Privacy and cybersecurity glossary
Doxxing, PII, phishing, the dark web: what each term means in plain words, and how to protect yourself.
No term by that name yet.
Popular terms
- Social engineering Social engineering is tricking a person into giving up information or taking an action, such as sharing a password or sending money, by exploiting trust, fear or urgency instead of breaking into a system.
- Doxxing Doxxing is collecting someone's personal details, such as their home address, phone number or workplace, and publishing them online to harass, threaten or humiliate them.
- Unknown caller An unknown caller is a call where your phone can't show who is calling: the number is hidden, blocked or not in your contacts. "No caller ID" and "unknown" usually mean the caller chose to hide their number, or the network couldn't pass it on.
- Malware Malware, short for malicious software, is any software or firmware placed on a device on purpose to harm it or its owner: to steal data, spy on activity, lock files or damage systems.
All terms A to Z
A
- Accept all cookies Accept all cookies is the button on a website's cookie banner that lets the site, and often its advertising and analytics partners, store small files on your device, including ones that are not needed for the site to work.
- Accepting cookies Accepting cookies means allowing a website to store small text files on your device. Essential cookies make the site work, while optional ones, such as analytics, tell the site owner how you use it.
- Account services phone call An account services phone call is an unexpected call whose caller ID or recorded message claims to be about a problem with one of your accounts. It can be genuine, but many are scams that try to get your details or money.
- Account takeover Account takeover is when a criminal gets into your online account, such as email, social media or banking, using stolen login details, and locks you out or uses it to commit fraud.
- Aggregate data Aggregate data is information combined from many people or records into totals, averages or groups, so it describes a population rather than any single person, such as 'about 40% of customers are under 30'.
- Aggregated data Aggregated data is information combined from many individual records into totals, averages or counts, so it describes a group instead of a single person.
- Anthropometric data Anthropometric data is information about the measurements of a person's body, such as height, weight, or limb and head size. Linked to a named person, it is personal data.
- Anti-malware Anti-malware is software that detects, blocks and removes malware, meaning code intended to harm a device or the data on it. It covers viruses, worms, spyware, ransomware and similar threats.
- Attack vector An attack vector is the route an attacker uses to reach a system, account or person, such as a phishing email, a stolen password or an unpatched flaw, in order to carry out an attack.
B
- Bait and switch A bait and switch is a sales tactic in which a customer is attracted by the advertisement of a low-priced item but is then encouraged to buy a higher-priced one.
- Biometric data Biometric data is information about a person's body or behavior, such as a fingerprint, face or voice, that can be used to recognize or identify them automatically.
- Browsing data Browsing data is the information your browser and the sites you visit record about your activity online, such as pages visited, search terms, cookies, saved form entries and your IP address.
- Brute force attack A brute force attack is when an attacker tries many passwords or codes, one after another, until one works. Automated tools can make thousands of guesses.
- Burner phone A burner phone is a cheap, prepaid cell phone with no carrier contract, bought to be used for a short time and then thrown away or replaced, so the user can keep their real number and identity private.
C
- Cached data Cached data is a temporary copy of web pages, images and other files that your browser or app saves on your device so the next visit loads faster.
- Case-sensitive password A case-sensitive password is one where upper and lowercase letters count as different characters, so "Password" and "password" don't match.
- Catfishing Catfishing is creating a fake online identity, usually with someone else's photos and a made-up story, to deceive a person into a relationship. It is often used to get money, gifts or personal information.
- CCJ (county court judgment) A CCJ (county court judgment) is a court order saying you owe someone money. It's usually made by default when you don't respond to a court claim, and it can make it harder to get credit.
- Clear data Clear data means deleting the information your browser or app has saved on your device, such as browsing history, cookies, cached files and autofill entries. It doesn't remove data that websites and companies already hold about you.
- Computer worm A computer worm is a self-contained malware program that copies itself and spreads from computer to computer over a network, usually without anyone clicking anything.
- Confidential information Confidential information is information that only authorized people are allowed to see, such as personal details, medical records, financial data or business secrets, and that must be protected from unauthorized access or disclosure.
- CPN (credit privacy number) A CPN (credit privacy number) is a nine-digit number that sellers claim can replace your Social Security number to build a new credit file. The FTC says promises to create a new credit identity are a scam.
- Credential stuffing Credential stuffing is an attack where criminals take username and password pairs stolen from one service and automatically try them on other services, hoping the same login works.
- Credit alert A credit alert usually means a fraud alert: a free notice on your credit file that asks lenders to verify your identity before opening new credit in your name. It can also mean a notification from a monitoring service.
- Credit card chargeback A credit card chargeback is when your card issuer takes a charge back off your bill after you dispute it, for example because it was unauthorized, the amount was wrong, or you never got what you paid for.
- Credit card ZIP code A credit card ZIP code (postal code outside the US) is the postal code of the billing address linked to your card account. Merchants ask for it to help confirm you are the cardholder.
- Credit freeze A credit freeze, also called a security freeze, stops prospective creditors from seeing your credit report, so no one can open a new credit account in your name until you lift it.
- Credit protection Credit protection is any step that makes it harder for someone to open credit in your name. In the US, the two free tools are a credit freeze, which blocks new accounts, and a fraud alert, which makes lenders verify your identity first.
- Credit protection fees Credit protection fees are charges for paid services like credit locks and credit monitoring. A credit freeze, which protects you just as well from new accounts being opened, is free by law.
- Credit protection program A credit protection program is a service or set of tools that helps guard your credit file against identity theft, such as a credit freeze, a fraud alert or paid credit monitoring.
- Credit score in Australia Credit score in Australia is a number from a credit reporting body that summarises your credit report and helps lenders decide whether to lend to you and on what terms.
- Criminal identity theft Criminal identity theft is when someone gives your name and personal details to police when they are stopped or arrested, so the criminal record ends up in your name.
- Cyber abuse Cyber abuse is using the internet to send, post or share content that harms someone's physical or mental health, such as threats, harassment, stalking or sustained hate.
- Cyber Essentials Plus Cyber Essentials Plus is the higher level of the UK government-backed Cyber Essentials scheme. It covers the same 5 technical controls, but adds independent technical testing to check they work in practice.
- Cyber flashing Cyber flashing is sending someone an unsolicited sexual image, usually a photo of genitals, by phone or online, often by AirDrop, text or social media. In England and Wales it is a criminal offence.
- Cyberbullying Cyberbullying is bullying that happens on phones, computers and tablets: sending, posting or sharing negative, harmful, false or mean content about someone, including their private information.
- Cyberstalking Cyberstalking is stalking carried out online or through electronic communication: repeated, unwanted contact or monitoring that makes someone afraid, distressed or feel unsafe.
D
- Data aggregation Data aggregation is compiling data from one or many sources into a single combined view, which can reveal things that no single piece of data shows on its own.
- Data anonymization Data anonymization is the process of removing the link between a set of data and the person it describes, so the data can no longer be tied back to that individual.
- Data asset A data asset is any entity made up of data, such as a database, a document, an output file or a web page. NIST's glossary also counts a service that returns data from an application.
- Data breach A data breach is an incident where personal or other sensitive information is accessed, disclosed or taken by someone who shouldn't have it, whether through an attack or by accident.
- Data broker A data broker is a company that collects personal information about people from many sources and sells or licenses it to others, even though those people never dealt with the company directly.
- Data collector A data collector is any website, app, advertiser or company that gathers information about you, such as what you browse, where you are and what you buy, and stores or uses it.
- Data controller A data controller is the person or organisation that decides why and how personal data is processed. Under the UK GDPR it carries the main legal responsibility for protecting that data.
- Data exfiltration Data exfiltration is the unauthorized transfer of information out of a system. In practice it means someone copying data out of a computer, account or network without permission.
- Data governance Data governance is a set of processes that ensures an organization's data assets are formally managed, with clear authority and rules for who can make decisions about the data it produces or manages.
- Data injection Data injection is an attack where someone feeds malicious or fake input into a program, such as a web form or an identity check, so that it runs unintended commands or accepts something false as genuine.
- Data integrity Data integrity means data hasn't been changed in an unauthorized way since it was created, sent or stored. It's one of the three core goals of information security, along with confidentiality and availability.
- Data interception Data interception is when someone secretly captures information while it travels between two parties, such as your device and a website, so they can read it or change it before it arrives.
- Data interception and theft Data interception and theft is when an attacker captures information as it travels between two parties, such as your device and a website, and copies or alters it without either side knowing.
- Data leak A data leak is when personal or sensitive information ends up somewhere it shouldn't be, such as an open server, a misdirected email or a shared file, often by mistake rather than because someone broke in.
- Data leakage Data leakage is when personal or confidential information reaches people who shouldn't see it, by accident or through weak security, rather than through a deliberate attack on the system holding it.
- Data logging Data logging is the automatic recording of events or measurements over time. In security, a log is a chronological record of system activity, such as who accessed a system and what they did.
- Data management Data management is the planning, policies and day-to-day practices an organization uses to handle its data, from collection to deletion, so the data stays accurate, protected and useful.
- Data mapping Data mapping is the process of working out what personal data an organisation holds, where it comes from, where it is stored and who it is shared with. It is usually the first step in building a record of processing activities.
- Data masking Data masking is replacing real values in a data set, such as a phone number or name, with substitutes like asterisks or a random pseudonym, so the real information is hidden but the data stays usable in form.
- Data minimisation Data minimisation is the GDPR principle that an organisation may collect and keep only personal data that is adequate, relevant and limited to what it needs for its stated purpose, and no more.
- Data mining Data mining is analyzing large collections of data to find patterns, links and trends. Companies use it to predict behavior, target ads and score risk, and when the data is about people it raises privacy questions.
- Data owner A data owner is the person or role accountable for a set of data and for deciding how it is collected, used, protected and disposed of. In security frameworks, it is the official who sets the controls for that information.
- Data ownership Data ownership is the question of who has the right to control a set of data: to decide how it's collected, used, shared and deleted. For personal data, privacy laws usually give people rights over it rather than treating it as property.
- Data point A data point is a single piece of information, such as one measurement, one fact or one answer. In privacy, each detail about you (a name, an address, a phone number) is a data point.
- Data privacy Data privacy is your ability to control who collects, uses and shares information about you. NIST describes privacy as freedom from intrusion into your private life that results from undue or illegal gathering and use of data about you.
- Data processing Data processing means doing anything with personal data, such as collecting, recording, organising, structuring or storing it. Under the GDPR, almost every use of information about a person counts as processing.
- Data processor A data processor is a person or organisation that processes personal data on behalf of a data controller, following the controller's instructions rather than deciding for itself why or how the data is used.
- Data processor (GDPR) Data processor (GDPR) means a person or organisation that processes personal data on behalf of a data controller. Under Article 4, the processor follows the controller's purposes and doesn't decide them.
- Data profiling Data profiling, in a privacy sense, is automated processing of personal data to evaluate things about a person, such as their interests, behavior, finances or location, and often to sort them into groups.
- Data Protection Act (DPA 2018) The Data Protection Act 2018 is the UK law that sets how organisations may collect, use and store personal data. It works alongside the UK GDPR and gives you rights over your own information.
- Data protection authority (DPA) A data protection authority (DPA) is the independent public body that supervises data protection law in a country. It advises organisations, takes complaints from individuals, investigates and can take enforcement action.
- Data protection law Data protection law is the set of rules that control how organisations collect, use, store and share personal data, and that give people rights over their own information.
- Data protection officer (DPO) A data protection officer (DPO) is the person an organisation designates to monitor its compliance with data protection law, advise it on its obligations and act as the contact point for individuals and the regulator.
- Data protection policy A data protection policy is an organisation's internal document that sets out how it handles personal data, who is responsible, and how it follows data protection law.
- Data protection principles The data protection principles are the seven rules in Article 5 of the UK GDPR that organisations must follow when they handle personal data, from lawfulness and fairness to security and accountability.
- Data purge A data purge is the permanent removal of data so that it cannot be recovered. In NIST's media sanitization guidance, purge means making recovery infeasible even with state-of-the-art laboratory techniques.
- Data scraping Data scraping is the automated collection of information from websites, often in bulk. When the information includes personal details such as names, photos or contact data, privacy and data protection laws can apply.
- Data steward A data steward is the person or group responsible for how a set of data is protected, shared and kept accurate, including enforcing the policies that govern it.
- Data subject A data subject is the identified or identifiable living person that personal data is about. Under UK GDPR and the EU GDPR, that's you whenever an organization holds information that can be linked to you.
- Data subject access request (DSAR) A data subject access request (DSAR) is a request you make to an organisation to get a copy of the personal data it holds about you. In the UK it's your right of access under UK GDPR, and it's usually free.
- Data transparency Data transparency is an organisation being open about how it handles personal information. NIST describes it as clear, accessible notice of how personal data is collected, used, stored and shared.
- DBS check A DBS check is a criminal record check from the Disclosure and Barring Service, used in England and Wales. Employers and voluntary organisations use it to check someone applying for a role. There are four levels, from basic to enhanced with barred lists.
- De-identification De-identification is any process that removes the link between a set of identifying data and the person it belongs to, so the data no longer points to a specific individual.
- Deep web The deep web is the part of the internet that search engines do not index and that you normally reach with a login or credentials, such as an online bank account or an internal company system. It is not the same as the dark web.
- Deepfake A deepfake is an image, video or audio clip created or altered with artificial intelligence to make it look or sound like a real person said or did something they never did.
- Demographic data Demographic data is information about the statistical characteristics of a population, such as age, income or location, used especially to identify and describe groups of people for markets, planning and research.
- Denial of service (DoS) attack A denial of service (DoS) attack stops legitimate users from reaching a website, service or system, or slows it down, usually by overwhelming it with traffic or requests.
- Dictionary attack A dictionary attack is a way of guessing a password by trying a long list of likely words and common passwords instead of every possible combination. It is a faster, more targeted cousin of a brute force attack.
- Digital certificate A digital certificate is an electronic credential that ties a public key to its owner, such as a website or a person, and is signed by a trusted authority so others can check the owner's identity.
- Digital fingerprinting Digital fingerprinting is a way of identifying your device by combining many small details, such as screen resolution, installed fonts and browser settings, into a profile that is usually unique to you.
- Digital forensics Digital forensics is the process of finding, collecting, examining and analyzing data from computers, phones and other devices in a way that keeps the evidence intact, so it can be used to investigate an incident or in court.
- Digital ID Digital ID, or digital identity, is the unique representation of a person in an online transaction: the account or credentials that let a service recognize you. Some digital IDs are also tied to your real-world identity.
- Digital keys Digital keys are secret values that a cryptographic algorithm uses to lock, unlock or sign data. Whoever holds the right key can read protected data or prove a message came from them.
- Digital literacy Digital literacy is the set of skills you use to find, evaluate, organize, create and communicate information with technology, along with using it responsibly. US federal law defines it this way.
- Digital signature A digital signature is a code made from a document and the signer's private key. Anyone with the matching public key can use it to check who signed the document and that nobody changed it afterwards.
- Doxxing Doxxing is collecting someone's personal details, such as their home address, phone number or workplace, and publishing them online to harass, threaten or humiliate them.
- Dynata Dynata is a market research company that supplies sampling technology and survey respondents to businesses, universities and government agencies, and it may contact people by phone, email, post or online.
- Dynata phone call A Dynata phone call is a call from Dynata, a market research company that runs telephone surveys. The company exists, but scammers also pose as survey firms, so don't share sensitive details.
E
- Email alias An email alias is an extra email address that delivers to your real inbox, so you can give out the alias instead of your main address. If it gets spammy or leaked, you can switch it off.
- Email mask An email mask is a unique, random email address that forwards to your real inbox, so you can sign up for apps and sites without giving them your actual address.
- Employment identity theft Employment identity theft is when someone uses your Social Security number or other personal information to get or keep a job, so their wages show up under your name.
- Examples of PII Examples of PII (personally identifiable information) include a name, Social Security number, date of birth, home address, phone number and biometric records: any information that can identify a person, alone or combined with other data.
F
- Facebook spam Facebook spam is unwanted or deceptive content sent through Facebook, such as junk messages, fake friend requests, comment links and posts from hacked accounts, usually meant to sell something, steal logins or scam you out of money.
- Fair processing (fairness principle) Processing data fairly means handling personal data only in ways people would reasonably expect, without using it in ways that have unjustified harmful effects on them. It is part of the first UK GDPR principle.
- Fake taxi A fake taxi is a car posing as a licensed taxi or minicab, or an unlicensed driver offering rides, that has not been vetted or insured to carry passengers.
- Fraud protection Fraud protection means the steps, tools and services that make it harder for someone to use your identity, accounts or money without your consent, such as credit freezes, fraud alerts, account alerts and strong logins.
G
- Geo data Geo data is information that ties something to a place on Earth. In privacy, it usually means location data from your phone, car or apps that shows where you are or have been.
- Geolocation data Geolocation data is information that shows where a device, and so usually its owner, is or has been. It comes from GPS, Wi-Fi, mobile networks and IP addresses, and it can reveal where you live, work and spend your time.
- Google Password Manager Google Password Manager is Google's built-in service for saving passwords and passkeys in your Google Account and filling them in on sites and apps in Chrome and on Android.
H
- Hacker A hacker is a person who attempts to gain, or gains, access to a computer system without authorization. The word is also used more loosely for anyone skilled at breaking into or working around computer systems.
- Hacking a computer Hacking a computer means getting into it, or into its accounts and data, without the owner's permission. Hackers often do it to steal logins or personal information, spread malware or scam other people.
- Home title lock A home title lock is a paid monitoring service that says it protects you from home title fraud, but the FTC says it isn't a lock and isn't insurance: it can alert you after a deed is changed, not stop the change.
I
- Identity management Identity management is the administration of individual identities within a system, such as a company, a network or a country, including who a person is and which roles and access privileges they hold.
- Identity provider (IdP) An identity provider (IdP) is a trusted service that confirms who you are and tells another service, such as an app or website, so you can sign in there without a separate password.
- Identity theft Identity theft is when someone uses your personal or financial information, such as your name, Social Security number or card details, without your permission, usually to get money, credit or services.
- IP theft (intellectual property theft) IP theft (intellectual property theft) is taking or using someone else's inventions, designs, software, writing or brand names without their permission. It is not the same as IP address theft or identity theft.
J
K
- Keychain password A keychain password is a login saved in Apple's keychain, the built-in password manager that stores and autofills your passwords, passkeys, card details and Wi-Fi passwords across your Apple devices.
- Keylogger A keylogger is software that records what you type, usually to capture passwords and other sensitive information, and sends it to someone else.
L
M
- Malware Malware, short for malicious software, is any software or firmware placed on a device on purpose to harm it or its owner: to steal data, spy on activity, lock files or damage systems.
- Malware attack A malware attack is when an attacker gets malicious software, such as a virus, spyware or ransomware, onto your device or network to steal data, take control or demand money.
N
- No caller ID call A no caller ID call is a call where your phone shows no number or name for the caller. Apple calls calls from numbers not saved in your contacts "unknown callers" and lets you screen or silence them.
- No caller ID number A no caller ID number is a call that shows no number or name on your phone, usually labeled "No Caller ID", "Unknown" or "Private". The caller hid the number, or your carrier couldn't pass it on.
- Non-PII Non-PII is information that doesn't identify a person on its own and can't reasonably be linked to one, such as properly de-identified data. The line isn't fixed: data that isn't PII today can become PII when it's combined with other data.
O
- Online footprint An online footprint is the trail of information about you on the internet, including what you post and what websites, apps and data companies collect or publish about you.
- Open register The open register is the version of the UK electoral register that anyone can buy and use, including for marketing. You can opt out of it without affecting your right to vote.
- OSINT (open source intelligence) OSINT (open source intelligence) is intelligence built from publicly or commercially available information, such as news, websites, social media, public records and commercial databases, rather than secret sources.
P
- Password A password is a secret string of characters, such as letters, numbers and symbols, that you use to prove you are who you say you are and to get into an account, device or service.
- Password characters Characters in a password are the individual symbols you type to make it up: letters, numbers, spaces and symbols such as ! or #. Password length is the number of characters.
- Password hash A password hash is a scrambled, one-way version of a password that a website stores instead of the password itself, so the real password isn't kept in readable form.
- Password hint A password hint is a short clue a person saves with an account to help them remember their password, shown to them when they can't log in. Security guidance says hints that anyone can see are a risk.
- Password manager A password manager is an app that creates, stores and fills in a different strong password for each of your accounts, so you only have to remember one strong password: the master password for the manager.
- PCH caller ID PCH caller ID is a name or number on your phone screen claiming to be Publishers Clearing House. Scammers use it to say you've won a prize, then ask you to pay a fee first. The real PCH never asks for one.
- PCH phone call A PCH phone call is a call, text or letter claiming you've won a Publishers Clearing House prize. Unexpected ones are scams: the caller wants you to pay fees or taxes to collect winnings that don't exist.
- Personal data Personal data is any information about a living person who can be identified from it, directly or indirectly, such as a name, an address, an ID number, location data or an online identifier like an IP address.
- Personal information Personal information is any information about an identifiable individual. In Canada's privacy law (PIPEDA) it covers anything that could identify you, alone or combined with other details.
- PHI PHI is health information tied to a specific person and held by a healthcare provider, health plan or their partners, which HIPAA protects. PII is the broader category: any information that can identify a person.
- PHI (protected health information) Protected health information (PHI) is health information that can identify a person, such as a medical record number, diagnosis tied to a name or an appointment date, when a HIPAA-covered organization holds or shares it.
- Phone spoofing Phone spoofing is when a caller deliberately falsifies the information shown on your caller ID so the call looks like it comes from a different number, person or organization than it really does.
- PII (personally identifiable information) PII (personally identifiable information) is any information that can identify a specific person, either on its own (such as a Social Security number) or when combined with other details (such as birth date and place of birth).
- PII data (personally identifiable information) PII data is any information that can identify a specific person, either on its own or when combined with other details about them. Names, Social Security numbers and biometric records are common examples.
- Potential fraud call A potential fraud call is a call your carrier has labelled "Potential Fraud" because its analytics flag the number as a possible scam. It is a warning based on a risk score, not proof the call is fraud.
- Potential spam Potential spam is a warning your phone shows on an incoming call when it thinks the caller may be a spam or scam number. It is a guess based on reports, not proof the call is harmful.
- Potential spam call Potential spam call is the label your phone or carrier puts on an incoming call it suspects is an unwanted robocall or sales call. It's a guess, not proof: the call may be legitimate, and some scam calls carry no label at all.
- Pretexting Pretexting is getting someone's personal information by lying about who you are or why you need it, for example by posing as a bank employee, a colleague or the account holder.
- Private caller A private caller is someone whose phone number is hidden from your screen because they blocked it. The call shows as private or unknown, which is legal and doesn't by itself mean the call is a scam.
- Private data Private data is information about you that you haven't chosen to make public and that could be used to identify you or harm you if others got it, such as your home address, ID numbers, health details or account logins.
- Private information Private information is anything that can identify you or be traced to you, such as your name, Social Security number, biometric records, date and place of birth, and financial, medical or employment details.
- Prosper data breach The Prosper data breach was a 2025 security incident at Prosper Marketplace, a US peer-to-peer lender, that exposed customer data such as names, Social Security numbers and birth dates.
- Public records (US) Public records are documents held by government bodies that, with some exceptions, the public has a legal right to see. They can include court files and other records that hold personal details about you.
R
- Rainbow table attack A rainbow table attack cracks stolen password hashes by looking them up in a huge table of precomputed hashes, instead of guessing passwords one by one. Salting defeats it.
- Replay attack A replay attack is when an attacker records a valid message between two parties, such as a login exchange, and sends it again later to pass as the real user or system.
- Restricted call A restricted call is a phone call where the caller has blocked their number from showing on your screen, so it appears as Restricted, Private, Blocked or Unknown instead of a number.
- Restricted phone call A restricted phone call is a call where the caller has hidden their phone number, so your screen shows a label such as "restricted", "private" or "unknown" instead of a number.
S
- Scam likely call Scam likely call is a call marked with a caller ID warning that it may be fraud. The label comes from call labeling, a service some phone companies offer, and it's based on a guess, not a confirmed scam.
- Screening calls on iPhone Screening calls on iPhone is a setting that asks callers from unsaved numbers why they are calling before your phone rings, or silences those calls and sends them to voicemail. It is built into the Phone app.
- Security clearance A security clearance is an official decision that a person is eligible to access classified government information, based on a background check of their loyalty, character, trustworthiness and reliability.
- Security code A security code is a short, usually one-time number that a company sends you to confirm you are really you when you log in, reset a password or approve a payment. Anyone who has it can act as you, so never share it.
- Security delay Security delay is an iPhone feature, part of Stolen Device Protection, that makes some sensitive changes wait one hour and need a second Face ID or Touch ID check when the phone is away from familiar places.
- Security engineer A security engineer is a person who designs, builds and tests the protections that keep computer systems and data safe, such as secure software, networks and access controls.
- Security key A security key is a small physical device, usually USB or NFC, that you plug in or tap to prove it's really you when you sign in. It's a hardware form of two-step verification.
- Security posture Security posture is the overall security status of a network, system or organization: the people, hardware, software and policies in place to defend it, and how well it can react as the situation changes.
- Sensitive data Sensitive data is personal information that carries a higher risk of harm or discrimination if it leaks, such as health, religion, sexual orientation, political views or biometric data, and that privacy law protects more strictly.
- Signs of identity theft The signs of identity theft include accounts on your credit report that you didn't open, bills or charges for things you didn't buy, and bills that stop arriving because someone changed your billing address.
- SIM swapping SIM swapping is when a criminal gets your mobile carrier to move your phone number to a SIM card they control, so they receive your calls and texts, including the codes used to log in to your accounts.
- Skimming data breach A skimming data breach is when criminals secretly copy payment card details as they are entered, either on a tampered card reader or cash machine, or on a hacked online checkout page, then use them for fraud.
- Smishing Smishing is phishing by text message: a scammer sends an SMS pretending to be a bank, delivery company or agency and tries to get you to click a link or share personal details.
- Smishing and phishing Smishing is phishing sent by text message (SMS), and phishing is the wider scam where someone pretends to be a trusted company or person to trick you into giving up information or clicking a bad link.
- Smurf attack A smurf attack is a denial-of-service attack where the attacker sends network ping requests to many devices with the victim's address forged as the sender, so all the replies flood the victim and knock it offline.
- Social Catfish Social Catfish is a people-search website. Its own opt-out page lets US residents ask it to stop selling their personal information, and says it will delete what it can verify as theirs.
- Social engineering Social engineering is tricking a person into giving up information or taking an action, such as sharing a password or sending money, by exploiting trust, fear or urgency instead of breaking into a system.
- Social engineering examples Social engineering examples include a fake IT call asking for your password, a spoofed bank email or an urgent text with a link: any scam that tricks you into handing over information or access.
- Soft credit check A soft credit check is a look at your credit file that doesn't affect your credit score and isn't a response to you applying for credit. Examples include checking your own report or a lender reviewing an existing account.
- Spam call A spam call is an unwanted, unsolicited phone call, usually automated or mass-dialed, that tries to sell you something or trick you into handing over money or personal details.
- Spam caller A spam caller is a person or automated system that phones you with unwanted calls, such as sales pitches, robocalls or scams, usually without your permission and often from a number they've disguised.
- Spam number A spam number is a phone number used to make unwanted calls or texts, such as robocalls, telemarketing or scams. Scammers often fake the caller ID, so the number you see may not be the real one.
- Spam risk Spam risk is a label your phone carrier or a call-blocking app puts on an incoming call when it suspects the call is unwanted or fraudulent, based on call patterns or complaints.
- Spear phishing Spear phishing is a phishing attack aimed at one specific person or organization, using personal details about the target to make the fake email or message look genuine.
- Special category data Special category data is the more sensitive kind of personal data that the UK GDPR protects more strictly, such as health, genetic and biometric data, or information about race, religion, politics, trade union membership, sex life or sexual orientation.
- Spoofed call A spoofed call is a phone call where the caller deliberately changes the number or name that shows on your screen, so it looks like it comes from someone you trust, such as a bank, a government agency or a neighbor.
- Spoofing Spoofing is disguising where a call, text or message really comes from by faking the sender information, such as the number on your caller ID, so you trust it and respond.
- Spyware Spyware is software that secretly collects information from your device, such as what you type, where you are or what you browse, and passes it to someone else without your knowledge.
- Strong password A strong password is one that's long enough and unusual enough that criminals can't guess or crack it, and that you don't reuse anywhere else.
- Suspected spam Suspected spam is a warning label your phone or email app puts on a call or message it thinks is unwanted or fraudulent. It is a guess, not proof, so you decide what to do next.
- Swatting Swatting is making a hoax emergency call, often claiming an immediate threat to life, to send armed police or a SWAT team to a victim's address. It's done to harass, intimidate or retaliate, and it can be deadly.
- SYN attack SYN attack (also called a SYN flood) is a denial-of-service attack that sends a server a flood of connection requests it never completes, leaving half-open connections that block real visitors.
T
- Telemetry data Telemetry data is information that a device or app measures about itself or its use and sends automatically to a remote system for recording and analysis.
- Third-party cookie A third-party cookie is a cookie set by a domain other than the website you are visiting, usually through embedded content such as ads. It can let the company behind it recognise you on other sites that use the same service.
- Tracker Trackers are bits of code on a website, in an app or on a device that record what you do online, such as the pages you visit, so companies can recognize you and build a profile.
- Trojan horse A Trojan horse is malicious software disguised as something useful. NIST defines it as a program that appears to have a useful function but also has a hidden, potentially malicious function that evades security mechanisms.
- Trojan horse (Trojan malware) A Trojan horse is a program that looks useful but has a hidden, malicious function, so it does harm once you install and run it.
- Two-factor authentication (2FA) Two-factor authentication (2FA) is a login check that asks for a second proof of identity, such as a code from your phone or a security key, on top of your password, so a stolen password alone can't open your account.
- Types of malware Types of malware are the main kinds of software built to gain unauthorised access, steal data or cause damage: viruses, worms, Trojan horses, ransomware and spyware. They differ in how they spread and what they do.
U
- Unknown caller An unknown caller is a call where your phone can't show who is calling: the number is hidden, blocked or not in your contacts. "No caller ID" and "unknown" usually mean the caller chose to hide their number, or the network couldn't pass it on.
- Unknown caller ID Unknown caller ID is what your phone shows when the incoming call has no number or name attached, because the caller hid it or because the network could not pass it along.
- Unknown caller on iPhone An unknown caller on iPhone is a call from a phone number that isn't saved in your contacts. iPhone can screen these calls, silence them or sort them into an Unknown Callers list.
- Unknown number An unknown number is a call from a number you don't have saved, or one that shows up with no number at all. The caller may be a real person, a business, an automated call or a scammer.
V
- Virus (malware) A virus (malware) is harmful code that infects a computer, runs without your permission and can damage your data or system. Malware is the wider term that also covers worms, Trojans and spyware.
- Vishing Vishing, short for voice phishing, is a scam where someone phones or leaves a voice message pretending to be a bank, company or agency to trick you into giving up money, codes or personal details.
- VPN on iPhone VPN on iPhone means the phone is connected to a network through a virtual private network (VPN), which is shown by a VPN icon in the status bar at the top of the screen.
W
- Watering hole attack A watering hole attack is when an attacker infects a website that a specific group of people visit often, so that the computers of people in that group get infected when they visit it.
- Web filter A web filter is software or a service that blocks or allows websites based on rules, such as known malicious addresses or unwanted categories of content.
- Web tracker A web tracker is code or a small file on a website or app that records what you do, such as which pages you visit, so advertisers and other companies can recognize you over time.
- Website trackers Website trackers are cookies, pixels and similar technologies that a site places on or reads from your device to recognize you and record what you do, often for advertising or analytics.
- Whaling (whale phishing) Whaling is a phishing attack aimed at senior executives or other high-ranking people, using a message that looks like it comes from a trusted source to steal information or get money moved.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.