European Cybersecurity Month: how to protect your accounts and personal data

A request to vote in a competition, a warning that your account is about to be blocked, or a message asking you to share a code received by text may seem harmless. During European Cybersecurity Month, guidance from the European Union Agency for Cybersecurity (ENISA) can help us recognise suspicious requests and reduce the risk of losing access to our accounts.

Held every October, European Cybersecurity Month is a European Union campaign supported by ENISA and the European Commission. Launched in 2012, the initiative promotes safer use of technology and a shared responsibility for online security. Since 2020, its official motto has been “Think Before U Click”.

Staying safe online is not just about technical knowledge. It also starts with simple habits: checking unexpected messages, using different passwords and keeping devices up to date.

Check the request, even if you recognise the sender
A message from a friend’s account does not necessarily mean your friend wrote it. If the account has been compromised, scammers can use it to send fraudulent requests.

If someone asks you to vote in a competition or urgently follow a link, check with them through another channel – a phone call, for example. ENISA recommends verifying the sender’s identity before responding to requests for sensitive information.

Take the same care with messages warning that your account will be blocked unless you confirm your details immediately. Instead of following the link, open the official app or website yourself and check your notifications there.

Use a different password for every account
Reusing a password means that a breach affecting one service could put several of your accounts at risk.
ENISA recommends long, unique passwords or passphrases, preferably generated and stored in a password manager. This makes it easier to use a different password for each service without having to memorise them all.

Pay particular attention to your email account: it is often used to recover access to other services.

Keep verification codes to yourself
Two-factor authentication adds an extra check when you sign in. This means a password alone is no longer enough to access your account.
Where a choice is available, ENISA recommends passkeys, physical security keys or authenticator apps rather than codes sent by text message.
Never share verification codes or approve a sign-in request you did not initiate. The same rule applies even when the request comes from an account you recognise.

Updates and privacy settings matter
Operating system and app updates may include fixes for security vulnerabilities. Enabling automatic updates, where possible, helps ensure those fixes are installed promptly.

ENISA also recommends reviewing privacy settings, limiting the personal information you share online and regularly checking accounts for unusual activity. Backing up important files can help limit the impact of data loss.

If you have already shared your details, act quickly
If you suspect someone else has access to your account, change your password through the official app or website and review your active sessions. Change the password on any other services where you have reused it.

If you have shared banking details or noticed suspicious transactions, contact your bank immediately through an official channel. Keep the messages and screenshots: they may be useful when reporting the incident.

No single setting can keep you safe online. But a few consistent habits – checking unexpected requests, using unique passwords and adding an extra layer of sign-in protection – can significantly reduce the risks.