Orientation: You Are a Target — Here Is Your Plan

Your personal security map

The six elements are the periodic table of this course: the complete, short list from which every protective step is built. The map is those elements drawn in the one arrangement that shows how they depend on each other. Read it as a mechanism, not as a list. You are at the centre because every sector exists to serve you, and because the most common way in is not through a machine but through a person — a tired moment, a convincing message, a password typed on the wrong page. That is not a weakness to be ashamed of; it is simply where scammers aim, so it is where your habits matter most. Accounts sit at the top, and email sits at the top of the accounts, for one mechanical reason. When you click "forgot password" on almost any site, the site sends a reset link to your email. So whoever controls your inbox can reset your bank, your shopping, your cloud storage and your social media, one link at a time. This is a fact about how the internet works, not a guess. It is why the course's first action, always, is to lock the email account. Devices come next because they hold the accounts: a phone left unlocked, or a laptop without its files scrambled, hands a thief everything that is logged in on it. Connections are the roads between your devices and the internet. The router at home is the front door of that road, and many routers still use the admin password printed on them at the factory. Messages are where most scams arrive, so this sector is less about settings and more about one habit: before you act on a message, check it by another route. Money is drawn as its own sector even though your bank is technically an account, because money is where most harm lands, and because banks offer protections — alerts, limits, a freeze button — that no other account has. Footprint is everything about you that others can find or buy: an old public profile, a people-search listing, your birthday on a forgotten page. It matters because scammers use it to sound convincing, and because some of it is used to answer security questions. The arrows from outside are deliberately plain: reused password, data leak, lost or stolen phone, default password tried, fake message, fake call, details copied and sold. These are the attempts that actually reach ordinary people, and the course names them only as signs to recognise and doors to close — never as techniques. Each arrow points at a sector, and that is the useful part: once you know which door an attempt aims at, you know which lock to fit. The lock states turn the map into a to-do list. An open sector (red) has no real protection beyond luck. A partly locked one (amber) has some protection with a known gap. A locked one (green) has the few right settings and habits in place — not perfection, which does not exist, but enough to turn away the common attempts. And the sits beside you, not in the ring, because no lock is perfect. The kit is what turns a bad day into an inconvenience: recovery codes printed and stored safely, backups of the files you cannot lose, the official phone numbers of your bank, and a short plan. The completeness argument is simple. To protect yourself you must know what you have (the sectors), how someone would most likely try (the arrows), which single change protects the most (the master key), and how you would recover (the kit) — and those are exactly the four questions. Every later module lights part of this map: Module 3 the whole ring with its risks ranked, Modules 4 and 5 the accounts, Module 6 the devices, Module 7 the connections, Module 8 the messages, Module 9 the money, Module 10 the footprint, Module 11 the identity layer behind your accounts and money, Module 12 a second and third person beside you — your household — and Module 13 the whole map, before and after.

Traced instance: Dana's map at Week 0. Dana fills her map on a Sunday afternoon, the day after the breach email (E1). Everything she writes down is a fact about her own accounts and devices; the numbers are illustrative. Accounts: using the list of saved logins in her web browser, she counts about 85 online accounts. Almost all of them use one of the same 3 passwords. Her email password was last changed 6 years ago. The password named in the breach email is one of the three — and it is still the password on her email. Devices: her phone has been asking to install updates for 4 months; she keeps tapping "later". Connections: her home router still uses its default admin password, the one printed on the sticker. Messages: she is careful, but she has no rule for checking a message before acting on it. Money: her bank account is her only account with two-step login — a second check after the password, here a code sent by text message. So that sector is partly locked. Footprint: an old public social-media profile lists her employer history, her town and her birthday. Recovery: her client files — her livelihood, and her clients' confidential records — exist on her laptop and on one USB drive in a drawer. She has no recovery codes for anything. Then she asks the four questions. Q1, what do I have that someone wants? Her email, because it opens the other 84 accounts. Her money. Her client files, which are hers to protect and her clients' to trust her with. Her identity details — birthday, town, employer history — which a fraudster could use to pretend to be her. And, less obviously, her place in other people's trust: her clients pay invoices she sends, and her father picks up when she calls. Q2, how would they most likely try? Here she ranks, using the course's scale and marking it as her judgement. Someone trying the leaked password on her email: likely, harm high, because that password from the breach still opens the master key. A scam message reaching her: likely to arrive — they reach everyone — with harm medium if she acted on it. A lost or stolen laptop: possible over the next few years, harm high while her files are not scrambled. Someone trying the router's default password: , harm . (Module 3 does this ranking properly.) Locking the email: a new long password and two-step login on her inbox. That is , done in . Today, she could not — no codes, no real backup. That is what (recovery codes in a sealed envelope, Week 2) and (automatic encrypted backups, Week 4) will fix. Notice what the map did. The breach email felt like a single emergency about a shopping site she no longer uses. The map shows it is something else: the leaked password is still on the master key, so the real danger is not the shopping site at all — it is her email. A list of worries would have sent her to change the shopping-site password and stop. The map sends her to the one door that opens all the others.

From worried-but-random to a person with a system

The gap between these two people is the whole value of the course. It is not a gap in intelligence or technical skill. It is a gap in order and habit, and each worried-but-random habit fails in its own way. The first is reusing a few passwords everywhere. Shopping sites, forums and apps get breached; this is a fact, and it happens often. When they do, lists of email addresses and passwords end up for sale. Criminals then feed those lists into programs that try each pair on many other sites — email providers, banks, shops. This is called credential stuffing (a "credential" is your login details), and it is a widely documented attack pattern. It does not need anyone to know who you are. If you reuse a password, one breach anywhere becomes a key to everywhere you used it. That is exactly Dana's E1. The second habit is keeping passwords in memory or a notebook, which is what makes reuse feel necessary: nobody can remember 85 strong, different passwords. A password manager — an app that creates, stores and fills in a different strong password for every account, locked behind one strong main password — removes the need (Module 4). The third is relying on the password alone. A password is one lock. Two-step login, also called 2FA or MFA (two-factor or multi-factor authentication), adds a second check — a code from an authenticator app (an app on your phone that shows a fresh six-digit code every 30 seconds or so), a physical security key, or a passkey (a newer kind of login that uses your device and your fingerprint, face or PIN instead of a password). It is widely published that two-step login blocks the large majority of automated attempts to take over accounts; the exact figure varies by study, so we give none. The fourth is buying security software but postponing updates. An update is a fix the maker sends for your phone, laptop or app, and many updates close security holes that are already known to criminals. Postponing them for months, as Dana did, leaves those holes open, and no add-on product makes up for that (Module 6). The fifth is clicking first, then worrying. Scam messages work by creating urgency, fear or the promise of a reward, so that you act before you think. The person with a system has one simple rule: do not use the link or number in the message; check by another route — the app you already have, the website you type yourself, the number on the back of your card (Module 8). The sixth is oversharing: a public birthday, town and employer history give a scammer the details to sound like your bank or to answer your security questions (Module 10). The seventh is , which turns any loss into a disaster. The eighth is . Shame is the scammer's best friend: it delays the first phone call to the bank, and in fraud the first hour matters. And the ninth is , while the people you love — an older parent, a partner — stay open on the same scams. The replaces each habit with one ordered step. , then money, then everything else. A gives every account its own strong password. is on wherever it matters. , and the laptop's disk is — its contents scrambled so that they are unreadable without your password. Messages are . The footprint is . A and are in place. A says what to do first if something goes wrong. And the household is — offered help, never taken over. Dana's own story shows the difference. Two incidents in the case test her system, and both came out well (illustrative). In , her father got a phone call from someone claiming to be his bank's fraud team. The caller asked him to read out the code just sent to his phone, "to stop a fraudulent payment" (). In Week 6, Dana had helped Tomas — with his agreement — set up a password manager, two-step login on his email and bank, and a family "safe word" for urgent calls (). Remembering that, Tomas hung up and called Dana. Together they called the bank on the number printed on the back of his card. The call had been a scam, and . The bank confirmed that someone had tried to log in with Tomas's old password — one he had reused — and that two-step login had blocked it. And in , after the course, Dana's laptop was stolen from a café (). Because the disk was encrypted, the screen was locked and "find my device" was on (), she started a — erasing the laptop from another device — within the hour. No client data was exposed, and her files were restored from backup () onto a new laptop within . The worried-but-random Dana of Week 0 would have lost the files and spent weeks wondering who had read them. The Dana of Month 6 lost a laptop. That is the difference between a data breach and a hardware loss.

The method — thirteen rungs

The course is thirteen modules, and the order is the method: the most protective steps come first. After this orientation, Module 2, Your Security Discipline & Boundary, sets six commitments, tagged B1–B6 and cited by those tags throughout: protect yourself, never spy on others — never access, monitor or track anyone else's accounts or devices, including a partner's or a family member's (B1); stay calm and proportionate — no fear, no gadgets for their own sake, the high-value steps first (B2); verify by another route — official contact details you already have, never the link or number in the message (B3); everyone's privacy matters, including older relatives and partners — help with consent, do not take over (B4); only your own accounts and devices, respecting the law and other people's consent (B5); and when it goes wrong, act fast, ask for help, no shame, and report scams (B6). Module 2 is a gate: the rest of the course assumes it. Module 3, Your Personal Threat Model, answers Q1 and Q2: what you have that others want, who actually targets ordinary people, how attacks usually arrive, your own exposure, ranking risks by likelihood and harm, and a one-page personal security plan. Dana's ranked list and her first plan are built there. Modules 4 to 7 lock the doors and answer Q3. Passwords & the Password Manager explains why reused passwords are the main door, what makes a password strong (length beats complexity; a passphrase of several random words is both long and easy to type), how a password manager works, moving your accounts over most important first, checking whether your details have leaked, and sharing passwords safely in a family. It traces E1 and Dana's actions X2 (the password manager, Week 1) and X10 (the remaining accounts moved, and 31 unused accounts deleted, Weeks 4–7). Two-Step Login & Passkeys explains what two-step login is, ranks the kinds from text codes to passkeys, turns it on in the right order, covers recovery codes, explains the trap of reading a code to someone who calls, and shows when to switch to passkeys. It traces X1, X3 (two-step on bank, phone carrier, cloud storage and social media, Week 2), X4 (the recovery kit) and Tomas's call, E3. covers updates, screen locks, encryption and "find my device", apps and their permissions, laptop basics, the first hour after a loss, and passing on a device safely; it traces and the stolen laptop, . covers the router as the front door, Wi-Fi settings, a guest network for visitors and smart gadgets, choosing and limiting smart-home devices, public Wi-Fi, and what a (a service that wraps your internet traffic in a protected tunnel) does and does not do; it traces , Dana's router work in Week 3. teach you to spot the tricks and guard what matters, returning to Q2. explains why scams work, the signs of (fake messages that try to get you to click, log in or pay), text and call scams, the verify-by-another-route rule, social-media impersonation, and reporting — including the fake parcel text Dana recognised in Week 2 (). covers banking-app and card settings, safer payment methods, shopping red flags, investment and romance-scam patterns (to recognise, never to run), alerts, limits and freezes, and the first hour after a suspicious payment; it traces . covers searching yourself, and people-search sites (companies that collect and sell details about people) and how to opt out, social-media settings, location data, your data rights, and a footprint routine; it traces . answer Q4 and widen the circle. covers how identity theft happens, protecting documents and ID numbers, credit freezes and monitoring where they exist, warning signs, a response plan for the first hour, day and month, and reporting. covers who owns which account, helping older relatives without taking over, shared devices, backups and the family recovery kit, digital legacy, and recognising tech-enabled abuse — the signs and where to get help, safety first. It traces , and , the one-page household plan Dana writes and shares with Ilan in Week 8. And runs the whole method on Dana's household, from the Week 0 breach email to her . Every module from 2 to 12 is built the same way: six — the small, separate skills of that rung — each with a tag (Module 4's atoms are P1–P6, Module 5's A1–A6, Module 6's D1–D6, and so on), and each taken apart through six fixed fields: it is, its (drawn on the personal security map), the as numbered steps, its — what it gives, what it costs and how it usually fails — to use it and when not, and it connects to the rest. The household is fictional so that the method can be shown whole without exposing anyone's real accounts. Where the course uses real-world material — the idea of credential stuffing, public services such as (Troy Hunt's free breach-notification service), password guidance from the US standards body in its publication , and passkeys as defined by the — it stays at the level the public record supports.

How to read this course

This is a dissection course, not a list of tips: every protective step is taken apart to show how it works and why it comes where it does, so you finish not with a pile of advice but with a short, repeatable plan for yourself and the people you care about. Three things to hold onto as you go. First, order beats quantity. Ten random precautions protect you less than three in the right order. Email first, because it is the master key; then money; then the accounts that hold your work and your memories; then devices, the router, and the rest. Dana did twelve actions in eight weeks, and in our judgement the first one, X1 in Week 1, protected more than any of the others, because the password from the breach was still on her email. When you are short of time, do the next step on the list, not the step that feels most urgent. Second, calm and checked, never rushed. Almost every scam in this course works by making you act quickly — a parcel held, an account locked, a fraudulent payment that must be stopped now. The answer is always the same move: stop, and check by another route you already trust (B3). Tomas did exactly that in E3; the whole defence took one phone call. If something does go wrong, act fast and without shame (B6). Banks, providers and fraud-reporting services deal with these cases every day, and many countries run a national service for reporting fraud — for example Action Fraud in the UK and the US Federal Trade Commission's ReportFraud site. The sooner they hear, the more they can do. Third, protect yourself; help others only with their agreement. Everything in this course is done on your own accounts and devices (B5), and when you help someone else — an older parent, a partner — you offer, explain and set things up together, and they stay in charge of their own accounts (B4). The course never teaches how to look into someone else's phone or accounts, for any reason (B1). If you are worried that someone is monitoring you — for example, a partner who seems to know where you go or what you write — that is a safety question before it is a technical one. Module 12 covers the signs and where to get help. Safety comes first: a specialist support service or the police can help you plan before you change anything, because removing a monitoring tool can alert the person who installed it. Two notes on how the course speaks. We separate facts (things that are true and checkable, such as "a reset link goes to your email") from our judgements (such as "a scam text reaching you this year is likely"), and we say which is which. And we keep the scale small on purpose: unlikely, possible or likely; harm , or . Where a number is needed, means roughly 20–45%, roughly an even chance (45–55%), and roughly 55–80%; every number about Dana's household is illustrative. This course is general guidance, not legal or financial advice for any one country; where a step depends on local law or a particular bank, the course says so and points you to the official source. Hold those three things and the rest is detail. Module 2 makes the commitments explicit first, because a plan to protect yourself is only worth having if it stays calm, honest and respectful of everyone else.