Codes are for you only
No real game, app or bank will ever ask you for the code they just sent you. If anyone asks for it, by message, call or DM, it's a scam.
Today: Tell a grown-up at home this rule, so they know it too.
Use it today
The missions are simulated. These tips are not. One small thing from the crew each week that keeps your real accounts safer. Anything to do with a real account? Bring a grown-up.
Zara's tip of the week
Codes are for you only
No real game, app or bank will ever ask you for the code they just sent you. If anyone asks for it, by message, call or DM, it's a scam.
Do this todayTell a grown-up at home this rule, so they know it too.
Why it worksThat code is the second lock on your account. Whoever has it can walk straight in.
Every tip so far
The crew's field guide
Length beats clever symbols
Four random words, like "tiger-lamp-river-sock", are far harder to crack than a short password full of symbols, and much easier to remember.
Today: With a grown-up, change the password on one important account to a long passphrase.
One password, one account
Never reuse a password. When one site leaks, attackers try that same email and password everywhere else. That's credential stuffing.
Today: Ask a grown-up about using a password manager to remember different passwords for you.
STOP · CHECK · VERIFY
If a message makes you feel rushed, scared or excited, stop. Check who really sent it. Verify by going to the app or site yourself, never through the link.
Today: Look at the last message that asked you to click something. Was it rushing you?
Free Robux is never free
Sites and DMs offering free game currency, skins or gift cards are after your login. Real currency only comes from the official store, with a grown-up's OK.
Today: If you've ever typed your game password into a "generator" site, tell a grown-up and change it.
Turn on two-step login
Two-step login (2FA) means a stolen password isn't enough. An authenticator app is stronger than a text message code.
Today: With a grown-up, turn on 2FA for your email first. Email can reset every other account.
Say yes to updates
"Update available" usually means someone found a hole and the fix is ready. Until you install it, you're the gap.
Today: Check that automatic updates are on for your phone, tablet or console.
Smart doesn't mean safe
Cameras, speakers, smart bulbs and plugs are little computers. Many ship with a default password that anyone can look up.
Today: With a grown-up, check one smart device at home: has its default password been changed? Is it updated?
Your photos know where you were
Phones can save the exact location inside a photo. Post it, and you may be posting your home or school on a map.
Today: With a grown-up, check your camera settings and switch off location for photos.
Don't hand out puzzle pieces
Your full name, your school, your street, your daily routine. Each one alone seems harmless. Together they're a map to you.
Today: Look at one of your public profiles. Could a stranger work out your school from it?
Only friends you've met
Accept friend and follow requests only from people you know in real life. A nice profile picture proves nothing.
Today: Scroll your followers. Remove anyone you've never actually met.
Lock your screen
Use a PIN, fingerprint or face lock on your phone and tablet, and set it to lock quickly when you put it down.
Today: Set your auto-lock to one minute or less.
Log out on shared computers
On school or library computers, always log out when you're done, and never tick "remember me".
Today: Next time you use a shared computer, check you're logged out before you walk away.
Careful on café Wi-Fi
Free public Wi-Fi is shared with strangers. Save logging in to important accounts for home Wi-Fi or mobile data.
Today: Check if your phone joins open Wi-Fi networks on its own, and switch that off.
Check before you scan
A QR code is just a link you can't read. Look at the web address your phone shows before you open it.
Today: Next time you scan one, read the address first. Does it match who you expected?
Does a torch app need your contacts?
Apps ask for permissions: camera, microphone, location, contacts. If an app asks for something it doesn't need, say no.
Today: With a grown-up, open your phone's privacy settings and see which apps can use your location.
Telling someone is a defender move
If something online feels wrong, scary or too good to be true, take a screenshot and tell a grown-up you trust. You're not in trouble.
Today: Decide now who your go-to grown-up is for anything weird online.
Grown-ups: these tips match the lessons in the book and on the parents page.