Essential digital security terms
Phishing, spoofing, malware, two-factor authentication, seed phrases and digital evidence. Technical terms explained in everyday language, with online scams in mind.
Search the glossary
Enter a term or situation, such as “SMS”, “password”, “cryptocurrency”, “phone” or “evidence”.
Choose the situation you are dealing with
You do not need to know the technical term. These shortcuts display terms relevant to your situation.
I received a suspicious message
Phishing, smishing, vishing, quishing, spoofing and fake domains.
Someone wants access to my device
Remote access, malware, RATs, spyware, trojans and ransomware.
My account may be compromised
2FA, OTPs, account takeover, SIM swapping, session hijacking and passkeys.
I need to preserve information
Original messages, screenshots, metadata, timestamps and payment confirmations.
How the basic terms connect
One scam message can combine several techniques and end in account takeover or financial loss.
Three topics worth exploring further
The glossary provides quick definitions. These articles explain how selected principles appear in real scam scenarios, advertisements and financial stories.
Forged email sender
A displayed name or sender address does not necessarily prove where a message came from. Learn what email spoofing is and how to check suspicious email.
- check the full sender address and domain
- suspicious links, attachments and time pressure
- email from your own address does not necessarily mean a hacked account
Why scammers love cryptocurrency
Cryptocurrency is not inherently a scam. Offenders exploit fast transfers, transactions that are hard to reverse and a complex environment to create fake investments.
- why transfers can be hard to reverse
- how fake investment platforms work
- why public transactions do not make identification easy
Scam adverts for weight loss and miracle supplements
Unrealistic promises, fake reviews, misused expert photos and discount countdowns aim to create trust, hope and pressure to buy quickly.
- “lose weight without exercise or changing your diet”
- fake endorsements by doctors and celebrities
- limited-time discounts and invented shortages
Essential terms for everyone
Knowing these terms can help you recognise scams, protect accounts and avoid handing over money or sensitive information.
Social engineering Manipulation that exploits trust, fear, authority or time pressure.
An attacker does not just target technology. They try to persuade someone to hand over money, information or access themselves.
A caller claims to represent your bank and says you must transfer money immediately.
End the conversation and verify the claim through a contact you already know.
Phishing Fraudulent communication or a website seeking information, money or access.
The offender imitates a trusted service and expects you to enter your details into a fake form.
An email says your account must be renewed. Its link opens a fake sign-in page.
Open the service yourself through a known address or official app.
Smishing Phishing carried out through SMS or another text message.
The message usually includes an urgent request, link or payment demand.
A text claims you owe a parcel fee and links to a fake payment page.
Do not click the link; verify the request with the genuine service.
Vishing A fraudulent phone call seeking information, money or remote access.
The caller uses a convincing story, authority and psychological pressure.
A supposed bank employee claims your account is compromised and requests a money transfer.
End the call and contact the institution yourself using its official number.
Quishing Phishing in which a QR code conceals the destination web address.
Scanning the code may open a fake sign-in page, payment page or file download.
A replacement QR sticker on a parking meter leads to a fake payment page.
Check the address preview and the QR code’s source before opening it.
Spoofing Forging an identity or communication source to appear trustworthy.
A displayed phone number, name or address does not necessarily prove the communication’s true origin.
Your screen shows the bank’s number, but the caller is a scammer.
Verify important information independently, without relying on contact details in the message.
Email spoofing Forging the sender information in an email.
A message may appear to come from your bank, a colleague or even your own address. That does not automatically mean the mailbox is compromised.
The sender name shows a familiar company, but the actual address belongs to a different domain.
Check the full address, domain and destination links.
Fraudulent domain An internet domain created or misused to imitate a trusted service.
It may differ by a single letter, an extra word or an unusual ending.
The address includes a bank name, but the actual domain is account-check-example.com.
Compare the domain with the official website; do not rely only on appearance.
URL The full address of a specific page, file or other internet resource.
A URL includes a protocol, domain and often a path. The domain is only one part of the full address.
In https://example.com/login, the domain is example.com.
Before opening a link, check its actual domain first.
HTTPS An encrypted connection between your browser and a website.
HTTPS protects data in transit from routine interception, but does not prove that a website operator is honest.
A scam website can also have a valid certificate and display a padlock.
Check the domain, content and why you arrived on the page too.
Malware A general term for malicious software.
It can steal data, monitor users, change settings, encrypt files or enable someone else to control a device.
A file presented as an invoice installs malware when opened.
Do not open unexpected files; keep devices updated.
Remote access The ability to view or control a device from another location.
Legitimate support tools can be abused if you share a connection code or allow an unknown person to connect.
A caller persuades a victim to install an app, supposedly to secure their bank account.
If someone else is connected, disconnect the device from the internet and contact your bank from another device.
Account takeover A situation in which another person gains control of an online account.
An attacker may change the password or security details, send messages or use the account for further scams.
Contacts begin receiving requests for money from a compromised profile.
Recover access, end unfamiliar sessions and secure your main email first.
Two-factor and multi-factor authentication Signing in with an additional authentication method alongside a password.
The extra verification may use an authenticator app, security key, biometrics or a one-time code.
After your password, a service asks for confirmation in an authenticator app.
Enable 2FA especially for email, banking and social media.
OTP and authorisation code A one-time code used to sign in or confirm a specific action.
Someone who obtains the code may complete a sign-in, account change or payment. It is not intended to be shared with another person.
A scammer says the code will cancel a payment, but actually uses it to authorise the payment.
Read the entire message and never dictate the code to anyone.
Deepfake A realistic-looking fake image, voice or video created or altered using AI.
A scammer can impersonate someone you know, a relative or a public figure.
A voice message imitates a family member and asks for urgent financial help.
Verify the request through another channel and ask something only the real person would know.
Seed phrase A set of words used to restore access to a cryptocurrency wallet.
Someone who knows the seed phrase can generally restore the wallet and transfer its funds.
Fake support asks for twelve or twenty-four words for supposed verification.
Never send anyone your seed phrase or enter it through a link in a message.
Private key Secret cryptographic information used to control funds or sign operations.
A private key acts like an extremely sensitive access credential. Exposing it may mean losing all control.
A scam page asks you to enter your private key to supposedly unlock withdrawals.
Do not share private keys or enter them into unverified services.
Money mule A person whose account or services are used to receive and forward other people’s money.
They may participate knowingly or be lured by easy earnings or a fake job.
A job offer requires you to receive payments into your own account and send some of the money onwards.
Do not forward money for others or provide your account to unknown people.
“Safe account” A scam story used to persuade a victim to transfer money to the offender.
Banks and police do not protect your money by calling and ordering you to transfer it to another account.
A caller claims your usual account is compromised and the money must be moved temporarily.
Do not transfer anything. End the call and contact your bank yourself.
Explore further — internet, data and cryptocurrency
Slightly more technical terms explained without unnecessary detail, abuse instructions or forensic procedures.
IP address A numerical identifier used for communication over a computer network.
An IP address may refer to a connection, router or device. On its own, it generally does not identify a specific person.
Several devices in a household may share one public IP address.
When reporting, the precise time and time zone matter, not just the IP address.
DNS A system that maps domain names to IP addresses and other technical records.
DNS means you do not have to enter a numerical IP address to visit a website.
After you enter a website name, your browser finds where to connect.
DNS does not verify whether a website operator is honest.
VPN A service establishing an encrypted connection between your device and a VPN server.
It can protect traffic on an untrusted network and change your publicly visible IP address. It does not automatically provide anonymity or protection against scams.
A VPN cannot tell that you are willingly entering details into a fake page.
A VPN does not replace checking an address, content and service credibility.
Proxy An intermediary through which a device communicates with a destination service.
A proxy can change traffic routing, filter content or hide a direct connection from the destination website.
A company proxy controls employees’ internet access.
A proxy does not necessarily encrypt all communication.
Cookies Small pieces of data stored by a browser for sessions, preferences or visitor recognition.
Cookies can maintain sign-in, store preferences or track behaviour.
After sign-in, a website stores a cookie so you do not need your password on every page.
A sensitive session can be compromised if an attacker obtains its sign-in cookie.
Metadata Information describing other data.
It can include creation time, file type, device, author, technical settings or location.
A photo may contain the date it was taken and sometimes coordinates.
Keep original files when preserving information; forwarding or editing may remove some metadata.
Log A chronological record of events and activity in a system or service.
A log may record sign-ins, errors, settings changes or other technical events.
A service records the time of a sign-in and the device used.
Users usually cannot see all logs; acting promptly matters after an incident.
Firewall Software or hardware that controls and restricts network traffic according to rules.
A firewall can block some unwanted connections, but cannot recognise every scam story.
The system blocks an unexpected incoming connection.
A firewall cannot protect you from every harmful operation you authorise yourself.
TLS A cryptographic protocol protecting communication in transit.
TLS is used by HTTPS, for example, to encrypt a connection and validate the server certificate.
Your browser and a website establish an encrypted connection.
Encryption does not mean that the page content or its operator is trustworthy.
Hash A digital fingerprint computed from data using a one-way function.
Even a small file change normally produces a different hash. Hashes help check integrity and identify data.
Two files with identical content have the same hash when the same method is used.
Hashing is not encryption; the original content cannot normally be recovered from a hash.
Blockchain A distributed database storing records in linked blocks.
Public cryptocurrency networks usually let you follow transactions between addresses, but do not automatically reveal users’ names.
A blockchain explorer displays a transfer between two addresses.
A public transaction does not make its ultimate recipient easy to identify.
Cryptocurrency wallet A tool for managing cryptographic keys and signing cryptocurrency transactions.
The cryptocurrency itself is not stored “inside the app”. The wallet manages the keys used to control it.
A mobile wallet displays a balance and lets you create a transfer.
Protect your seed phrase, private keys and access to the device.
Cryptocurrency address A public identifier used as the source or destination of a cryptocurrency transaction.
An address can generally be shared to receive payments. It is not a password or private key.
The sender enters the recipient address into a wallet before confirming a transaction.
Always check the entire address; malware can replace clipboard contents with another address.
Explore further — threats, devices and accounts
More terms you may encounter when describing a compromised device, account or security incident.
Transaction hash A unique identifier for a specific cryptocurrency transaction.
A TXID lets you find basic public transfer information in a blockchain explorer.
An exchange withdrawal confirmation includes a long string labelled TXID.
After an incident, keep the TXID, network, address, amount and time.
Data leak Unauthorised disclosure or loss of data.
Leaks may expose emails, passwords, phone numbers or other personal and operational information.
Attackers obtain a customer database and use the details to make scams more convincing.
After a confirmed leak, change reused passwords and watch for scam attempts.
Dark web A part of the internet accessible through special software or configuration.
It is not normally indexed by search engines and can serve both legitimate and illegal purposes.
A hidden service is available only through an anonymity network.
A detail appearing on the dark web does not necessarily mean a new account compromise.
Botnet A network of compromised devices controlled without their owners’ knowledge.
A botnet can send spam, carry out attacks or spread more malicious content.
Thousands of compromised devices flood an internet service at once.
Update devices, change default passwords and remove unknown software.
Ransomware Malware that locks a device or encrypts data and demands a ransom.
Modern ransomware may also steal data and threaten to publish it.
After a malicious attachment is opened, documents become inaccessible and a payment demand appears.
Disconnect the device from the network and seek specialist help. Do not blindly restore data into a compromised environment.
Spyware Software designed to monitor a user secretly or collect information.
It may record activity, location, communications or sign-in details.
A malicious app gains extensive permissions and sends data to someone else’s server.
Review app permissions and install only from trusted sources.
Trojan A malicious program disguised as a legitimate file or app.
Users often run it themselves because they expect a different function.
A file labelled as an invoice actually installs malware.
Do not trust only a filename or icon; avoid unexpected attachments.
RAT A malicious tool allowing an attacker to control a compromised device remotely.
Unlike a normal remote-support app, a RAT is often installed secretly or under a false pretext.
After running, a trojan gives the attacker persistent remote access.
If you suspect compromise, isolate the device and have it checked by a specialist.
SIM swap An unauthorised transfer of a phone number to another SIM or eSIM.
The attacker may receive calls and text messages intended for the owner, including some verification codes.
Your phone suddenly loses service while account-recovery attempts occur.
Contact your mobile operator and secure your email, banking and important accounts.
Session hijacking Misusing an active signed-in session without entering the password again.
An attacker obtains a token or cookie that tells the service you are already signed in.
A stolen session may remain usable after a password change if the service does not revoke old sessions.
After an incident, change your password and sign out other devices and sessions as well.
Passkey A modern sign-in method based on a cryptographic key pair.
The private part is protected by your device or credential provider; sign-in is confirmed using biometrics or the device PIN, for example.
A website offers sign-in using your phone’s fingerprint reader instead of a password.
Passkeys greatly reduce ordinary phishing, but you must still protect your device and recovery account.
Password manager An app for storing passwords securely and generating unique passwords.
It lets you use a different long password for every service without remembering them all.
A manager fills a password on the domain it was saved for.
Protect the manager with a strong master password, 2FA and a secure device.
Terms that matter when preserving information
This section helps victims preserve available information. It does not provide detailed digital forensics, identification or anti-forensics procedures.
Digital trace Information created by using a device, service or communication.
A trace may be a message, sign-in, file, timestamp, transaction or settings change.
Sign-in history shows an unfamiliar device and access time.
Not every trace is evidence on its own; its meaning depends on context.
Digital evidence Digital information or data that may help clarify an event.
Whether information is evidence and how much weight it carries depends on context and expert or procedural assessment.
Original communication, timestamps, the recipient account and payment confirmation document a scam’s course.
Keep original material and avoid unnecessary edits.
Original message The original communication item preserved in the service or device.
It contains more information than retyped text and sometimes technical details a screenshot misses.
An original email remains in the inbox with its date, sender and headers.
Do not delete the message or publish sensitive details.
Screenshot An image of what was visible on a screen at a particular moment.
Useful for quickly capturing content, but it may omit original metadata, the full link or surrounding context.
A screenshot captures a profile, message text and displayed phone number.
Capture the wider context too and preserve the original message or link.
Email header The technical part of an email describing its transmission and processing.
It can help assess a message’s origin and route. The full header is not normally shown in the basic email view.
The header contains servers and timestamps along the message’s route.
Keep the original email; copying its text alone does not preserve the header.
Conversation export A file or archive created by a service’s communication-export feature.
It may preserve longer context, timestamps and attachments better than individual screenshots.
A chat app lets you export an entire conversation to a file.
Store exports securely; do not post them publicly if they contain personal information.
Timestamp and timeline The date, time and order of individual events.
Precise timing can connect communications, sign-ins, payments and other events.
A call started at 10:14, a remote connection at 10:27 and a payment was confirmed at 10:41.
Record the time zone and explicitly label approximate times as estimates.
Payment confirmation A document containing information about a completed or submitted financial operation.
It usually lists the amount, time, recipient, message or transaction identifier.
A bank PDF confirmation records the recipient account number and when the transfer was sent.
Contact your bank first; saving a document must not delay an attempt to block payment.
Original file or attachment A file kept in the form in which it was received or downloaded.
Renaming, format conversion or editing may change its properties and metadata.
An unexpected document remains stored as the original email attachment.
Do not reopen suspicious files or casually forward them to others; seek advice on the next steps.
Incident notes Your own short account of what happened before and after discovering a scam.
It helps you remember important facts and explain the situation to a bank, platform or police.
Notes record who called, what they requested, which app was used and which accounts were open.
Record facts and distinguish what you know from what you assume.
Limit harm first, then preserve information
Preserving evidence must not delay contacting your bank, securing an account or ending remote access.
End communication, disconnect active remote access and contact your bank if money is at risk.
Do not delete communications, links, payment confirmations or details of the app used.
Do not send passwords, PINs, full card details, OTPs, seed phrases or private keys.
Understanding a term is a first step. Responding correctly matters more.
The glossary offers quick guidance and prevention. If you sent money, shared details or have a compromised device, go straight to the recommended incident steps.