In January 2024 a finance worker in the Hong Kong office of Arup, the British engineering firm, received a message asking him to make a confidential payment. He thought it was a phishing email, which was the right instinct. Then he was invited to a video call. The chief financial officer was on it, along with several colleagues he recognised, and they all looked and sounded like themselves. He made fifteen transfers, HK$200 million in total, about £20 million. Everybody else on that call was an AI-generated fake.
Arup confirmed the fraud that May, and added the detail I think matters most: none of its internal systems had been compromised. Nobody broke in. A careful person, who had already been suspicious once, was asked to do something he’d normally do when the finance director asks.
That’s an extreme case, but the pattern is the ordinary one. The government’s Cyber Security Breaches Survey 2025 found that 43% of UK businesses and 30% of charities had identified a breach or attack in the previous twelve months. Among those, 85% of the businesses and 86% of the charities had been phished, which means sent a message pretending to come from somebody they trust.
Getting caught out is a lapse, and anybody can have one
Getting caught out online isn’t a mistake reserved for people who feel like they’re bad with technology. Most attacks don’t hack anything. They ask, convincingly, for something you’d normally just do, usually at the end of a busy afternoon when the checking part of your brain has gone home. Any small thing you do out of habit can be the vulnerability, and getting caught out is a moment’s lapse in concentration. This sounds bleak until you notice the other half of it: habits are the fix too, and they’re cheap.
So here are five. I’ve picked them because they aren’t the usual advice, and because every one can be done quickly and simply. If your organisation has an IT provider or a security policy, some of this may already be done for you at work, and it’s worth finding out which parts before you start. All five still apply to your own accounts and your own phone.
1. You are probably already in a list
Criminals don’t sit and guess passwords. They take the ones leaked from some website you joined once for free delivery and try them against everything else you own, automatically. Put your email address into Have I Been Pwned, a free site that lists the breaches it has turned up in. Then make the password on anything that matters longer rather than cleverer. Every extra character multiplies the number of guesses it takes, so three random words beat a short one full of symbols, and the symbols were among the first things the guessing software tried anyway. The National Cyber Security Centre’s page on three random words explains the logic better than I can.
2. Your next security update has a date
Microsoft releases its security fixes on the second Tuesday of every month, at about six in the evening UK time. From then on the holes they close are public knowledge, because anyone can compare the old version with the new, and criminals scan for machines that haven’t installed them yet. So install it on the Wednesday morning, and do the restart, because most of the fix only takes effect when you do. On a work laptop the installing may be handled for you, in which case the restart is your half of the job.
3. 7726 spells SPAM
That’s the number you forward scam texts to, free, and the networks use what comes in to block the senders. Scam emails go to [email protected], which is run by the National Cyber Security Centre. Worth doing even when you’ve already spotted it, because you’ll have practised reporting before the day it matters.
One more thing on spotting them: spelling mistakes no longer give a scam away now that AI writes them fluently. What hasn’t changed is the pressure. An unexpected message, a deadline, and a request to click, pay or log in: that’s the tell, and the checking happens by a route you already trust, never the link in the message.
4. Take your login codes from an app, not a text
If you’ve set up two-step verification, you probably get the code by text, because that’s what most services offer first. The trouble with a text is that it goes to your number, and your number can be moved.
A SIM swap is where someone rings your network, says they’ve lost their phone, and asks for your number to be put on a new SIM. They’ll have done their homework first, your date of birth, your address, the sort of thing that leaks or sits on a social profile, so they can get through the security questions. If they do, your phone drops to no signal and theirs starts getting your texts, and that now includes the codes from your bank and your email. Add a password from that leaked list in point one and they’re in.
An authenticator app doesn’t use your number at all. The code is made on the phone in your hand, so moving the number gets them nothing. I’d switch your email over first, because that’s where nearly every other account sends its reset link. A text code is still a lot better than none, which is the NCSC’s position too, so keep it wherever that’s all you’re offered. And if your phone ever drops to no signal for no reason you can think of, ring your network from someone else’s phone before you do anything else.
5. Agree a safe phrase with the people who might ring you for money
AI can now imitate a voice from audio found online, a clip from a video, say, and it can be good enough to pass on a short call. There have been cases of scammers using it to ring a relative asking for money urgently. Nobody has a reliable count of how often that happens, and it is still far rarer than the ordinary scam text, but the precaution is so cheap it’s worth having anyway.
Starling Bank suggests a safe phrase: a few words you agree with your family, in person and never by message, that a caller gives before you act on anything urgent. Whoever has borrowed the voice hasn’t got the phrase. It takes a few minutes, costs nothing, and it works just as well on the older trick of someone simply claiming to be your boss.
At work, how a payment gets approved is a decision for whoever runs finance, and there may already be a rule for it. If there isn’t one for urgent requests by phone or video, the Arup story is a fair reason to ask.
What these do, and what they don’t
None of these makes you unfoolable, and I’d be wary of anyone who says otherwise. What they do is close the doors that automated attacks walk through, and that’s the part I find encouraging. Feeling confident online comes from having done a handful of things this size and knowing which ones they are.
Data & Digital Safety is one of the six areas in the free Personal Digital Assessment. It takes about ten minutes and compares how confident you feel with what you actually do.
