Security & Safety Resource Center

That forgotten security camera or smart plug may still be working—even when you never open its app. If an unused Internet of Things (IoT) device stays powered and connected, it can remain reachable through your network or its cloud service. Inventory your devices, identify what you no longer need and disconnect those extras safely.

This is more than digital housekeeping. A joint FBI, CNMF and NSA advisory documented a botnet containing over 260,000 compromised devices as of June 2024, including routers and IoT equipment. That does not mean your gadgets are infected, but it shows how criminals can recruit ordinary connected hardware.

Why can an unused smart device still pose a risk?

“Unused” describes your habits, not the device’s network activity. A camera might keep contacting its cloud service. A forgotten hub might keep running outdated software. Weak passwords, unpatched vulnerabilities and unnecessary remote access can leave opportunities for attackers.

A compromised device may expose information it handles or help criminals launch attacks against others. Depending on network protections, it could also provide a foothold toward other equipment. Disconnection removes that device’s active network connection; it does not repair an existing compromise elsewhere.

How do you find dormant devices on your network?

Start with your router’s official app or administration page. Look for “Connected devices,” “Clients” or a similar list. The FTC recommends checking connected devices, updating their firmware and disconnecting older equipment you no longer use.

Walk through your home and match the list to actual hardware. Include cameras, speakers, TVs, plugs, sensors and hubs—not just phones and laptops. Keep a simple inventory with:

• Identity: Device name, model and location.
• Purpose: What it does and who still needs it.
• Connection: Wi-Fi, Ethernet or a connection through a hub.
• Support: Firmware version and manufacturer’s update-support status.
• Decision: Keep, disconnect temporarily or retire.

Investigate unfamiliar entries before blocking them. Device names can be vague, and a hub may serve several accessories. Never disconnect medical equipment, alarms or other safety-critical systems without checking the manufacturer’s guidance and arranging a safe alternative.

How do you disable an unused IoT device safely?

Use this sequence for a nonessential device you have confirmed you no longer need:

• Check dependencies. Review schedules and automations first so removing a plug or sensor does not unexpectedly stop another household function.
• Save what matters. Export recordings or settings you need before removing access or resetting anything.
• Disconnect the device. Follow its instructions to disable networking, unplug its Ethernet cable or power it down fully. Check battery-powered equipment, too.
• Remove lingering access. Review linked cloud accounts, integrations and remote-management settings. For permanent retirement, follow the manufacturer’s account-removal and factory-reset instructions.
• Verify and record. Confirm the router no longer shows an active connection. Some routers retain offline entries. Mark the device’s status in your inventory.

Is deleting the app or using standby mode enough?

Do not assume so. Removing an app does not necessarily disconnect its hardware, and standby may leave networking active. Likewise, blocking Wi-Fi alone may miss an Ethernet or alternative connection. Verify the device’s actual connection status rather than relying on a dark screen.

What should you check before reconnecting a stored device?

Check the manufacturer’s support page first. Install available firmware updates using its approved process, replace default passwords and enable multifactor authentication on the associated account when available. Retire equipment that no longer receives necessary security updates rather than reconnecting it out of habit.

For devices you keep, consider a separate IoT or guest network with isolation from your primary devices. Check what your router actually isolates and whether essential features still work. The FTC’s home Wi-Fi guidance recommends a guest network, router updates and disabling unnecessary remote management.

Close one forgotten connection today

Review your inventory monthly and after adding or replacing equipment. Fewer connected devices mean fewer updates to track and fewer potential entry points to overlook. Start with one forgotten gadget: confirm its purpose, disconnect it safely and record the change. Keep convenience where you need it—not connections you have forgotten.

A quick balance check tells you how much money you have—not whether every transaction belongs to you. Review your bank, credit card and payment-service activity regularly, then examine each monthly statement. Look for unfamiliar purchases, withdrawals and transfers, and report anything unauthorized immediately.

The stakes reach beyond a stray charge. The FTC says people reported losing $3.5 billion to imposter scams in 2025. That figure covers impersonation scams, not just account fraud, but it underscores why checking activity and verifying supposed bank alerts both matter.

How often should you check your bank statements?

Make a brief account review part of your weekly routine, and read every statement when it arrives. Check more often after losing a card or learning about a breach. Treat this schedule as a starting habit, not a reason to wait when something looks wrong.

Review payment apps separately, too. Compare their transaction histories with linked bank and card accounts so you understand where money went. Turn on available transaction alerts, but keep reviewing statements: notifications do not replace a complete account check.

What warning signs should you look for?

Scan every transaction, not just large purchases. Compare entries with receipts, order confirmations and your own payment history. Pay particular attention to:

• Small, unfamiliar charges: Criminals sometimes test stolen payment details before attempting larger purchases.
• Unexpected withdrawals or transfers: Check ATM activity, automatic debits and payment-app recipients.
• Duplicate or incorrect amounts: These may indicate billing errors rather than theft, but still need attention.
• Recurring charges you cannot explain: Review subscriptions and canceled services.
• Missing refunds: Match promised credits against your records.

Does an unfamiliar merchant name always mean fraud?

No. A statement descriptor may differ from a store’s familiar name. Check receipts and ask other authorized account users before deciding. If you still cannot explain the transaction, contact your provider promptly. Do not ignore a small amount simply because investigating feels inconvenient.

What should you do if you spot an unauthorized transaction?

Act as soon as you notice it. Follow these steps rather than waiting for the next statement:

• Open a trusted channel. Use your provider’s official app or the number on your card. Avoid links and phone numbers in unexpected fraud messages.
• Report the transaction. Explain what you did not authorize. Ask about securing the account, locking or replacing the card and stopping further transfers.
• Document the details. Save the transaction date, amount, merchant or recipient, screenshots and case number. Record when you contacted the provider.
• Follow the dispute instructions. Ask whether you must submit written confirmation and when. Keep copies and track the response.

For U.S. accounts, timing can affect your protections. The CFPB explains that you should report unauthorized bank withdrawals immediately and generally no later than 60 days after the bank sends the statement showing them. Lost or stolen debit cards, PINs or security codes can trigger a much shorter two-business-day reporting window to limit liability. Do not treat any deadline as a waiting period.

Credit cards and payment services have different procedures; ask your provider which rules apply. Describe accurately whether someone moved money without permission or a scammer persuaded you to send it. Never transfer money to a supposed “safe account” because an incoming caller tells you to.

How should you store and dispose of statements?

Keep records you need for disputes, taxes or other requirements securely. When you no longer need paper copies, shred them rather than putting readable statements in the trash. The FTC recommends shredding documents containing personal or financial information when you dispose of them. Preserve evidence of an unresolved dispute.

Build a habit that protects your money

Set a weekly review reminder and check each statement when it arrives. Catching unexplained activity sooner gives you a chance to stop further misuse and report within important deadlines. Start today: open one account, review recent transactions and investigate anything you cannot explain.

Before you hand a website your name, email or phone number, check what happens next. Read its privacy policy, inspect its sharing choices and submit only what you need to use the service. You cannot verify every behind-the-scenes practice, but you can avoid giving away information blindly.

You are not alone if this feels confusing. In a 2023 Pew Research Center survey, 67% of U.S. adults said they understood little to nothing about what companies do with their personal data. A focused privacy check can turn that uncertainty into practical decisions.

What should you look for in a website privacy policy?

Find the “Privacy” or “Privacy policy” link before completing a form. Start near the bottom of the website or beside the signup button. Check that the policy names the company operating the service, then use your browser’s find feature to locate these topics:

• Collection: What information does the company collect, including browsing activity, location and details you enter?
• Purpose: Does it need the information to deliver your order, personalize content, advertise or build a profile?
• Sharing: Who receives it—service providers, affiliated businesses, advertising partners or other organizations?
• Retention: How long does it keep your information, and what happens after you close your account?
• Choices: How can you change marketing preferences, request deletion or contact someone with privacy questions?

Look for specific explanations, not just “we value your privacy.” The FTC emphasizes that businesses must honor their privacy promises, but a posted policy alone does not establish that a company handles data safely.

Does sharing with partners always mean selling your data?

No. A company might share information with a vendor that processes orders or sends service emails. It might also disclose information to partners that market related products. Read the stated purpose and available controls rather than treating every partner relationship as identical. If “trusted partners” leaves you guessing, ask who receives your information and why.

How can you limit what a website collects?

Turn the policy review into action before clicking “Submit.” Follow these steps each time you try an unfamiliar service:

• First, question the form. Leave optional fields blank. Ask why a newsletter needs your birthday or home address.
• Next, separate service from marketing. Decline optional promotional emails and partner mailing lists unless you actually want them.
• Then, check tracking choices. Where available, reject nonessential cookies and review advertising preferences rather than automatically accepting everything.
• Finally, inspect permissions. Deny location, camera, microphone or contacts access unless the feature needs it. Revisit those choices in browser and device settings.

The FTC’s explanation of online tracking recommends adjusting privacy settings and turning off unnecessary app permissions. These controls complement your policy review; neither step replaces the other.

Does private browsing stop websites from tracking you?

No. Private browsing can limit the history your browser keeps after a session, but it does not stop websites from seeing your activity. Do not treat it as permission to submit sensitive information to an unfamiliar business.

What if a website has no clear privacy policy?

Pause before sharing anything. Contact the company through independently verified contact details and ask how it uses, shares and retains your information. Do not send sensitive documents just to get an answer. If you cannot find a policy or get a clear explanation, choose another service.

How often should you review your privacy choices?

Recheck policies on sites you use often, especially after an update notice or before adding sensitive information. Compare changes to sharing, retention and marketing choices. Save important preferences and revisit them periodically.

Start today with one frequently used account. Remove unnecessary profile details, switch off unwanted marketing and review permissions. Sharing less gives companies less information to retain or pass along—and gives you fewer privacy decisions to untangle later.

The financial stakes are enormous. The FBI’s 2025 Internet Crime Report recorded $3 billion in reported business email compromise losses. SPF, DKIM and DMARC will not stop every compromised inbox or lookalike domain, but they make direct spoofing of your domain easier to detect and reject.

What is SPF and how does it protect business email?

Sender Policy Framework, or SPF, is a DNS record listing the systems authorized to send email for your domain. When a receiving server gets a message, it checks whether the sending server is permitted by that record. This helps detect mail sent from an unauthorized server claiming to use your domain.

What is DKIM and how is it different from SPF?

DomainKeys Identified Mail, or DKIM, adds a cryptographic signature to outgoing messages. Your mail service signs the message with a private key; receiving systems use the public key in your DNS to verify the signature and confirm that signed content was not altered in transit.

SPF focuses on the sending infrastructure. DKIM focuses on a domain-backed signature that can survive some forwarding scenarios. Google’s DKIM setup guidance explains the public and private key pair and recommends 2048-bit keys when the domain provider supports them.

Do you need SPF, DKIM and DMARC?

Yes. CISA says the three methods are not intended to work in isolation. Its email-authentication guidance recommends implementing SPF, DKIM and DMARC together. DMARC checks whether authenticated domains align with the visible From address and tells receiving systems what to do with messages that fail—monitor, quarantine or reject. It also provides reports that reveal legitimate senders you missed and attempts to impersonate your domain.

How should a small business set up email authentication?

1. Inventory every sender. List your primary mail platform and every vendor that sends using your domain. Include marketing, CRM, ticketing, accounting and website systems.
2. Publish one complete SPF record. Follow each provider’s instructions and authorize only current senders. Remove services you no longer use.
3. Enable DKIM signing. Generate the key through your email provider, publish the public key in DNS and switch signing on. Protect private keys and rotate them according to provider guidance.
4. Add DMARC in monitoring mode. Start with a reporting policy so you can collect data without blocking legitimate mail. Use a dedicated mailbox or reporting service to review aggregate reports.
5. Fix alignment problems. Confirm that newsletters, invoices and other third-party systems pass SPF or DKIM with a domain aligned to the visible From address.
6. Increase enforcement gradually. Move from monitoring to quarantine and then reject after reports show that authorized mail passes consistently.
7. Test and document. Send messages to major providers, inspect authentication results and record owners, vendors and renewal procedures.

What mistakes can break SPF or DKIM?

• Forgetting third-party senders: A billing or marketing platform may send legitimate mail that fails authentication.
• Publishing conflicting records: Multiple SPF records can cause errors; combine authorized senders correctly.
• Changing messages after signing: Gateways that add footers or rewrite content can invalidate DKIM.
• Skipping unused domains: Even a domain that sends no mail should have defensive SPF and DMARC policies to discourage spoofing.
• Enforcing too quickly: A reject policy before inventory and monitoring can block real customer communications.
• Ignoring reports: DMARC data only helps when someone reviews failures and unknown senders.

What threats do SPF and DKIM not stop?

Authentication does not prove that the message itself is honest. A criminal can compromise a legitimate employee mailbox, register a lookalike domain or abuse an authorized marketing account. Keep MFA on every mailbox, limit administrator privileges, train staff to verify payment and banking changes through a second channel, and monitor forwarding rules and unfamiliar logins.

Make email authentication part of business maintenance

Correctly configured SPF, DKIM and DMARC reduce domain spoofing and show who is sending mail in your name. Review the records quarterly and whenever a vendor changes. Start today by asking your email provider to confirm the authentication status of every business domain.

The stakes are real. The FBI’s 2025 Internet Crime Complaint Center summary recorded $1.3 billion in reported personal data breach losses. Reducing unnecessary accounts and devices cannot prevent every breach, but it limits the number of services holding your information and the number of entry points an attacker can try.

Why do unused accounts increase online risk?

An abandoned account may still contain your name, address, payment history, private messages or a reused password. Because you rarely sign in, you may miss a breach notice, password-reset message or unfamiliar login. A criminal who takes over the account might use stored data to impersonate you, target other services or send scams to people who trust you.

Which accounts should you delete or keep?

• Delete accounts you no longer use: Old retailers, forums, trials, games and apps do not need permanent access to your information.
• Close duplicates: Keep one active profile when several accounts serve the same purpose.
• Review accounts with stored payment data: Remove cards and addresses even if you are not ready to close the account.
• Keep accounts tied to records: Preserve access when you need warranties, tax documents, medical information or purchase history.
• Protect recovery accounts: Your primary email, mobile account and password manager need the strongest security because they unlock other services.

Does deleting an app delete the account?

Usually not. Removing an app from a phone may leave the online account, cloud data, subscriptions and connected permissions intact. Sign in through the official service, download anything you need, cancel paid plans and use its account-deletion control. Save confirmation before removing the app.

How do you audit your digital accounts?

1. Build an account list. Check your password manager, saved browser logins, email for “welcome” and “verify” messages, app stores and bank statements for subscriptions.
2. Prioritize high-value services. Start with email, banking, cloud storage, healthcare, social media and accounts with saved payment methods.
3. Secure what you keep. Give every account a unique password, enable multifactor authentication and update recovery information.
4. Disconnect third parties. Review “Sign in with” connections, linked apps and active sessions. Remove anything unfamiliar or unnecessary.
5. Delete carefully. Export needed records, remove stored cards and personal data, then use the official deletion process rather than simply abandoning the login.
6. Track the result. Record deletion requests and recheck later. Some services take time to complete them.

Which devices should you disconnect or retire?

• Remove old devices from Apple, Google, Microsoft and other account dashboards.
• Sign out of streaming, email, cloud and shopping services before disposal.
• Transfer authenticator apps and recovery codes before wiping a phone.
• Back up necessary files and verify that the backup opens.
• Factory-reset the device using the manufacturer’s official instructions.
• Remove SIM and memory cards, then recycle electronics responsibly.

The FTC advises users to unlink accounts, remove storage cards and erase personal information before trading in or disposing of a phone. Deleting files one by one is not a substitute for the approved reset process.

Can fewer accounts replace strong cybersecurity?

No. One poorly protected email account can still expose your entire digital life. Digital decluttering works best with unique passwords, MFA, automatic updates, backups and careful link handling. Think of it as reducing the number of doors; you still need strong locks on the doors that remain.

Start with a 15-minute digital cleanup

Reducing digital clutter makes you safer online because fewer services store your data, fewer devices need patches and fewer alerts compete for your attention. Start small: delete one unused account, remove one old device from your account dashboard and turn on MFA for the email address that controls your resets. Repeat monthly until every account and device has a clear purpose and owner.

The financial risk is serious, too. The FBI’s 2025 Internet Crime Complaint Center summary recorded $929 million in reported confidence and romance scam losses. Safer profiles cannot stop every dishonest match, but limiting public details makes targeting, password guessing and convincing impersonation harder.

What information should you leave off a dating profile?

• Your home location: Use a general city or neighborhood, not an address, apartment view, street sign or nearby landmark.
• Your exact workplace: A broad profession is safer than naming the employer, office, department or schedule.
• Your daily routine: Avoid posting regular gym times, commute routes, favorite quiet spots or dates when you will be away.
• Security-question material: Leave out full birthdays, pet names, childhood schools, hometown details and family names.
• Contact and financial details: Never publish your personal email, phone number, banking information or government ID.
• Photos that reveal too much: Check backgrounds for house numbers, work badges, license plates, school logos and children’s information.

Can dating profile details help someone guess a password?

Yes. Password guesses often use names, dates, teams, pets and places. Even if the password itself is stronger, the same details may help someone answer weak recovery questions. Use a password manager to create a unique password for the dating account, enable multifactor authentication and choose random answers for security questions when the service allows it.

How can you tell whether an online match is catfishing you?

Go slowly and look for consistency rather than relying on chemistry alone. The FBI advises people to research profile photos and details, question fast-moving relationships and treat repeated excuses to avoid meeting as suspicious.

1. Keep early conversations on the platform. Dating services may provide reporting tools and safety controls that disappear when you move immediately to private text or encrypted chat.
2. Reverse-search profile photos. Look for the same image under another name, job or location. Also search distinctive phrases from the profile.
3. Ask ordinary follow-up questions. Scammers reuse scripts. Details that continually change—or answers that never address your question—deserve attention.
4. Use live video before meeting. A short call can expose stolen photos, although deepfakes and prerecorded video mean it is not absolute proof.
5. Tell someone you trust. An outside perspective can notice pressure, contradictions and isolation tactics that excitement makes easy to miss.
6. Never send money or financial access. Emergencies, travel costs, investment opportunities and requests to receive or move funds are reasons to end contact.

How can you meet an online date more safely?

• Do not let the other person pick you up at home.
• Protect your drink and stay clear-headed enough to make decisions.
• Leave immediately if the person pressures, threatens or isolates you.
• Use the app’s block and report tools after unsafe behavior.
• Call emergency services if you believe you are in immediate danger.

The FTC’s romance-scam guidance recommends never sending money or gifts to a love interest you have not met in person and suggests reverse image searches when a profile seems suspicious.

What should you do if a match misuses your information?

Stop contact and preserve the profile, messages, payment records and usernames before blocking the account. Change any exposed or reused password, secure your email first and review account recovery details and active sessions. If you shared financial information or sent money, contact the bank or payment provider immediately and ask about recovery options.

Make privacy part of your dating routine

A lower-detail profile gives strangers fewer clues to locate you, guess passwords or manufacture instant compatibility. Independent verification helps you catch copied identities before trust becomes financial or physical access. Review your profile today: remove one identifying detail, enable MFA and check every photo background. A safer profile can still be warm, specific and memorable without publishing the map to your offline life.

Phishing remains widespread. CISA notes that the FBI received 193,407 phishing complaints in 2024, making it the most reported cybercrime that year. Treat every unexpected reward as unverified, even when the message appears to come from a company you know.

How does a fake gift card offer work?

The prize is bait. The real goal may be your account credentials, card number, address or device access. A scammer may also ask you to buy another gift card to cover fees and send the card number and PIN. The FTC is clear: no honest business or government agency will require gift-card payment to release a prize.

What are the signs of a gift card phishing scam?

• You never entered the contest: A prize for an event you do not remember joining is not a lucky break.
• The message creates urgency: “Claim now,” countdown timers and threats of expiration discourage verification.
• The sender does not match the brand: Look for extra characters, free email accounts or a strange reply-to address.
• The link is misspelled or shortened: A familiar brand name inside a longer, unrelated address can hide the destination.
• The offer asks for sensitive information: A legitimate gift should not require your password, one-time code or full payment details.
• You must pay to receive the prize: Fees by gift card, wire transfer, cryptocurrency or payment app signal a scam.

What should you do when a suspicious gift card offer arrives?

1. Do not click or reply. Avoid buttons, links, attachments, QR codes and “unsubscribe” options inside the message.
2. Inspect without interacting. Check the sender and preview the destination on a computer by hovering over the link. Misspellings help, but polished wording does not prove safety.
3. Verify independently. Open the company’s official app or type its known address yourself. Check your rewards or promotions there, or contact support using information you found independently.
4. Delete and report the message. Mark it as phishing or junk so your provider can improve filtering. If it reached a work account, follow your organization’s reporting process.
5. Warn others carefully. Share a screenshot or description, not the active link. A quick warning may stop the same lure from reaching family or coworkers.

CISA describes phishing as messages or malicious websites that impersonate trusted entities to steal information or deliver malware. Its phishing guidance recommends skepticism toward urgent, too-good-to-be-true offers and suspicious hyperlinks.

Can clicking a gift card link install malware?

It can, although many phishing pages focus on stealing what you type. Close the page if you clicked but did not enter anything. Do not approve downloads, browser notifications, profiles or security prompts. Update the device and browser, then run a scan with trusted security software already installed on the device.

If you entered a password, change it immediately through the real service and anywhere you reused it. Enable multifactor authentication, review active sessions and protect your primary email first because it can reset other accounts. If you entered payment details, contact the issuer through the number on the card.

What if you bought or shared a gift card?

Contact the gift card company immediately and ask whether it can freeze the funds or issue a refund. Keep the physical card, purchase receipt, packaging and every message. Do not trust anyone who later promises to recover the money for an upfront fee; recovery scams often target people twice.

Turn “pause and verify” into a habit

Ignoring an unsolicited gift card offer protects more than the promised reward. It keeps your credentials out of copycat login pages, prevents small “fees” from exposing a card and blocks attackers from using a compromised account against people who trust you. The safest response is simple: leave the message, reach the company independently and delete the lure.