7. Staying safe online: passwords, two-step verification and scams

Week 2 of 2

What you will be able to do

  • Create strong passwords, and keep them safe with a password manager.
  • Turn on two-step verification for your email account.
  • Recognise phishing and common scams, including the ones aimed at people in Africa.
  • Protect your privacy: what you share, on which networks, and with whom.

Why this matters

Criminals don't need to be clever when people reuse passwords and click links in fake messages. A few habits protect your email, your bank account and your identity, and security awareness is expected in every IT job.

1. Strong passwords

A strong password is long and unique:

  • Long: at least 12 characters. A passphrase of four or more random words is long and easy to remember: mango-Bicycle-river-27-lamp.
  • Unique: a different password for every important account. If one website is hacked, criminals try that password on your email and bank.
  • Not guessable: no names, birthdays, phone numbers, or password123.

Use a password manager to remember them for you: the one built into your browser (Chrome, Edge, Safari) or Google Password Manager, or an app such as Bitwarden. You remember one strong password; it remembers the rest.

Never share a password or a one-time code with anyone, including people who say they're from your bank, your telecom company or ITLearning. No real organisation asks for them.

2. Two-step verification

Two-step verification (2SV, also called 2FA) asks for a second proof after your password: a code from an app, a prompt on your phone, or a text message. Even if someone steals your password, they can't get in without your phone.

Turn it on for your email first, because email can reset all your other passwords:

  • Google: myaccount.google.com → Security → 2-Step Verification.
  • Microsoft: account.microsoft.com → Security → Advanced security options.

An authenticator app (Google Authenticator, Microsoft Authenticator) is safer than text messages, which can be stolen through SIM swap fraud.

3. Phishing and scams

Phishing is a fake message that tries to make you click a link, open an attachment, or give away details. Warning signs:

  • Urgency or fear: "Your account will be blocked in 24 hours!"
  • Too good to be true: "You've won N500,000", "work from home and earn $300 a day".
  • Wrong sender: the address or number doesn't match the real organisation (support@gtbank-verify.com).
  • A link that goes somewhere else: hover over it (don't click) to see the real address.
  • Requests for codes, PINs, BVN, NIN, passwords or payments.

Common scams to know:

Scam What happens
Fake bank alerts A text says money arrived; the "sender" then asks you to refund the "mistake". Always check your actual balance in the bank's app
Fake job offers You must pay for "training", "registration" or a "visa" before starting. Real employers don't charge you to work
Account "verification" A call or message asks for your BVN, card details or one-time code to "update" or "unblock" your account
SIM swap Criminals take over your phone number to receive your codes; keep your SIM PIN on and report sudden loss of signal to your provider
Fake support A pop-up says your computer has a virus and to call a number. Close the browser tab instead (topic 10)

If you've been tricked: change the password at once (from a safe device), call your bank on the number on your card, turn on two-step verification, and warn your contacts.

4. Privacy

  • Think before posting your full date of birth, address, ID numbers, travel plans or photos of documents.
  • On public Wi-Fi (cafés, airports), avoid banking unless you're using the bank's own app; websites with https are protected, but be careful what you sign in to.
  • Lock your phone and computer with a PIN or password, and set them to lock automatically.
  • Check app permissions: does a torch app really need your contacts?

Watch

Get Cyber Safe | Creating a strong password

Communications Security Establishment · 3 min. Creating strong passwords and passphrases.

How To Enable Two-Step Verification For Google Account

Tech is Easy · 1 min. Turning on two-step verification for a Google account.

Understanding Spam and Phishing

LearnFree · 5 min. Spotting spam and phishing.

Try it

  1. Check whether your email has appeared in a known data breach at haveibeenpwned.com. If it has, change that password.
  2. Turn on two-step verification for your email account.
  3. Turn on your browser's password manager (or install Bitwarden) and save one password in it.
  4. Find a suspicious message in your email or SMS (or invent one) and list three warning signs.

Check your understanding

  1. What makes a password strong?
  2. Why should two-step verification go on your email account first?
  3. Name three warning signs of phishing.
  4. Someone calls from "your bank" and asks for the code they just sent you. What do you do?
Last modified: Sunday, 8 November 2026, 3:26 PM