Household Records, Digital Life and Communications · Chapter 4
Device security, home network and recognizing fraud
Protect the devices that hold household information and recognize the messages that try to steal it.
The basics
Update everything, lock everything
Both the FTC and CISA identify software updates as a core household security practice. Operating systems, browsers, apps, and connected devices all receive updates that address security vulnerabilities. Enable automatic updates where appropriate. A device that no longer receives security updates from its manufacturer should be reviewed for replacement, isolation from the network, or changed use.
The FTC recommends locking devices so an unattended or lost phone or computer is harder for another person to access. Use a PIN, passcode, password, or biometric authentication combined with automatic screen lock. Leaving important household devices permanently open for convenience trades security for a few seconds of time.
Household checkpoint
All phones have screen lock enabled
All computers require login on wake
Automatic updates on where supported
No device running unsupported OS
The home network
Secure your router and Wi-Fi
The FTC recommends securing the home Wi-Fi network with WPA3 Personal where available, or WPA2 Personal where appropriate if WPA3 is not supported. Older encryption methods including WPA and WEP are outdated and should not be used.
Two separate credentials protect two different things. The Wi-Fi network password lets devices join the wireless network. The router administrator password controls the router's settings, firmware updates, and security configuration. Both should be unique, strong, and changed from the factory defaults.
Router security checklist
- Administrator password changed from default
- Wi-Fi network password is unique and strong
- Encryption set to WPA3 or WPA2 Personal
- Router firmware is current
- Remote management disabled unless needed
- Firewall enabled
- Guest network configured if needed for visitors
Router interfaces differ by manufacturer and internet provider. Use the specific manufacturer's instructions for your model. The security goals are the same regardless of brand.
Know your network
What is connected?
The FTC advises reviewing the router's connected-device list. Most households have more devices on their network than they realize: phones, tablets, computers, smart TVs, cameras, thermostats, speakers, printers, appliances, children's devices, and sometimes medical or assistive devices. Any device the household does not recognize should be investigated.
The FTC warns that internet-connected devices can create a path into the household network if left insecure. Default credentials on connected devices should be changed. Firmware updates should be applied when available. Devices that no longer receive updates from the manufacturer may need replacement or isolation from the network.
Connected devices including locks, cameras, thermostats, garage doors, and alarms can affect physical access and safety. Security guidance for these devices should be conservative. The Privacy Basics guide covers the broader privacy implications of connected home technology.
The human layer
Recognizing phishing and digital fraud
The FTC explains that phishing messages often impersonate trusted organizations to steal login credentials, account numbers, personal information, or money. The technical controls covered earlier in this chapter protect devices and networks. Recognizing phishing protects the person using them.
Messages may claim an account is locked, a payment failed, a package has a problem, a bill is overdue, a tax issue needs resolution, bank fraud was detected, or a family member needs urgent help. The subject alone does not prove fraud. The unverified request for credentials, codes, or money is the issue.
The verification procedure
1. Stop. Do not click, do not reply, do not call the number in the message.
2. Identify what the message wants. Credentials, a code, money, account access, or personal information.
3. Go to the source independently. Open the known official app or website directly, or call a number the household already knows is legitimate.
4. Verify, then act. If the issue is real, the official channel will show it. If it is not real, the message was the threat.
Never give a one-time code to an unsolicited requester
A verification code is part of the authentication process. If someone asks the household to read back a code that arrived by text or email, treat that as a strong fraud signal unless the household member independently initiated the process that requires it. Legitimate companies do not call to ask for your login codes.
A familiar name does not prove a real sender
Accounts can be compromised. Sender names and identifiers can be spoofed. If a family member unexpectedly asks for money, gift cards, credentials, or urgent secrecy, verify through a second known channel before acting. The Family Verification guide covers family code words and trusted-channel verification in more depth.
The FTC directs consumers to ReportFraud.ftc.gov for scam reporting. For the full catalog of scam patterns and detailed recognition techniques, see Scam Patterns.
Before selling or recycling
Dispose of old devices safely
The FTC recommends three steps before getting rid of an old computer: back up information that must be kept, erase personal data from the drive, and then dispose of or recycle the device through an appropriate channel.
Deleting files or emptying the recycle bin may not be sufficient to securely remove data. The specific secure-erase procedure depends on the operating system, storage type, and manufacturer. Modern devices with solid-state storage may offer built-in reset or erase functions. Check the manufacturer's support documentation for your specific device.
Before disposal, also sign out of all accounts, deauthorize the device from services that limit the number of authorized devices, remove the device from any remote management or find-my-device services, and remove any SIM card or external storage.
Chapter 5: Household Contacts, Digital Accounts and Shared Access