website, but it doesn't prove that the website itself is legitimate. Verify the website address and navigate directly to the organization's official website whenever possible.
Software updates often include security patches that fix known vulnerabilities. Keeping your operating system, browser, apps and other connected devices updated can reduce your exposure to known security weaknesses.
Contact your financial institution immediately using a trusted phone number. If you believe you've been the victim of fraud or attempted fraud, report it to the Canadian Anti-Fraud Centre at 1-888-495-8501 and monitor your accounts for suspicious activity.
Don't panic. Close the page and don't enter additional information. If you entered a password, change it using a trusted device. If you provided banking or payment information, contact your financial institution immediately.
You can report suspected fraud to the Canadian Anti-Fraud Centre at 1-888-495-8501 or through its online reporting system. If you've lost money or believe a crime has occurred, you should also contact your financial institution and local police as appropriate.
If you are a YNCU member and believe your banking information or account has been compromised, contact YNCU as soon as possible.
YNCU Service Excellence Centre:
1-888-413-YNCU (9628)