The people who protect your business go home at night
Every control you buy assumes the person operating it is thinking clearly. That person also has a personal email account that resets everything else they own, a teenager with a gaming console, and a parent who answers unknown numbers. Home is where most people learn what a scam feels like — and where they learn it badly, expensively, and too late to be useful at work.
So we wrote the guide we would want a colleague’s family to have. Nineteen pages, written for a household rather than an IT department, in the same plain English we use in a board report. It is free, there is nothing to fill in, and we do not ask who you are.
Cyber-Safe at Home
Simple habits, family conversations and emergency steps to protect your money, accounts, devices and children online.
What is in it
If something has happened
Five numbered steps in the order they matter: stop, bank, accounts, evidence, report. Written to be read by someone who is frightened, on a page you can print and stick inside a cupboard door.
The six habits
Protect email first, use passkeys or 2-step verification, update automatically, pause and verify, back up what matters, talk without blame. Six things, not sixty.
Passkeys and passwords
Why the NCSC now rates passkeys at least as strong as password-plus-2SV, when three random words is the right answer, and why changing a good password on a timetable makes things worse.
Pause, leave, verify
A sentence to practise aloud, and the rule that never breaks: never use a phone number, link or contact detail supplied by the person asking you to act.
Impersonation
A familiar voice is no longer proof of anything. What a family can agree in advance so that a cloned voice on a bad line does not get an answer.
Younger children and teenagers
Settings worth changing, conversations worth having, and gaming, in-game purchases and account sharing — where most teenage account compromises actually start.
Updates, backups, the router
What automatic update actually covers, what a real backup looks like, and the two things worth changing on a home router and smart devices.
Supporting older family
How to help without taking over, and what to set up once so that the next unexpected call reaches you before it reaches their bank.
The numbers that matter, on one page
Every reporting route in the guide is the official UK one, checked rather than remembered.
Suspicious emails go to report@phishing.gov.uk. Suspicious websites go through the NCSC’s reporting service. Both are in the guide, on the page you keep.
If you employ people
Human risk does not respect the boundary between a work laptop and a kitchen table. The habits that stop someone approving a fraudulent invoice at 4pm are the habits they practised on a scam text at the weekend — and the family that has agreed what to do when a voice sounds wrong is the family whose member does not wire money on a Friday afternoon.
So send this to your staff. Attach it to an all-hands email, drop it into a Teams channel, print it for a noticeboard. There is nothing in it that sells anything, no form, and no requirement to mention us at all. We would rather it was read than credited.
Awareness material your people will actually read
The one-page staff posters cover the same ground for the office. Also free, also no sign-up.
The rule the whole guide rests on
No one is in trouble for telling the family quickly.
Speed matters more than blame. A household that reports a mistake in ten minutes loses money it can usually recover; a household that spends two days being embarrassed loses money it cannot. Exactly the same is true of an organisation, which is why the same sentence, differently worded, sits at the front of every incident runbook we write.