26 risky online behaviors (and how to stop them)

Neglecting account security

People neglect to secure their online accounts, either because they don’t understand the risks or because managing – and remembering – complex passwords is difficult. This difficulty is one of the reasons why industry leaders are pushing for the adoption of passkeys and automated password managers as a practical, safe alternative. 

You can neglect your online account security in various ways:

1. Using weak or reused passwords

Using the same password for everything is one of the biggest mistakes you can make because it puts you at risk of being hacked across multiple accounts. If one of your accounts is compromised, attackers can use your leaked credentials to access every other account you own, including your email and online banking.

According to recent data, 82% of people¹ use unsafe passwords, with the most common sources of inspiration being their favorite number, pet names, and random passwords generated online.

What to do instead:

Create a unique password for every account and use a secure password manager to store them for you. Never use “123456” or “qwerty” as your password, because these are used by millions of people² and will take less than a second for a threat actor to crack.

2. Keeping passwords on sticky notes

Having a unique and robust password but keeping it on a sticky note or in another easily accessible plain-text form is not much better than reusing the same password for everything.

You may trust your family with your passwords, but other people visit your home too. Friends, their significant others, and their kids, or home maintenance workers — you can’t always predict who will be at your home and looking at your passwords.

If you take the same practice into your workplace, the risks are even higher. Using sticky notes to remember your passwords — even among people you know — is risky behavior and leaves you vulnerable to hacking and even identity theft. 

What to do instead:

Store your passwords in a password manager. A password manager will protect your passwords with next-generation encryption and even autofill them, so you don’t need to type them each time you log in.

3. Not using two-factor authentication

If passwords are the first line of defense for your online accounts, then two-factor authentication (2FA) is the second.

How does it work? After you enter your password, your account requires a one-time passcode or other confirmation (e.g., clicking on a notification) that you, not someone else, are accessing the account.

What’s the point? If your password is exposed in a data breach, 2FA prevents hackers from accessing your accounts using the leaked password.

Two-factor authentication is available on most online services, including Google, Apple’s iCloud, Facebook, Instagram, X, and NordVPN. But too many people don’t take advantage of this excellent security feature. 

What to do instead:

Enable 2FA on your accounts whenever it’s available. Usually, you can do so by visiting security settings on a specific website or using a third-party app, such as Google Authenticator.

4. Not monitoring for data breaches

Failing to monitor for data breaches leaves you exposed to risks like financial fraud, complete identity theft, targeted social media attacks, and compromised personal accounts. When you do not regularly check for data breaches, hackers can use your information for months or even years without you knowing.

If you fall victim to a data breach, it’s not just your online accounts put at risk — cybercriminals can access confidential data like your Social Security number, mobile network information, and personal banking logins. They can also use your details to craft highly convincing personal scam emails or texts and blackmail schemes. 

By the time you realize a bad actor has accessed your accounts, you’ve missed a critical opportunity to freeze your credit cards, change your passwords, and alert your family and friends.

What to do instead:

Use built-in browser alerts to automatically monitor your saved passwords and let you know if they appear in a known data breach. Use 2FA across all your accounts, and never reuse passwords.

You can regularly check your credit reports with major providers like Equifax and Experian to spot unauthorized credit applications or suspicious financial activity. 

NordVPN's free data leak checker also lets you check if your email address has been exposed in a data breach.

Exposing sensitive data online

Some risky online behaviors — like choosing an easy password or reusing the same password for everything – are obvious and easy to fix. Others may be less obvious or harder to spot. Many people simply don’t know they are exposing private information every single day.

5. Falling for phishing attempts

Email phishing is one of the most common online scams around the world, accounting for the start of over 90% of all cyberattacks.³

Cybercriminals can also alter (or “spoof”) your email address and use it to launch phishing, email fraud, or business compromise (BEC) attacks. This spoofing happens when a hacker sends you an email with a fabricated sender address to make you believe it came from a trusted source like your bank, a colleague, or a friend.

Email phishing isn’t the only attack of this nature. Other types include SMS phishing (smishing), voicemail phishing (vishing), social media phishing and targeted attacks on specific individuals or departments.

What to do instead:

Don’t know or trust the source? Don’t click the link. When you do know the sender, double-check whether the link looks natural and whether receiving it makes sense because email addresses often get spoofed.

6. Visiting HTTP sites

The “HTTP” prefix you see on the website address usually indicates that your connection is not secure. This lack of encryption means snoopers could see the data you share with that website.

HTTP websites are dangerous for online payments and cases when you need to provide personal information. That’s why most browsers warn you when you visit such websites.

What to do instead:

To stay on the safe side, only browse sites that use an SSL — an encrypted connection, indicated by HTTPS. If you have no choice but to visit unprotected websites, enable the NordVPN extension first to secure your traffic.

7. Checking bank account on public Wi-Fi

Like HTTP sites, public wireless networks usually lack proper protection. They leave you open to man-in-the-middle attacks and other nefarious ways for hackers and snoopers to get your information. Anyone could intercept your banking credentials or other sensitive data if you visit insecure sites on such a network.

What to do instead:

When on public Wi-Fi, don’t check sensitive information, especially if it’s work or money related. Or better still, subscribe to a virtual private network (VPN) and keep your communications safe even on public Wi-Fi with a VPN.

8. Feeding sensitive data into AI chatbots

Feeding sensitive data into public AI chatbots is considered risky behavior because you immediately lose control over where that information goes and how it’s used. Sensitive text, login details, personal information, files, and images fed into chatbots are hosted on cloud servers, making them potential targets for cyberattacks and data theft.

What to do instead:

When using public AI chatbots, turn off chat history and training in the settings or use enterprise-level accounts that guarantee data privacy. Always redact names, numbers, and identifiers and replace them with generic placeholders before sharing.

9. Uploading files to the cloud as they are

Most devices automatically sync your files to the cloud, but is your data safe there? If someone steals your cloud credentials, they can access everything you keep in the cloud.

Moreover, most cloud companies can access your files if they want. A nosy employee with enough access privileges may snoop around in your private files. Or they may have questionable privacy practices, enabling third parties to access your data.

Finally, cloud companies are vulnerable to cyberattacks and data breaches, which may put your sensitive data in the wrong hands.

What to do instead:

Encrypt your files before uploading them to the cloud or use services that guarantee end-to-end encryption, such as NordLocker opens in a new tab. NordLocker allows you to access encrypted data through the cloud or sync files across all devices.

10. Agreeing to all app permissions

Reading the terms and conditions every time you want to install a new app is a real pain. No one’s surprised you hit “agree” without looking at what’s written there. However, reading at least a part of those terms and conditions should be your new habit.

By agreeing to the terms without reading them, you may be allowing the software to:

• Collect and sell information about you
• Listen to your conversations
• Install additional software you don’t need

Agreeing to all app permissions impacts your privacy, security, and device performance in the long run.

What to do instead:

Read the terms and conditions before clicking “agree,” focusing on the parts related to data collection and privacy.

11. Over-reliance on an antivirus

Not having security software is a bad habit, but thinking an antivirus solution is all you need to be secure is not quite right either.

Antivirus solutions cannot prevent all threats. If you get a vishing call, no piece of software can stop you from telling the scammer your login information for your bank account.

Awareness of threats and how to recognize them can be much better at protecting you than the most advanced security software.

What to do instead:

Continue using your antivirus, but remember — it cannot protect you from all threats. Be mindful when opening emails, clicking on links, or picking up phone calls from unknown numbers. Social engineering is as dangerous as malware, and antivirus software cannot always bail you out.

Neglecting device security

Scammers target everyone, but not everyone is an easy target. The same logic applies to hackers and devices. Why hack someone prepared for a potential attack when there are so many careless individuals with little to no defenses?

No device or system is inherently secure, but many people think they are and don’t understand the potential risks. You must be aware of some of the less obvious device security risks so you can spot suspicious activity and put up defenses.

12. Ignoring software updates

The majority of people find software updates annoying. No wonder — updates tend to pop up exactly when you don’t have time to deal with them. So what you normally do is hit the “Remind me later” button, thinking you will get back to the updates later.

Keeping programs up to date is crucial if you want to stay protected from malicious threats. Hackers love to exploit vulnerabilities in software and apps, especially those with many users, like browsers.

Companies usually fix the issues immediately by releasing a patch in the form of a software update. But if you don’t install the update, the vulnerability is still accessible on your device, and you’re left exposed.

Another issue comes into play when you don’t update your security software. Your antivirus needs to be updated to identify new threats, which requires regular software updates. If you run an outdated version of the antivirus, it may not be able to recognize and quarantine the malware you accidentally download.

What to do instead:

If you don’t feel like checking for updates, enable automatic updates on your applications. And think twice next time you want to click “Remind me later.”

13. Not having security software installed (and active)

While ignoring antivirus updates is a bad digital habit, not having software that protects you from malicious threats is even worse.

Hackers, scammers, and snoopers are always improving their tactics and tools. Knowing about the current threats may not always be enough — you never know what the bad actors will come up with next. So it’s good to have tools of your own for reassurance.

Good news if you use NordVPN — it protects your data with VPN encryption and has a bunch of extra security features to keep you safe from hackers. You can also get it bundled with encrypted cloud storage and a password manager to elevate your security and digital confidence to another level.

What to do instead:

Use a next-gen antivirus from NordVPN to prevent malware downloads and accidental phishing website visits. It also blocks intrusive ads and online trackers.

If you suspect your device may have already been infected, use an antivirus to scan for threats. Windows Defender is a good start if you have a Windows operating system.

14. Not locking or password protecting your devices

Every tablet and mobile device has built-in screen locking — and for a reason. If you don’t lock your screen behind a passcode, anyone can read your private messages or install malware on your phone when you’re not paying attention. And if your phone is stolen, the thief gets access to all your private information, emails, phones, social media accounts and digital payment methods like Apple Pay.

Similarly, computers and laptops store all sorts of sensitive information, yet their protection is overlooked because they’re often in your home. But not using a password or biometric authentication puts you at risk — if someone got access to your computer, they could access everything.

What to do instead:

You have many ways to lock your phone or device, including fingerprint and facial recognition or using a passcode. You should always lock your devices and computers behind a passcode and consider logging in with biometric data for added security.

Downloading files from unverified sources

Brilliant security habits won’t suffice if you continue downloading malware to your devices. Before you click “download” again, take appropriate measures to protect yourself.

15. Downloading free software

When searching for software, you can always find free applications to download. Many companies have a transparent business model behind their apps being free. For example, freemium software will try to get you to upgrade, while other apps will show ads to compensate for the costs.

But what about software that doesn't have such a clear business model, like most free VPNs? They need a lot of resources to support the software, from an extensive network of servers to human resources. If it's not your money they gain, it may be something even more valuable to them. This is one of the key differences in the free VPN vs. paid VPN debate — paid providers have a clear revenue model, while free ones often need to make money in less transparent ways.

Free software may collect a lot of data about you to sell to the highest bidders (advertisers, hackers, scammers, you name it), bombard you with ads, or work as malware in disguise. When it comes to software subscriptions, there's another option too — the free or cheaper accounts may be stolen, and using them is, therefore, illegal. Not only do you fund scammers by using them, but you can also get in legal trouble yourself.

What to do instead:

Think twice before you download free or too-cheap-to-be-true software. Read reviews, make sure the website is legitimate, and have a next-gen antivirus from NordVPN ready to block malicious downloads just in case.

16. Downloading attachments without thinking

Malicious attachments — a photo from an old friend or a spreadsheet from work — may look innocent enough. But even images and office documents can be malware in disguise.

Once downloaded and opened, malware can encrypt your data and ask for ransom (ransomware), log everything you type on your device, including your passwords (keylogger), spy on your activity and private conversations (spyware), or damage your device and steal your data in many other ways.

What to do instead:

Be on the lookout for suspicious attachments. If you don’t know the sender, don’t download or click on anything in the email you’ve received. Better yet, don’t even open the email.

17. Downloading antivirus software from virus warning pop-ups

Now and then, a pop-up may appear, claiming to have found malware or viruses on your device.

Is it scary? Sure. Legit? Not really.

It’s not your antivirus that displays these pop-ups — it’s the website. And that website or its ads have no way of knowing if there’s malware on your device. Clicking on the pop-up promising a malware cure will initiate a malware download instead.

What to do instead:

Don’t click random pop-ups, because they may install malware or adware on your device. Many such pop-ups are part of malvertising campaigns, so it’s a good idea to use an ad blocker to avoid seeing them in the first place.

18. Downloading files from sketchy sites

Downloading free pirated movies, games, and programs is never a good idea. Software piracy is actually considered a crime, and it’s one of the easiest ways to infect your device with malware.

Anyone can upload a virus and name the file after a new popular movie or video game. It doesn’t mean the file is what it says it is.

What to do instead:

Be vigilant on sites that offer free downloads, or even better, don’t go there at all. Use reputable services, research them, and read the terms of service before downloading any files.

Oversharing and ignoring your digital privacy

“I have nothing to hide” is a common excuse for someone to justify their ignorance of online privacy. It may seem valid until you learn about the social engineering attacks, data breaches, and all the ways third parties gather, share, and sell your most private information.

19. Underestimating privacy risks

Many people dismiss online privacy concerns, but ignorance is only bliss until you or someone you know gets hacked or scammed. Even more disturbingly, violations of privacy like snooping, webcam hacking, and location tracking happen every day, so it’s important not to dismiss the risks. We are not used to taking all the warnings seriously, but we should.

What to do instead:

Take responsibility for your privacy. Get to know the dangers and online scams, think twice before sharing private information online, and get a VPN to hide your IP address and encrypt online traffic. You can also use Threat Protection Pro to stop invasive ads, tracking, and malware. 

Most importantly, don’t underestimate data privacy importance. It may sound paranoid to wonder if your camera has been hacked or your phone is listening to you, but these invasions of privacy happen every day — and they could happen to you. It’s always better to be safe than sorry.

20. Choosing services that don’t care about your privacy

Have you checked how much Google knows about you? Spoiler alert: It knows a lot.

It’s not just Google that tracks everything it can get its hands on. Data brings a fortune to many companies — social networks, browsers, free online games, and probably most apps on your phone. Even Spotify is as much a data company as it is a music streaming service.

Most of these companies don’t even hide it. You can check their terms and conditions for what information they collect and what they do with it.

What to do instead:

Choose services that care about privacy. Alternatives to your favorite services and apps that don’t track your every move online are often available if you look for them.

Adjust your settings if you don’t want or can’t quit some mainstream services or apps. For example, disable location tracking and personalized ads on Google and Facebook and remove the microphone, location, or camera access on apps that don’t need it to function.

21. Oversharing on social media

Oversharing on social media can expose information that scammers, stalkers, advertisers, and data brokers can use against you. Teens and other vulnerable users face higher risks, but oversharing can affect anyone with public or loosely protected accounts.

Personal details help scammers write more convincing messages. If your posts reveal where you work, where you live, where you travel, or who your family members are, scammers can use those details in phishing emails, fake messages, or impersonation attempts.

Photos and videos can also create risks. Bad actors can steal public images and use them in fake profiles, harassment campaigns, or deepfake content. A beach photo, for example, could be manipulated into a nude deepfake and used to embarrass, threaten, or blackmail the person in the image.

Oversharing can also make cyberstalking and cyberbullying easier. Regular posts about your location, school, workplace, daily routine, or social plans can help someone track you, contact people around you, or target you with harassment.

The same information can increase the risk of identity theft. Birthdays, pet names, family details, addresses, travel plans, and workplace information can help scammers guess passwords, answer account recovery prompts, or build a profile for targeted fraud attempts.

Be careful with geotagged photos, public check-ins, and viral posts that ask for personal details. A trend that asks for your childhood nickname, first car, or favorite teacher may seem harmless, but the answers can help scammers personalize phishing attempts or guess account recovery answers.

What to do instead:

Limit the information you share online. Never give out your address or phone number unless it’s necessary. And before sharing photos on social media platforms, ask yourself whether you actually should. If the answer is “yes,” consider sharing them privately without making the posts public, and be careful who you share your location with.

22. Trusting “friends” you’ve only met online

It’s not just teens who fall prey to scams and phishing from strangers. People of all ages can be duped into thinking they’re forming a meaningful relationship with someone and end up sharing personal data that makes them vulnerable.

Attackers are increasingly sophisticated, and many will resort to romantic manipulation, peer pressure, or claims of illness or poor mental health to extract money, access your financial accounts, or steal your identity. 

Risky online behavior on social media includes asking for personal information or intimate content, seeming “too good to be true,”,sending suspicious links, and asking for money. Be especially wary of accounts with very few followers, no mutual connections, and recently created profiles.

What to do instead:

Remember that people you meet online are strangers. There’s no harm in adding someone as a friend and talking to them online, as long as you’re aware of the risks and do not  share personal information such as your address, Social Security number, or bank details. Never send them money, and always report them to the authorities if they try to blackmail or manipulate you.

Leaving your home network unsecured

You can install an antivirus on your smartphone, tablet, and computer. But what about your router, home network, and all the smart devices connected to it? They also need protection, and they rarely get enough of it.

23. Using a weak Wi-Fi password

You may be susceptible to easy hacking if you don’t have a strong password on your home Wi-Fi. Cybercriminals can hack your network and snoop or collect your private information.

Your neighbors can also take advantage of your weak Wi-Fi password by connecting to your Wi-Fi and using it for their own needs. It may not seem like that big of a deal until they start downloading or uploading something illegal to the internet, and you’re the one getting fined or even charged in a court of law for it.

What to do instead:

One of the best ways to create (and, more importantly, remember) your Wi-Fi password is to use a passphrase. You can use the words of a song you like or come up with an original phrase and then shorten it using special symbols and numbers.

For instance, the phrase “I care about my privacy. My VPN provider is NordVPN” could be converted to a strong password “1camp.MVpiN.”

24. Not securing your router

All your internet connections at home pass through your router, yet router security is often overlooked.

Not only do many people use lousy passwords for their Wi-Fi networks, but they also keep the default passwords of their routers. Default passwords, usernames, and router IP addresses can be found online with a simple Google search.

What does it mean? Someone with enough knowledge could connect to your router and change its settings or monitor your connections to the internet.

What to do instead:

Change your router username and password when setting up your home network. Make the password strong enough to resist guessing and dictionary attacks.

Also, you can hide your network name (SSID), enable MAC filtering, and set up a VPN on the router for additional security.

25. Disregarding smart home security

If you don’t secure your router, chances are you think even less about your smart home devices. And you’re not alone — 1 in 4 people don’t take any measures to protect their smart devices. The usernames and passwords stay as the manufacturer left them, and security doesn’t get a second look.

If that wasn’t enough, manufacturers often don’t focus on the security of these devices either. They need to rush production and leave vulnerabilities that hackers love to exploit. It then leads to creeps talking to your kid through a hacked baby monitor or indoor security camera.

What to do instead:

First, take time to research the devices you want to buy. Make sure the company takes security into account and doesn’t have questionable practices regarding user privacy.

When you already have the device, change the username and password immediately. Also, change activation phrases from “Hey Alexa” or “OK Google” to something only your family would know.

Finally, set up a VPN on your router to encrypt the connections of all your smart home devices connected to the network.

26. Forgetting firmware updates

It’s easy to update your software — you click on the update reminder and wait until your device restarts. Firmware updates are not always that easy, and you need to look for updates manually, which nobody has time for.

Hackers do have time. They find time to exploit routers and other devices with outdated firmware. And recovering a hacked router takes much more time than installing updates.

What to do instead:

Set yourself a reminder to look up and install firmware updates. For the router, visit the manufacturer’s website and follow their instructions to download the latest firmware.

Final thoughts

Risky online behaviors — such as using the same password for everything or sharing personal information online — can have serious real-world consequences that can take months or even years to recover from. 

Thankfully, you can do plenty to protect your online privacy and security, but it starts with being aware of (and not underestimating) the risks.

You may not find all the risks outlined here to be relevant. You may be guilty of reusing old passwords and delaying software updates but understand the risks of sharing personal information online. 

But for those you do — it’s important to be realistic about the changes you can make to your online habits and not expect yourself to implement all of these suggestions overnight. 

And if that’s not enough, you can explore more online safety tips.

Approach these suggestions carefully and realistically, and stay practical while avoiding online fearmongering. Ultimately, the more informed you are, the better you can protect yourself and the people you care about from online dangers many of us don’t even know exist.

Sources

1. 1. Password Statistics 82% of Internet Users Practice Dangerous Password Behaviors, All About Cookies opens in a new tab, May 2026.
2. 2. These Are the Most Common Passwords Hackers Target, Huntress opens in a new tab, May 2026.
3. 3. Phishing statistics 2025-2026: The numbers you need to know, Zensec opens in a new tab, March 2026.