The attack surface for an individual or small organization is no longer limited to the inbox. Personal data breaches led to a sharp increase in requests for assistance in 2025, according to Cybermalveillance.gouv.fr, and scam techniques now combine text messages, phone calls, and bank transaction approvals in a single sequence. Protecting your devices and online data means going beyond generic checklists and addressing the actual ways attackers gain access.
Passkeys and multifactor authentication: how they actually improve phishing resistance
Passwords, even long and complex ones, remain vulnerable whenever a user enters them on a fake website. Passkeys use a pair of cryptographic keys linked to the relevant service: the private key never leaves the device and cannot be replayed on a fraudulent domain. The main benefit is not convenience—it is eliminating the risk of entering credentials on a cloned website.
On March 20, 2025, the CNIL adopted a recommendation on multifactor authentication. It confirms that two-factor authentication remains a minimum baseline, but it is not an absolute guarantee. Someone can still approve a fraudulent transaction themselves if they are manipulated over the phone.
Consumer articles often treat two-factor authentication as a box to tick. In practice, we recommend prioritizing accounts by how critical they are: bank accounts, your primary email account, and cloud storage first, followed by social media. The security section of Tech Mafia provides detailed, service-specific activation instructions and explains the differences between TOTP, push notifications, and passkeys.
Multichannel scams: why a single warning sign is no longer enough to spot fraud
The classic suspicious email riddled with spelling mistakes is a thing of the past. Reports from 2025 cited by Cybermalveillance.gouv.fr point to a rise in scams involving fake bank advisers and spoofed phone numbers. A typical scenario unfolds in several steps: an alert by text message, followed by a call from a number that looks like the bank’s, then a request to approve a transaction in the mobile app.
Data breaches directly fuel the credibility of these attacks. When a scammer knows their target’s name, address, and account number, it becomes difficult to tell their pitch from a legitimate call. The only reliable defense is to hang up and call the organization’s official number, taken from a paper statement or its verified website—never from a link or number you received.
Practical steps to take when you receive a suspicious request
- Never approve a bank transaction at the request of someone who contacts you, regardless of the channel (text message, phone call, or instant message). A legitimate bank adviser will not ask you to confirm a transfer in real time over the phone.
- Check the URL of the website you’ve been redirected to before entering any login details. A single altered character in the domain name is enough to create a fraudulent website.
- Report any attempt immediately on the Cybermalveillance.gouv.fr platform, even if you have suffered no loss. Reports help malicious domains get taken down faster.
Updates and separating activities: the real attack surface of your devices
A device running an outdated operating system is exposed to publicly documented, known vulnerabilities. Security patches are not cosmetic improvements: they fix vulnerabilities that attackers sometimes exploit within days of their disclosure. Enabling automatic updates on every device remains the most effective measure for the effort involved.
Keeping personal and work activities separate is more than a basic security recommendation. Connecting a personal USB drive to a work computer, or using the same email address for a government service and a hobby forum, creates links between environments with different levels of security. If one is compromised, an attacker can access the other with no extra effort.
Managing permissions and installed software
Installing apps only from official stores (App Store, Google Play) or verified publishers’ websites reduces the risk of running modified software. On a computer, using a standard user account (without administrator privileges) for everyday tasks limits the damage a malicious program can do: it will not be able to modify system files or install itself deeply into the system.
Every installed app expands your attack surface. Uninstalling software you no longer use and revoking excessive permissions (access to the microphone, location, or contacts) mechanically reduces your exposure. On both Android and iOS, you can review these permissions in the privacy settings in just a few minutes.
Data backups and encryption: the overlooked safety net
Ransomware encrypts files and demands payment. Without a recent backup, victims must choose between paying (with no guarantee of getting their files back) and accepting the loss. Regular backups to a device disconnected from the network (an external drive or offline storage) remove the attacker’s leverage.
A common practical rule is to keep at least two copies of your data on different storage media, with one physically separate from your workstation. Synced cloud services are no substitute for an offline backup: ransomware can spread to synced files before it is detected.
Disk encryption (BitLocker on Windows, FileVault on macOS) protects data if a device is physically stolen. If a laptop is stolen on a train, the thief can access all its files if the disk is not encrypted—even if the computer is protected by a login password.
Digital security is not a fixed state. Attack techniques evolve, data leaks give scammers increasingly precise information, and every new connected device adds a potential entry point. The measures described here require neither a special budget nor advanced skills, but they do need to be applied consistently—not just understood.
