When someone says “hacking,” I still picture the movie version: a dark room, a terminal, and someone typing faster than I can read. But a lot of real attacks start with something ordinary—a text about a stuck package, a call from someone pretending to be support, or a link that arrives while we’re busy. The trick is to get us to do something for the attacker: share a password or a verification code, approve a payment, install a file, or hand over access to an account. That people-focused part is called social engineering. The computer may be working just fine; the attacker is trying to talk us into opening the door.

Why does a simple message work?

The message usually borrows something we already recognize. It might look like a bank alert, a delivery update, a work request, or a note from someone we know. Then it adds pressure: “your account will close,” “approve this payment now,” or “your package is waiting.” That urgency is the point. We focus on the problem in the message and forget to check what it’s asking us to do. A familiar name or polished logo can make it feel real, but neither proves who sent it. Phishing is more than a suspicious link, too. A page may ask for a password, a caller may ask for a code, or an attachment may install something harmful. The route changes; the goal is still access, information, or money.

I try to pause and check

If a message asks for account details, money, a download, or a verification code, I stop before replying. Then I check it another way:

• Open the service’s app yourself or type in its address.
• Look up the company’s contact details independently. Don’t use the number or link in the suspicious message.
• If it seems to come from someone you know, check with them through a different channel.
• Be extra careful with one-time codes, especially when you didn’t start the call or chat.

The FTC’s phishing guide recommends contacting a company through a phone number or website you already know is real. CISA’s phishing tip sheet is another handy reference. Multi-factor authentication helps add another layer if someone gets a password, as the FTC explains. It doesn’t make a strange request safe, though. I never read a verification code to a caller just because they say they’re helping.

Already clicked? Take a breath first

What to do depends on what happened. If you entered a password, open the real service directly, change it, and check the account’s active sessions. If you shared payment details or approved a transfer, call your bank through its official app or number. If it’s a work account or device, tell the person responsible for security. If you downloaded or opened a file, scan the device with trusted security software or ask someone qualified to help. The FTC’s recovery guidance also walks through what to do after sharing information or opening a harmful file. Acting quickly can limit the damage.

Let’s make checking feel normal

It’s easy to say “be careful” after someone has been tricked. These messages are made to feel familiar and tend to show up at exactly the wrong time. Anyone who’s tired, busy, or worried about an account can get caught out. For a team, it helps when checking is normal: confirm payment changes through a second channel, make suspicious messages easy to report, and don’t make people feel bad for stopping to ask. Security gets better when the safe choice is also the easy one. That’s what I wanted to say in my short talk: hacking doesn’t always look like a movie. Sometimes it’s just a message asking us to trust it. So, before clicking, take a second and check who’s really asking.

SECURITY / TALK CLIPA short clip from my talk: What is hacking?

00:00 / 00:00