PLAIN LANGUAGE
Words the manual uses
Every term below is written for someone who does not work in security. If a chapter uses one of these words, the same meaning is repeated there.
Phishing
A message, page, or advertisement that pretends to be a company or a person you trust, so you will give up a password, a code, or money.
Smishing
Phishing that arrives as a text message. The name combines SMS, the technical name for text messages, and phishing.
Vishing
Phishing that arrives as a phone call or voicemail. The name combines voice and phishing.
Social engineering
Tricking a person, rather than breaking a machine. Urgency, fear, flattery, and a borrowed logo are the usual tools.
Caller ID spoofing
Faking the name or number that appears on a phone so a call looks like it comes from a bank, a utility, or someone you know.
Malware
Software written to harm the device or to steal from the person using it. Viruses, spyware, and ransomware are types of malware.
Spyware
Malware that watches. It may record keystrokes, location, messages, or what is on the screen.
Ransomware
Malware that locks your files or your screen and demands payment to unlock them. Paying does not guarantee the files come back.
Sideloading
Installing a phone application from outside the Apple App Store or Google Play, usually by opening a file someone sent you.
Two-factor authentication
A second proof at sign-in, after the password. A stronger second proof is an authenticator application, a passkey, or a hardware key. A text-message code is a weak second proof.
Passkey
A sign-in bound to your device and to the real website. A look-alike page cannot use it, because the passkey checks the site’s true address.
Hardware security key
A small physical device, such as a YubiKey, that you tap to approve a sign-in. Buy two. Keep one somewhere else.
Password manager
An application that creates and stores a different long password for every account, so you only have to remember one master password.
Virtual private network
A service that encrypts the connection between your device and a server the company runs, which hides that traffic from people on the same public wireless network. It does not stop you from typing a password into a fake site. A kill switch is a setting on that service that blocks internet access if the secure tunnel drops, so your traffic does not leak in the open.
Public Wi-Fi
A wireless network you do not control, such as a café, hotel, or airport. Most sites already encrypt the page. A virtual private network is optional and does not stop a scam.
Seed phrase
The list of words, often twelve or twenty-four, that can recreate a cryptocurrency wallet. Anyone who has the words has the money. Never type them into a website.
Private key
The secret that proves you control a cryptocurrency wallet. The seed phrase is a human-readable backup of that secret.
Hardware wallet
A small device that keeps cryptocurrency private keys offline and shows the destination address on its own screen before you approve a payment.
Hot wallet
A wallet that is connected to the internet, such as a phone application or a browser extension. Convenient for spending money. A poor place for long-term savings.
Cold storage
Keeping cryptocurrency keys offline, usually on a hardware wallet or on paper or metal that is not photographed or uploaded.
Browser extension
A small add-on inside the browser. Wallet extensions are useful and also a common place for fakes. Install them only from the wallet’s official website.
Clipboard hijacker
Malware that replaces a cryptocurrency address you copied with the criminal’s address when you paste.
Keylogger
Malware that records what you type.
SIM swap
A criminal convinces your mobile carrier to move your phone number onto their card, then receives your calls and text-message codes.
Rug pull
A cryptocurrency project that takes investors’ money and disappears, often by removing the trading pool so the token cannot be sold.
Pump and dump
A scheme that inflates a token’s price with hype, then sells. Everyone who bought the hype is left holding a token that collapses.
Pig butchering
A long scam that starts as friendship or romance and ends as a fake investment. The name is ugly because the criminal spends weeks “fattening” the target before asking for the large payment.
Romance scam
A relationship used to extract money. It may never meet in person, and it often turns into an investment pitch.
One-ring scam
A missed call, often international, placed so you will call back and pay a premium rate.
Premium-rate number
A phone number that bills far more than a normal call. The criminal receives a share of that bill.
Zero-click exploit
An attack that infects a device without you tapping a link, by abusing a flaw in the system. Rare, and the fix is the manufacturer’s update.
Juice jacking
A public charging port that is altered to install malware or copy data while a phone charges.
Remote wipe
A setting that lets you erase a lost or stolen phone from another computer or from the manufacturer’s website.
Biometrics
Using your face or fingerprint to unlock a device. Useful, and still paired with a long passcode in case the biometric fails.
Business email compromise
A fraudulent email that looks like a vendor, an executive, or a payroll office and asks you to change where a payment is sent.
Deepfake
Audio or video generated to imitate a real person’s voice or face. A familiar voice on the phone is no longer proof.
Quishing
Phishing that uses a QR code. The square code hides the real web address until you have already opened it.
Crypto ATM
A machine, also called a Bitcoin kiosk, that takes cash and sends cryptocurrency to a wallet address. No bank, court, or police department collects payment this way.
Wallet drainer
A website that tricks you into signing a transaction so it can take cryptocurrency out of your wallet.
Token approval
Permission you grant a website or a contract to move a token from your wallet later. Revoke means you cancel that permission.
Address poisoning
A look-alike wallet address placed in your transaction history so you might copy it by mistake the next time you send money.
Family code word
A private word or short phrase your household agrees on in advance, so you can tell a real relative from a caller using a copied voice.
Safe-account scam
A caller pretending to be your bank who tells you to move money to a new account, into cash, or into cryptocurrency to protect it. The move is the theft.
Task scam
A fake job that pays you for tiny online tasks, then asks you to deposit your own money to unlock more work or a withdrawal.
Marketplace scam
A fake buyer or seller on a listing site who uses a payment screenshot, a wire, gift cards, or cryptocurrency so you ship goods or pay before anything is real.