40 Fun Facts About Internet Safety

Which tech billionaire was photographed in 2016 with tape covering the webcam and microphone jack of his laptop?

Mark Zuckerberg gave the habit away by accident in a post celebrating Instagram's half a billion users. Covering the lens stops spyware from watching through it.

Unwanted bulk email takes its name from which canned meat, chanted over and over in a Monty Python sketch?

Spam is repeated so relentlessly in the sketch that it drowns out everything else, which is how early internet users felt about junk messages flooding their inboxes.

What name for luring someone with a fake online identity comes from a 2010 documentary featuring Nev Schulman?

Catfishing took its name from a story told in the film about catfish shipped with live cod, and spread widely in 2013 when football star Manti Te'o was deceived.

Which web company admitted in 2017 that a 2013 hack had exposed all three billion of its user accounts?

Yahoo had first put the damage at one billion accounts in December 2016, then tripled the figure ten months later.

Which password topped SplashData's Worst Passwords List for 2016, making up 4% of all those surveyed?

123456 alone accounted for one in every 25 passwords surveyed, and the 25 most common entries together covered more than a tenth.

The '419' advance-fee email scam, often sent in a prince's name, is numbered after which country's criminal code?

Nigeria covers fraud in section 419 of its code, but the trick is much older: it echoes the 'Spanish Prisoner' letters of the late 1700s.

Which country passed a law in 2024 banning under-16s from holding social media accounts, the first of its kind?

Australia put the burden on the platforms, not on families: companies that fail to keep under-16s off face fines, and the ban took effect in December 2025.

Which video chat site that paired strangers at random closed in 2023 after a lawsuit over child safety?

Omegle was launched in 2009 by Leif K-Brooks, whose farewell message thanked the person who sued for opening his eyes to the site's human cost.

During the 2020 lockdowns, what name was given to strangers gatecrashing online video meetings to disrupt them?

Zoombombing was modelled on the word photobombing and first appeared in mid-March 2020, just as schools and offices moved their meetings online.

Which type of malware poses as a harmless program and relies on the victim to install it?

Trojan horse programs can't spread by themselves as viruses do. Like the Greeks' ruse, they need the victim to carry them inside, often as a free download.

Which scam, documented on AOL in 1995, uses fake emails from trusted names to trick people into revealing logins?

Phishing owes its spelling to 'phreaking', the older hobby of hacking phone lines. On AOL, early attackers posed as staff and asked members for their passwords.

The US Federal Trade Commission warns that no real business or agency will ever demand payment in which form?

Gift cards are a scammer's favourite: callers are rushed into buying Google Play, Apple or Amazon cards and reading out the numbers on the back.

Microsoft says its genuine error messages never include which detail, a hallmark of tech support scam pop-ups?

A phone number in a pop-up leads to a fake help desk, where the caller is talked into paying or letting a stranger take remote control of the computer.

What kind of malware holds a victim's files hostage until a payment, usually in cryptocurrency, is handed over?

Ransomware usually arrives as a booby-trapped email attachment, though the 2017 WannaCry outbreak jumped between computers with no click needed.

Which word for AI-forged video or audio of a real person began as a Reddit username in late 2017?

Deepfake blends 'deep learning' with 'fake'. The Reddit forum that grew up around the name shared face-swapped clips, including many that put Nicolas Cage into other actors' films.

Which snack names the small data file, devised by Netscape's Lou Montulli, that websites store in a visitor's browser?

Cookie was borrowed from 'magic cookie', Unix programmers' name for a packet of data that a program receives and hands back unchanged.

Which website test, named in 2003 by Luis von Ahn and colleagues, makes visitors prove they are human?

CAPTCHA is a contrived acronym with 'Turing test' in the middle; its twisted letters and picture grids are meant to be easy for people and hard for software.

Withdrawing cash from an ATM is a classic case of two-factor authentication: a bank card plus which second proof?

A PIN code is something the user knows and the card something the user has; a thief needs both, which is why a stolen password alone can't open a two-factor account.

Which creature of Scandinavian folklore shares its name with people who post inflammatory messages online?

Troll behaviour feeds on attention and reactions, which is the thinking behind the long-standing advice simply to ignore it.

What name is given to the active or passive trail of traceable data that a person's online activity leaves behind?

A digital footprint has a passive side as well as what a person chooses to post: data left behind involuntarily, simply by being online.

What name is given to headlines and thumbnails that exploit a 'curiosity gap' to lure readers into following a link?

Clickbait teases just enough to make readers curious but not enough to satisfy them, and the page behind it often fails to deliver what was promised.

What name is given to fake pop-up virus warnings that pressure people into paying for useless security software?

Scareware plays on shock and anxiety: a web page claims the computer is infected, then offers a fake antivirus program as the paid cure.

Which type of app keeps every login in a locked vault that opens with one master passphrase?

A password manager can also invent a different random login for every site, so the user never has to memorise them and one leak doesn't unlock the rest.

Which Google setting, often locked on across school networks, filters explicit content out of its results?

SafeSearch also powers child-friendly search engines such as Kiddle and KidzSearch, which pass every query through Google's filter.

In Childnet's SMART rules for children online, which R-word warns that not everything on a screen can be trusted?

Reliable is the R; the other letters stand for safe, meet, accepting and tell, the last meaning to speak to a trusted adult when something feels wrong.

What two-word name is given to stealing a passcode by watching it typed, even through binoculars or hidden cameras?

Shoulder surfing needs no hacking skill at all, which is why cash machine keypads are often fitted with privacy shields.

Which worm of May 2000 spread through email attachments and infected millions of Windows PCs around the world?

ILOVEYOU was written by a college dropout in the Philippines and mailed itself to every contact in each victim's address book.

What term describes tricking people, not machines, into revealing secrets, as hacker Kevin Mitnick famously did?

Social engineering works on trust and pressure instead of code; Kevin Mitnick used it in phone and computer break-ins around Los Angeles from the late 1970s.

Which security method, used by WhatsApp and Signal, means only the sender and recipient can read a message?

End-to-end encryption shuts out the messaging company too: the provider carrying the chat cannot decrypt it, even when asked to.

Smartphone photos often carry hidden Exif data that can reveal which private detail about each picture?

Where it was taken is stored as coordinates inside the image file, a privacy risk that can be avoided by stripping the data with a metadata removal tool.

Which five-letter word do makers often ship as the default password on home routers, expecting owners to change it?

Leaving admin in place is risky: unchanged default logins are one of the main reasons home routers get taken over on a large scale.

Which 1998 US law requires websites to get a parent's consent before collecting personal data from children under 13?

COPPA is the reason so many social networks set 13 as their minimum age: turning younger children away is cheaper than meeting the law's consent rules.

In 2016, malware called Mirai hijacked home cameras and routers into which kind of remote-controlled attack network?

Botnet joins 'robot' and 'network'. Mirai recruited its gadgets by trying over 60 factory-set usernames and passwords, so changing a default login keeps a device out.

Also called URL hijacking, what practice registers misspelled versions of web addresses to catch careless visitors?

Typosquatting sites may mimic the real brand to capture passwords or install malware, and some change the ending, using .cm or .co in place of .com.

Which attack sets up a fake Wi-Fi hotspot that copies a genuine network's name to eavesdrop on people who connect?

An evil twin can pass traffic on to the real network while watching it, so the victim's connection seems to work normally.

Which scam persuades a mobile carrier to move a victim's number to a new card, capturing login codes sent by text?

A SIM swap turns the handset into the weak point: one-time codes texted as a second login step go straight to the fraudster.

Which experimental 1971 program, often called the first computer virus, was hunted down by a rival named the Reaper?

Creeper was chased by the Reaper, written by Ray Tomlinson; some call that the first antivirus program, though it was really a virus built to delete another.

Microsoft's monthly batch of security fixes is nicknamed 'Patch' plus which weekday, the second of each month?

Tuesday releases bundle a month of fixes into one batch, which lets the people who run big networks plan for them.

Which kind of reward scheme for reporting software flaws dates back to a 1983 offer of a Volkswagen Beetle?

Bug bounty offers turn hackers into helpers: Hunter & Ready's 1983 advert promised the car to anyone who found a flaw in its operating system.

Which website, created by Troy Hunt in 2013, lets people check whether their email appeared in a data breach?

Have I Been Pwned grew out of Troy Hunt's study of breaches for patterns; a 2018 addition lets people test a password without revealing it to the site.