Facebook was hacked, and now everyone is scrambling to understand why it happened, who was responsible, and most importantly, what it means for the potentially 90 million affected users. What’s become clear is that Facebook’s unprecedented access to user data across at least 8 million websites—via the ever-present Login With Facebook option—puts each of Facebook’s 2 billion-plus users at risk.

To understand why the Login With Facebook option is a bad idea, we’re sharing three facts you might not know about the problems associated with using a centralized service connected to your social profile as a way to manage logins for many accounts.

Facebook is often referred to as a social media company or a social media app. But that’s not a business model. It would be far more accurate to think of Facebook as the second largest data-collection and advertising agency in the history of mankind, behind Google—we’ll get to them soon. In 2017, 98% of Facebook’s global revenue was generated through its advertising business. It’s no wonder Facebook does everything in its power to collect every ounce of data about everyone they can, whether they have a Facebook account or not. That phone number you gave Facebook to help secure your account? The company used it to serve you and your friends ads. The list of data points they collect is practically endless.
Armed with this data, you could say that Facebook knows more about you than even you know about you. And one of the primary ways Facebook collects this data was just revealed to be vulnerable.

It’s hard to find a service nowadays that isn’t connected to Facebook in some way. For many of those services, users don’t even need to create an account—they simply use Login With Facebook to gain access. In theory, using Facebook as a way to manage logins for third-party accounts is beneficial to all parties: Users get an easy, one-click login, services get new, verified users without the responsibility of securing login data, and Facebook gets access to the user data associated with those services.
​
However, the recent Facebook hack exposed the dangers of using Facebook as a way to manage your logins for many accounts.
It’s unclear what data, if any, was stolen in the hack. However, a paper published by computer scientist Jason Polakis in August 2018 analyzed the different ways hackers could exploit Login With Facbeook, as well as other types of social logins (e.g. signing in with Google) to infiltrate third-party accounts.
In controlled experiments, authors of the paper were able to:

• Get into a target’s Uber account, track the target’s trips in real time, and even tip the driver after a completed trip.
• Send and receive messages on a target’s Tinder account, even though those messages appeared unread on the target’s device.
• Access a target’s Expedia account and view their passport number, TSA information, and payment details.
• Log in to some accounts where users didn’t even use Login With Facebook, as long as those accounts used the same email address associated with their Facebook account. Pro tip: Use a different email for Facebook than you do for any other services to eliminate this risk.

It’s easy to imagine a real-life scenario where hackers take advantage of compromised social accounts connected to third-party services and exploit them.
You can see which third-party apps are connected to your Facebook profile here.

Password managers remember all your different passwords, personal details, and payment info and intelligently fill in that information on your desktop, laptop, tablet, or mobile device. They have all the convenience of using Login With Facebook, but they’re more secure. And while they don’t protect you from 100% of the risks associated with using Facebook, they are the best alternative to allowing Facebook to manage access to all your accounts.

You’re probably wondering, How’s a password manager more secure than using Login With Facebook? It sounds like I’m still putting all my eggs in one basket.

There is one crucial difference: Facebook was and remains a single point of failure for all 2 billion-plus users—a Facebook vulnerability could mean access to millions of users and their associated third-party accounts. In contrast, a password manager prevents this same “one-to-many” hack, because it requires a unique key—your master password, which is never stored online and is known only by you—to unlock your personal data. A password manager is designed to keep each of your accounts separate, so if one account becomes compromised, your other accounts remain secure.

So, while you’re keeping all your eggs in one basket, imagine that basket is locked inside a safe which is locked inside a larger vault. Even if someone manages to open the vault, your safe is protected by your unique master password.

All the problems associated with using a centralized service like Facebook exist with any type of social login, including Google, LinkedIn, Twitter, or Yahoo. In fact, LinkedIn, Twitter, and Yahoohave already been hacked, and Google recently revealed a breach for hundreds of thousands of users. The common thread? Each of these businesses generates revenue primarily through ad sales.

And the truth is, these data privacy issues shouldn’t have to be solved by users. Legislation around data privacy is underway in the U.S., and will continue to evolve to protect citizens. Facebook could take a big step in the right direction by allowing users to opt-in or out of allowing Facebook to connect their accounts with third-party services. That way, users are in control of where and how their data is shared, not Facebook.
​
But until that becomes a reality, stop entrusting your data to companies whose primary goal is to sell you ads. A security-focused password manager, like Dashlane, puts you in control of your private data and provides the same convenience of instant logins across all your accounts.

Thank to Eitan Katz from Dashlane

The internet is the most widely used communication network ever constructed. It’s used by millions of humans and machines every second of every day. There are good and bad things happening on the internet, and among the bad things are ongoing attempts to scam innocent people out of their money or identities.
Indeed, wherever there’s a slight opportunity of making some easy money, you can be sure that criminals lay ready to pounce. The internet brings with it many such opportunities, and fraudsters appear to be waiting around every virtual corner with the latest in online scams.
While some scams have gotten very sophisticated, even some of the older, less advanced plays still actually work. If people know more about the types of scams taking place and what to look out for, we can hopefully save at least some people from getting swindled out their hard-earned cash.
We’ve covered some specific types of scams in various dedicated posts, but here we’ll offer a roundup of many of the scams currently in operation.

Here’s our list of over 70 common online scams to be aware of:

Email-based scams:
Email scams are a type of fraud. While it’s true that a fraudulent offer can be contrived with almost any story, there are a few “tried and true” cons that seem to crop up repeatedly over time, such as advanced fee fraud, over payment fraud, and work from home scams, among others.
The broad strokes tend to remain the same, but the details of these types of fraud change over time. There are resources to keep on top of the ever changing scams, and steps to take to defend against them.
Email is an extremely common format for many scams for the simple fact that it’s so cheap and easy to execute. You would think that scammers would have refined their approach by now, but many scam emails are poorly written and fairly easy to spot. Nonetheless, some are more sophisticated and people still lose a lot of money to email scams every year.

Advanced fee:
This scam has many variations, and may claim that you are a beneficiary of some estate money, have won the lottery, or have an old bank account you’ve forgotten about.

A scam requesting a nominal fee of $82 in return for a supposed sum of $7.5 million.
​
Whatever the subject, the email is requesting that you send a fee in advance before you can receive whatever is promised.

Nigerian 419:
This is a variation of the advanced fee scam but deserves its own spot since it has been so prevalent. Emails typically promise large rewards for helping “government officials” move money to US banks, with upfront fees required. The scam started in Nigeria and violates penal code 419 in the country.

Charity fraud:
Charity scams simply play on the emotions of victims to persuade them to hand over donations to fake charities and organizations. Subjects might include puppies in danger or disaster relief efforts. The emails typically include some excuse as to why the matter is urgent and may include links to legitimate-looking websites. Aside from sending money, victims may be handing over their credit card details to thieves.

Work from home:
Working from home has so many draws and is a major lifestyle goal for many people. Scammers capitalize on the dreams of these would-be remote workers by luring them with fantastic yet realistic-sounding work-from-home opportunities. The catch? They just need to pay upfront for some equipment or educational materials before they can get started, but these never arrive, and there is no actual job.

Cancelled account:
​Some scammers spend a fair amount of time creating official-looking emails from reputable service providers. They tell the target that the account is about to be suspended and that they need to provide information to keep it open. The email might include a link to a phishing site requesting login credentials and billing details to secure the “continuation of service.”

​Netflix customers were recently hit by such a scam.

CEO fraud:
This one is more targeted toward businesses. The scammer identifies the person within a company that has control over funds. They then pose as someone with authority such as the CEO, and request money be transferred to a specified account. With all of the information available on LinkedIn these days, it’s fairly easy for fraudsters to identify who to target and to come up with convincing stories (see also: whaling).
This type of phishing requires some preparation because the scammer needs to act convincingly like the executive he or she is purporting to be. The fraudster will then contact someone in the company who has the authority to move money and direct that person to transfer funds to the scammer.
As with most phishing scams, CEO phishing is most effective when there’s a sense of urgency or emotionalism applied to the request. Therefore, many CEO phishers will zero in on new members of the finance department in the hopes that person does not yet know all the safeguards that may be in place to prevent the scam from working.
Read more on CEO fraud here.

Greeting cards:
The very simplistic greeting card scam can be used to infect your computer with malware. The email poses as a greeting card (e-card) from a friend or family member and encourages you to click a link. Once you do, the malware is automatically downloaded and installed on your system.

Affinity fraud:
Affinity fraud refers to when someone uses a common interest or belief such as religion to lure you in. It often happens in person, especially within religious communities, but can be conducted via email too.

​The above email uses faith to try to hook the reader and persuade them that it’s legitimate.

Guaranteed bank loan or credit card:
In this take on the advanced fee scam, you are told that you are preapproved for a loan or credit card but that you just need to pay some processing fees. It could be a small amount but fraudsters might be looking for banking info more so than the money itself.

Service provider:
This one often targets businesses and involves an email containing an invoice for legitimate-sounding services. A sense of urgency is used to convince the receiver that they need to pay immediately or risk having the case transferred to a collections agency.

Scam compensation scam:
Yes, believe it or not, this one pops up regularly in spam folders. The email explains that its sender is coordinating some compensation for scam victims, and the receivers’ name is on a list of victims.

You just need to send over some personal details before you can start collecting your compensation.

Elder fraud:
While most online scams can be targeted toward virtually anyone with access to a computer, many are crafted specifically with the elderly in mind. Seniors are often targeted for identity theft since they are perceived as being more susceptible to certain scams. Here are some of the most common forms of elder fraud but you can find more about detecting and reporting these scam in our elder fraud article.

Investment schemes:
Elderly people seeking to invest are often looking for short-term lucrative projects to supplement their retirement income. Some scams simply promise fantastic returns in order to get seniors to hand over their money.

Insurance schemes:
The insurance scam plays on the assumption that seniors might be less focused on what they have now and more so on what they will leave behind for loved ones. This type of scheme might involve a phone call or email persuading the senior that they need an annuity or life insurance policy. Often the insurance firm is completely made up, but insurance scams are actually sometimes carried out by legitimate agents, including one who has been caught multiple times.

Health scams:
As people age, health tends to be more likely to deteriorate and the need for prescription medication can become expensive. Many online pharmacies have stepped in to offer drugs and other healthcare at lower than average prices. The problem is, most of these sites do not operate within the law or follow standard practices. For example, the founder of Canada Drugs is wanted in the US for selling counterfeit medicines, but the website is still very much up and running.

​Without proper regulation, consumers really have no way of knowing what they are getting or if they will receive anything at all.

Grandparent scam:
This one is technically a form of vishing and involves someone calling a grandparent and posing as their grandchild who needs money urgently. They might say they’re in jail or in need of medical help abroad, but that it’s imperative they get the money immediately. Of course, the desperation tugs on the heartstrings of their “relatives” and one convicted scammer said that about one in 50 people fell for his scam.

Extortion:
Extortion scams follow the basic premise that you need to hand over money urgently or face a predefined consequence, whether it be real or fabricated. Extortion schemes can be simple or extraordinarily complex, depending on the imagination of the perpetrator involved. Here are some of the online extortion scams to look out for.

Ransomware:
Ransomware is a type of malware that involves an attacker encrypting your files with the promise of decrypting them only in return for a fee. One of the most notorious cases of ransomware was the 2017 WannaCry attack in which more than 400,000 machines were infected. Ultimately, criminals took an estimated $140,000 worth of bitcoin in exchange for decrypting users’ hijacked files. Backing up files regularly can help protect you against the threat of ransomware.

Sextortion:
In this form of extortion, victims are typically lured into sharing intimate photos or videos, often through dating sites or social media. They may even be prompted to perform explicit acts while being secretly filmed. They are then asked to pay a fee to prevent the photos or videos from being released.

Hitman:
​This terrifying scam involves threats of physical violence and even death, usually sent via email. The claim is often that the person sending the email has been hired to kill you and will relinquish their role in exchange for a fee. Emails might include personal details garnered from social media or other sources to make them seem even more threatening. Aside from going after your money, some scammers also try to obtain your personal information for use in identity theft.

Terrorist threat:
This is a variation of the hitman scam that plays on today’s societal fear of terrorist acts. Again, the basic premise is that your life will be spared only if you pay up.

Bomb threat:
Another one playing on the fear of recent world events is the bomb threat scam. This is an email telling people that there is a bomb planted in their building and it can disconnected only if a certain fee is paid.

DDoS attack:
Distributed Denial of Service (DDoS) attacks are similar to ransomware attacks, except that instead of file encryption you often have whole websites or internet services taken down. Web servers hosting these sites and services are flooded with dummy traffic that overwhelms them, slowing the site down to a crawl or even shutting it down altogether. Victims are instructed to pay a fee to gain back control over the service. Businesses are often prime targets for this type of attack.

Phishing:
We’ve touched on phishing in some of the other sections, but with this field comprising such a large portion of online scams, it’s good to know about the different types to look out for. In fact, the common element in almost all types of internet scams is the initial “phish.” This is the act of tricking you into providing some kind of information that is later used to scam you.
The odds of pulling off a successful scam are low, so the pool of potential victims has to be very large. The easiest way to contact a large number of people with almost no effort is through email. In some cases, phishing emails attempt to direct you to a clone of a trusted website where you’re likely to enter login credentials, or try to make you download malware.
In a dedicated phishing post, we look at the how to avoid or repair the damage done by common phishing scams, some of which are explained below.

Spear phishing:
Spear phishing is very targeted and the perpetrator typically knows some of your details before they strike. This could be information gleaned from social media, such as recent purchases and personal info, including where you live. A phishing email or message might be crafted based on those details, asking for more information including payment details or passwords.
WhalingThis is geared toward businesses and targets high-level executives within corporations who have access to the email accounts of someone in authority. Once they have access to that email account, they can use it for other means such as accessing employee information or ordering fraudulent wire transfers (see also: CEO fraud).

W-2 phishing:
​This is an even more targeted version of whaling where the main goal is to obtain employees’ W-2s or contractors’ W-9s. Recents cases have involved schools, hospitals, and tribal groups, as well as businesses. The email might be from an actual or spoofed executive account or might appear to be from the IRS or an accounting firm. Once provided, the documents give criminals everything they need for identity theft.

Phishing to deliver ransomware:
As if the phishing itself isn’t bad enough, many emails come bundled with ransomware. This way criminals can get an increased payload for their efforts.

Vishing:
Voice phishing (vishing) scams are not really online scams, but they are often linked and are becoming more sophisticated so are worth mentioning here. They use voice solicitation to get information or money from consumers or businesses. The scammer calls the victim and attempts to use social engineering techniques to trick the victim into doing something, often to give credit card details or send money.
Sending email spam and SMS spam is very easy and costs almost nothing. Calling an intended victim personally, on the other hand, takes more time and effort. For that reason, we are less accustomed to vishing and the stakes are often much higher in order to justify the scammer’s time.
One of the major benefits of vishing versus phishing via email is that criminals don’t have to worry about spam filters. Calls in general are far less abundant than email, so there is a higher chance of getting someone’s attention. While phone calls are more expensive than email, VoIP has made mass calling far more accessible to criminals.
To make matters worse, it is almost trivial to spoof a caller ID number these days. If a scammer wishes to present themselves as an official with your country’s tax bureau, it would be easy for them to show you a legitimate tax bureau number on your caller ID.

Bank:
Bank fraud vishing scams are some of the most common you’ll come across. Scammers will typically pose as a bank representative and tell you there has been suspected fraud or suspicious activity on your account. While some will then try to extract personal or banking information, other scammers have different tactics. One in particular involves persuading targets to install “protective software” on their computer to block any more fraudulent transactions. What the software actually does is allow remote access to the victim’s computer.

Tax:
We’ll cover tax scams in a bit more detail later, but these are often carried out over the phone or through a combination of phone calls and emails. The first contact via phone may be automated meaning scammers can reach a huge number of targets very easily. It also means they only have to actually speak with anyone who calls back. These callers would be considered “qualified leads” and easy targets at that point since they’ve already fallen for the first stage of the scam. See more tax scams.

Prize:
Fake prize or contest winnings are often communicated via a phone call or automated voice message. Promised prizes could be in the form of cash, a car, or an all-expenses-paid vacation. In reality, fraudsters are looking to find out personal details for use in credit card fraud or identity theft.

Tech support:
The tech support scam often starts as a phone call and ultimately ends up online, similar to the bank scam mentioned above. This time, a “technician,” claiming to represent a large firm like Microsoft, will tell you your computer is infected and you need to hand over remote support.
Once you do, the fake tech can do whatever they want with your system, including installing malware or ransomware. Typically, once they are finished “fixing the issue,” you’ll be asked to pay for the service. They then have all of your payment info and in some cases can continue to access your computer through the remote access software whenever they want.
This scam isn’t always initiated over the phone and might start via a web page popup that tells you your computer is infected and to call a support number. The popup is usually difficult to get rid of which serves as motivation to call the number provided.

Government agency:
If you get an official-sounding call from a law enforcement or government agency, you’d be forgiven for being scared into handing over details. Criminals prey on this fear and often pose as police or government officers to phish for personal information. Bear in mind, any such legitimate contact would be dealt with in person or at the very least by mail.

Social media scams:
With the popularity of social media continuing to boom, it’s no surprise that it’s considered a ripe environment for scammers. While many of the other scams on this list could potentially be carried out through social media, a few very specific ones have popped up on social platforms.

“See who’s viewed your profile”:
This scam takes advantage of the curiosity of Facebook users and might pop up as an ad while you’re browsing the site. You’ll be prompted to download an app with the promise of being able to see who has viewed your profile. The thing is, Facebook doesn’t actually give this information out, even to third-party applications. All you’re actually doing is handing over access to your Facebook account, including your personal details and possibly banking information.

Facebook “dislike” button:
During the last few years, the Facebook world is often abuzz with the prospect of a “dislike” button becomingavailable. Scammers capitalize by posting ads for such a feature. These lead to pages which look like they’re run by Facebook but that actually include links to phishing sites asking for personal information.

Fake celebrity news:
This scam involves a clickbait-style headline on Facebook relaying some fake celebrity news, such as the death of a well-known star or a new relationship in Hollywood.

​Once you click, you’re prompted to enter your Facebook credentials to view the article, thus giving criminals full access to your account.

Impersonation scam:
When you think about how easy it is to create a social media account, you realize there’s nothing stopping someone from creating an exact replica of your public profile. They can then reach out to your friends and family with friend or follow requests and once connected, pose as you. These trusted connections can then be used for a whole host of purposes such as spreading malware or requesting money for made-up scenarios.
​
Instagram Likes scam:
With many users across social platforms desperate for ‘likes’ and ‘follows,’ scammers have capitalized by offering just that. One app released in 2013 called InstLike asked for usernames and passwords in return for follow and likes.

​n fact, they simply collected the credentials of 100,000 users and turned them into participants in a large social botnet. Basically, the app did deliver on its promise but used the accounts of those who signed up to do so. What’s more, within the app, people were encouraged to pay fees for additional follows and likes.

Job offer scam:
A job offer scam might be run through email, but is commonly conducted through professional networking site LinkedIn. Basically, you’re offered a job from a seemingly reputable company via direct message. In some cases, these can lead to scams whereby you become the middleman for transferring funds. You deposit cheques, then wire some of the money, keeping the remainder as your fee. Unfortunately, the initial cheque bounces and you are down the amount you sent in the wire transfer.

Travel scams:
Many people purchase airline tickets, hotel rooms, and even entire vacation packages online these days. Scammers know this and there has been a rise in fraudulent travel sites selling fake tickets and non-existent vacations. Travel is usually a big-ticket item, which spells big bucks for criminals. Additionally, travel is a tricky purchase because you typically pay large amounts of money up front for something that you won’t see until the date of travel.
This type of scam can be particularly problematic because you may not find out you’ve been scammed until you arrive at your destination or the airport. There may be no record of you having a booking at all. Now you’re out the original money and also might have to come up with more to continue on your vacation, or simply pack up and go home.

Free or discounted vacation:
These scams may be initiated via phone or email, but typically the target is told that they have won a vacation. In order to claim, they either have to pay a small fee (advanced fee scam) or provide credit card details for a deposit. In the former case, the thief takes off with the money. In the latter, the credit card details can be used in credit card fraud.

Vacation ticket re-sell scam:
In this case, someone posts an ad claiming that they have purchased a ticket for a trip they can no longer go on. They then sell the (fake) tickets for a much lower price than their face value. Some victims don’t realize the scam until they show up at the airport ready for the trip. With insurance company agencies making it so difficult to get refunds on tickets, the fact that someone might be selling tickets online is made more believable, fuelling the success of the scam.

Points scheme:
In a points scam, the target is called or emailed and informed that they have won a huge number of points, through a travel points card program or a travel credit card points scheme. All they have to do is provide some details to confirm the transaction. This may include account information, credit card details, or other personal information.

Vacation rental:
The vacation rental scam involves fraudsters posting ads for property in desirable locations for bargain prices. The victim is required to send a deposit or the full amount up front.
Once they arrive at their destination, they may realize the property doesn’t exist, it has been misrepresented, or it isn’t actually available for rent.

Tax scams:
As if tax season isn’t already dreaded enough without scammers making life more difficult! Criminals look to exploit both taxpayers and the government using a range of tax-related scams.

Fake audit:
In a fake audit scam, targets are contacted by someone claiming to be from the IRS or similar tax agency and told that an audit has identified a discrepancy. Immediate payment is demanded with the threat of additional costs, imprisonment, or even deportation if victims don’t comply. Whether it’s through an email or recorded voicemail, this scam is easy to execute so probably won’t go away any time soon. Oddly, in Canada, it is reported that many of these particular scams involve payment requests via iTunes gift cards. You’d think this would be a bit of a giveaway, but it’s happening.

Fake refund:
This one targets people who are expecting a tax refund. Again, criminals pose as the IRS or similar agency and prompt targets to click a link through which they can claim their refund. However, the link leads to a phishing site where the victim is asked to provide personal information such as their social security number and banking details, which can be used in identity theft.

Erroneous refund:
This scam is a bit more sophisticated as it actually uses real client details stolen from accounting firms via hacking or phishing. The information is used to file a fake tax refund request which is processed by the IRS, and the client receives the refund amount. The scammer then poses as the IRS or a collection agency, tells the client the refund was issued in error, and demands the money be returned. Of course, the payment is directed toward the fraudster, not the IRS. This case spells double trouble for the client. Not only are they short their refund, they could also be in hot water with the IRS for supposedly filing a false claim.

Tax protester scheme:
A tax protester scheme involves criminals calling or emailing consumers to tell them they don’t need to pay taxes. This is really more of a troll than an actual scam, because the person running it doesn’t benefit financially. However, the victim can be negatively impacted as failing to pay taxes can result in a conviction, including fines and imprisonment.

Bitcoin and Cryptocurrency scams:
With bitcoin and other cryptocurrencies exploding in terms of popularity and market cap over the past few years, it’s no surprise that criminals want to get in on the action. Indeed, there are so many methods for scammers to choose from, and scams and hacks involving bitcoin and altcoins seem to be constantly in the news.

Fake coin exchanges:
Since so many cryptocurrency-related businesses are relatively new, it’s difficult to know which ones are legit. Criminals have capitalized on this and simply take people’s money through fake or questionable exchanges. One example of a blatantly fake coin exchange is Internet Coin Exchange which simply lists cryptocurrency price details alongside Buy buttons.

This one still appears to be very much up and running so we won’t be posting the link here.

Other questionable operations include Igot, which later became Bitlio. This exchange appeared to be operated inefficiently as there have been times when it simply can’t pay customers. Again, it’s still in business.

Hacked coin exchanges:
Unfortunately, when exchanges are hacked by cybercriminals, both the exchange and its customers tend to lose out. Mt Gox is probably the most famous case in which people are still waiting to find out if they’ll see their money four years on. But there have been other, more recent, high-profile hacks, including that of Coincheck to the tune of $500 million.

Pump and dump scheme:
‘Pump and dump’ is a familiar term in the stock market, but it’s hitting cryptocurrencies too. This involves the organized promotion of a particular cryptocurrency, usually a relatively unknown coin. The mass investment causes the value to spike, encouraging other investors to get in on the action. The value of the coin increases even further and when the time’s right, the first round of investors cash out, leaving the second wave with a worthless coin.

Fraudulent cloud mining companies:
Mining of bitcoin and other cryptocurrencies typically involves using computational power to support the network in return for a reward. However, mining isn’t the easiest thing to get started with. Enter cloud mining companies, which enable you to invest in mining without having to actually deal with the setup yourself.
When you invest in cloud mining, you’re putting a whole lot of trust in the mining company. Of course, where there are investors, there are scammers ready and waiting. For example, Mining Max raised $250 million for its operation, all but $70 million of which was reportedly pocketed.

​In another case, the CEO of GAW Miners pleaded guilty to $9 million in fraud as an outcome of some very dodgy dealings, including selling more hashing power than was available.

Mining malware:
Mining requires a huge amount of computational power, and that doesn’t come cheap. As such, criminals have developed mining malware that can enable them to exploit users’ computational power. Known as malicious cryptomining or cryptojacking, the malware is usually spread by a trojan virus. Infected computers then form a larger botnet that mines cryptocurrencies. Examples of mining malware include “Digmine,” spread via FacebookMessenger, and WannaMine, which uses EternalBlue, the leaked NSA exploit.

ICO exit scam:
An Initial Coin Offering (ICO) is a little like an Initial Public Offering (IPO) for a company, the major difference being the coin is really worthless until investors perceive value. ICO exit scams are similar to the pump and dump scams we talked about earlier except it’s usually the coin creators doing the heavy promotion followed by a quick sell-off.
Investors are wooed with whitepapers and promises of superior security and broad application potential. They buy coins in exchange for fiat currency, hoping to get a return on their investment. Some of the biggest exit scams we’ve seen so far are Plexcoin, which gathered $15 million in investments before it was suspended, and Benebit, the team behind which ran off with between $2.7 million and $4 million early in 2018.

​ICOs in general are viewed as such a problem that China has banned them and other countries are imposing heavy regulation.

ICO impersonators:
Another issue among ICOs is not with the ICOs themselves, but with scammers impersonating them. For example, the legitimate Seele ICO had their Telegram channel hijacked by people posing as admins. Investors were persuaded to pay for tokens before the sale had actually started and the funds were pocketed by the criminals. Other fraudsters used a phishing scam centered around the Bee Token ICO as a means to dupe investors out of $1 million worth of ether.
​
Cryptocurrency investment schemes:
With the cryptocurrency market being so volatile, it’s not uncommon to hear about massive gains over a short period of time. This makes classic pyramid or Ponzi schemes an easier sell to investors as people are less likely to view them as “too good to be true.” Austrian investment scheme Optioment promised a whopping 4% weekly return to some investors and ended up reportedly stealing more than 12,000 bitcoins.

​The Optioment website. (Source: Wayback Machine)

Other suspicious schemes include BitConnect, which shut down after receiving multiple cease and desist letters, and OneCoin, a reported global Ponzi scheme that is still going strong.

Wallet fork scams:
Coin wallets are used as “safe” places for people to secure their cryptocurrency, basically somewhere to safeguard the private keys that can enable access to coins. When a cryptocurrency forks and a new coin is created, it can be difficult to find a wallet that can accommodate the new coin. Enter scammers. When Bitcoin Gold was first released, the mybtgwallet.com website popped up, promoting users to hand over their private keys and subsequently lose their coins.

This one wallet scam reportedly resulted in total losses worth over $3 million.

Wallet impersonators:
More impersonators are taking advantage of the cryptocurrency market, this time in the form of wallet clones. Criminals make people believe they are depositing their coins into a legitimate wallet but are actually keeping them for themselves. Hacker group, Coinhoarder, used such a scheme to steal more than $50 million worth of bitcoin and other cryptocurrencies. It used domains impersonating the reputable Blockchain.info and even used paid Google ads to attract more victims.

​Coin mixing service phishing scam:
Coin mixing services are used to mix coins in order to break the connection between the sender and receiver, making transactions more anonymous. While coin mixing services can aid illegal activity, they can have legitimate use cases, too. Popular sites include Bit Blender and the now-defunct Helix by Grams.

​These two were involved in a phishing scam on the dark web where a coin mixing tutorial used links to fake websites for both of the services. Users following the steps and visiting the links simply handed over their coin to the thieves.

Coin mixing service Ponzi schemes:
It’s not just phishing schemes that affect users of coin mixing services. Bitpetite ran a mixing operation but also asked for investors to hand over money with the promise of 4% daily returns! This was clearly unattainable and the site disappeared in November 2017 after stealing an unknown amount from investors.

Other online scams:
​Aside from all of the above, there are many more online scams to look out for. Here are some of the most popular plays making the rounds right now.

Fake antivirus software popup:
We mentioned popups in the tech support scam earlier. A common one you might have already seen is a popup prompting you to download antivirus software. However, when you follow the prompt, you could end up with malware instead.

​Fake websites:
Fake websites are usually used in phishing scams. Typically, a replica of a legitimate website is used to encourage targets to enter details such as credentials, banking information, and personal details.

For example, the above image from the Expr3ss blog shows a very convincing fake Facebook login page.

Counterfeit goods sitesThis is a more specific example of a fake website and is a big problem. Replicas of reputable websites may be used to make counterfeit goods seem legitimate. For example, brands like Ugg, Coach, and Michael Kors have had their websites copied almost exactly to make consumers believe they are purchasing genuine goods from the real brand.

Dating and romance scams:
Dating and romance scams are some of the oldest in the book, but as long as people are looking for love, they won’t be going away. In fact, in the US, romance scams account for the largest financial losses of all internet crimes. Fraudsters may contact targets through phone, email, text, social media, or dating sites.
They typically pose as a different person, including creating completely fake profiles (this is called catfishing), and often work in groups. The ultimate goal might be to get victims to pay money, hand over personal information, or even aid in illegal activities.

Ticket scams:
We mentioned travel ticket scams earlier, but would-be concert goers and sporting event attendees are also common targets of ticket scams. They purchase tickets online and show up to the event to find out they’re holding fakes.

Rental scam:
The rental scam preys on those desperately searching for a place to call home. Rental ads are posted with below-average prices, attracting plenty of buyers. Would-be landlords explain that viewings are not available since they are overseas but they will happily issue a refund if you’re not satisfied. First and last month’s rent are typically required to secure the rental property. The fake landlord may also have renters fill out a form which includes banking information along with other personal details.

SMS (Cellphone text) scams:
​SMS scams (smishing scams) are variations on phishing and vishing scams and involve the use of text messages. SMS, or text messaging, is built into just about every phone on the planet. As phones become more internet connected, many of us have transitioned to instant messaging apps like WhatsApp and Facebook Messenger. But good old SMS messaging is almost always available. Scammers know that and can use it to target you.
Smishing texts usually have much the same aims as any other kind of fraud. Scammers may want you to click a link to download malware or adware, or bring you to a convincing looking phishing page in order to trick you into providing your login credentials for a website. Others might provide a number to call as a transition to a vishing scamming method.
While these often follow similar plays to email and voice scams, there are some more specific cases, such as trying to get you to activate a new credit card or telling you an account is expiring.

Amazon phishing scam:
In this rather complex scheme, targets order products on Amazon from third-party sellers. They don’t receive the item so call the seller to inquire. The seller prompts the buyer to complete the transaction outside of Amazon, so gets paid and has access to payment information.
Amazon delivery scamThis is a slightly different angle to the one above, but is also orchestrated by third-party sellers. In this case they ship empty packages to wrong addresses where they are signed for by someone who is in on the scam. Since the package is signed for, the victim often has problems when trying to make a claim with Amazon.

Astroturfing (advertising scam):
​Astroturfing has been around for a long time and its definition can be loosely defined as a company creating fake support around its product in order to attract customers. One famous example was McDonalds paying employeesto stand in line to create buzz around the release of the Quarter Pounder in Japan. With the persuasive power of online reviews, these have become a means for digital astroturfing.
​
Companies simply pay people to write fake glowing reviews on supposedly unbiased review sites. There are even Facebook groups dedicated to swapping online reviews for specific sites like Amazon or specific product types, for example, books.

Consumers rely heavily on these reviews when making purchases and ultimately end up with a subpar product or service or nothing at all.

Continuity scams:
There are a broad range of continuity scams out there but they typically follow similar patterns. Popups for surveys offering free gifts or amazing deals lead victims to enter credit card details to pay for minimal fees or shipping. Often hidden in the small print are exorbitant ongoing monthly fees that can be near impossible to cancel. In this case, you’ll likely have to contact your card issuer to stop future fees, but it’s unlikely you get reimbursed for those already paid. This is another reason to always check your statements as these could easily go unnoticed.

Stock market scam:
This scam is along the same lines as astroturfing and is conducted very much out in the open. It involves articles or other methods and materials which persuade potential investors to contribute funds based on exaggerated predictions. In April 2017, the SEC enforced actions against 27 individuals and entities for such fraudulent promotions of stocks.

Buyer scams:
Most of us have sold something online at some point, but it’s seller beware. Some scammers are using a tactic whereby they fake a pending payment to encourage the release of goods. This might be a bogus PayPal or email transfer message to say that payment will be released once tracking information is received. Once you do actually send the goods, no payment is ever received.

Overpayment:
The overpayment is another one for sellers to watch out for. It usually relates to the sale of items or services, often through classified ads. The scammer sends you payment for whatever you are selling but sends too much. They ask you to refund the difference. In the meantime (hopefully for them, it’s after you send the money) their payment is canceled or retracted. So you’ve received no payment at all but have issued them a partial refund.

How to recognize scams
Since online scams are popping up so frequently, with many probably yet to be uncovered, it’s impossible to list them all here. This just makes it even more important that you watch out for tell-tale signs.

Recognizing secure sites:
Many scams require a legitimate looking website for victims to interact with and provide the information the scammer is looking for. Since virtually anyone can purchase almost any domain name and then visually re-create any site on the planet, how can anyone be sure they’re using a safe site? This is a good question which we cover in detail in a post about recognizing scam or fake websites.

Some techniques are technical, such as checking that the domain name shown in your browser’s address bar matches the site you think you’re visiting. Others are more holistic such as verifying the site has legitimate contact information on it and isn’t riddled with spelling errors.
There is no single silver bullet that can indicate the trustworthiness of a site, but there are a number of things you can check that will help you make a judgement call.
​
Spotting a fake or spoof phishing email:
As Mr. Miyagi said in the movie Karate Kid, “best block, no be there.” In internet scams, the best defense is to simply not get tricked in the first place. Scammers can be clever, though, and it can be hard to spot the fake phishing emails sometimes.

In a dedicated post, we cover tips to help you spot a fake, spoof, or phishing email. For example, it’s not enough to see that the email appears to come from someone you know. You’ll need to actually see the ​Fraud Key by Jak Rustenhovene under CC BY 2.0

Credit:
Published by Jon Watson on June 13, 2018 in VPN at Comparitech
Many thanks to: Sophie Hunt, Comparitech​ for reaching out to us and suggesting this article to CompuBC.

Imagine the scenario: You bought Microsoft Office from a website that looked good. After all, it was plastered with trust seals. You paid with PayPal. You download and installed the software without a problem. The product key they emailed to you worked like a charm.

Eight months later the product key stops working. Not to worry. The site had a one-year warranty on product keys. You contact them and they email you another. That too works. For six months. You go back to the website. But the site no longer exists. You phone PayPal. They can't do anything to help you get your money back. So you phone Microsoft. They confirm what you suspected. The product key is illegal. You have been scammed.

With so many sites now selling fake Microsoft Office what does one do? 

Well, here are 7 tips for telling the genuine from the fake, the legal from the illegal, the authentic from the counterfeit. So you don't get ripped off buying illegal Microsoft software, such as Microsoft Office or Microsoft Outlook or Microsoft Access or Microsoft Windows or... Well, you get the picture. 

When you buy Microsoft software online that is delivered to you by download, you are in fact getting a package. This package should include the following:

1. A Microsoft online account.
2. A Microsoft license.
3. A product key.
4. The software.

If you don't get all four, the likelihood is that what you have bought is not a genuine Microsoft product.
​

1. A Microsoft online account. Your Microsoft account is the combination of an email address and password that you use to sign in to services like Hotmail, OneDrive, Windows Phone, Xbox LIVE, and Outlook.com. 

When you buy genuine Microsoft software online, Microsoft will update your Microsoft online account with that software. For example, if you bought 2 copies of Microsoft Office Home and Student 2016 online, your Microsoft online account will then list 2 x Microsoft Office Home and Student 2016.

There are two points to take away from this:

(i) If it is legal Microsoft software, you will get a Microsoft online account.
(ii) If it is legal Microsoft software, you will find that your Microsoft online account has been updated with details of the software you have bought.

How you can use this

So if you don't get a Microsoft online account, or if your Microsoft online account does not include any information about the software you have purchased online, then the likelihood is that it is illegal.

What we offer
​
We provide you with a Microsoft online account when you buy Microsoft software from us. Microsoft will update it for you with software download links, license information, and (if they are needed for product activation) product keys.

Credit and rights: Tekgia

A few minutes of tweaking and configuration right after unboxing your new router can save you headaches down the road. A Wi-Fi router, left improperly configured and with poor security, can leave your network unstable and vulnerable to malicious users. This guide should help you establish a solid baseline level of security.

Update the Firmware​
​Your router’s firmware is a set of operating instructions and tools stored on its memory chip that controls everything from the Wi-Fi radios to the firewall.
Although firmware updates are generally infrequent, and router firmware is designed to be stable, there are two reasons to check for updates immediately after getting a new router. First, you don’t know how long your router was sitting on the shelf, and a new update may have been (and most likely was) released.
Second, although not as common as problems on consumer operating systems like Windows, there are exploits and vulnerabilities that crop up in router firmware, so it’s always good to have the latest (and most secure) firmware available. It also means you have access to the most up-to-date features of the router.

Change the Wi-Fi Network Name (SSID)
​Your Wi-Fi’s network name, or SSID, can reveal a lot about the router. For example, it might be called “Linksys”, which lets outsiders know the manufacturer of your router—making it easier for them to fetch the default login, or check for vulnerabilities on that model.
Change the SSID to something different from the default, but without any identifying information in it. This means no SSIDs like “Apartment5a” or “321LincolnSt”. Something easy to remember but unspecific to you is ideal—like “Cookie Monster” or “Spaceman”. Any combination of words will do,. really.

Set a Secure Wi-Fi Password with Quality Encryption
For years, router manufacturers shipped routers with poorly configured Wi-Fi and/or default passwords enabled. Now, they’re finally starting to ship routers with the highest level of Wi-Fi encryption enabled and a randomized password set (so even if new users don’t know what they’re doing or fail to look up a list like this one, they’re still protected).
When you go to change your Wi-Fi network’s password, you’ll typically have options available like WEP, WPA, and WPA2. Select WPA2 (or, to future proof this advice, whatever better encryption comes along). We recommend using WPA2, but the short of it is that anything below WPA2 is easier to crack. WEP is so trivial to crack a child with the right (and widely available) tool could do it.
As far as passwords are concerned, when you’re using strong encryption like WPA2 that supports up to 63 characters, it’s far better to use a passphrase than a password. Forget simple passwords like thedog20, blackcat, or any of the trivial passwords that Wi-Fi standards used to restrict us to. Passphrases are easier to remember and are harder to crack. Instead of “thedog20”, use “My Dog Is Twenty Years Old”.
While we’re on the topic of securing your Wi-Fi: if you have a newer router, chances are you have a guest network. If you choose to enable it, the same rules apply for selecting good encryption and a strong password.

Disable Remote Access
​If you need remote access for some reason, it’s a pretty handy feature. For 99.9% of home users, however, there’s very little reason they would need to remotely administer their router from afar, and leaving remote access on simply opens up a point of vulnerability that hackers can take advantage of. Since the router not only functions as the network management brain of your home network but also the firewall, once a malicious user has gained remote control, they can open the firewall and gain complete access to your home network.
Again, like better Wi-Fi security, manufacturers are finally taking default security seriously, so you might be pleasantly surprised to find that the remote access/management features are disabled. Still, trust but verify. Look in the advanced settings of your router and confirm that any remote access tools are turned off.

Disable WPS and UPnP
​Finally—compared to the previous examples of security measures you should take—we have a more arcane one: disabling Wi-Fi Protected Setup (WPS) and (Universal Plug and Play) UPnP. While both services are intended to make our lives easier, they both have various security flaws and exploits. WPS allows you to press a button on your router or use a PIN to pair your new devices to your router (instead of manually searching for the Wi-Fi network name and entering the password) but there are flaws in WPS that aren’t worth the convenience. If your router supports disabling WPS, it should be easily found in your router’s menus.
In addition to disabling WPS, you should also disable UPnP. The UPnP system is, in fairness, way more useful than the WPS system—it automates the process of opening ports in your firewall for applications like Skype and Plex media server—but like WPS it has security flaws that can allow malicious parties access to your router. You should check through settings on your router to disable it and then brush up on how to manually forward ports on your router so, should you run into any issues like your Plex server’s remote access isn’t working right with UPnP turned off, you can fix it right away.

Remember the rule of thumb, never have any liquid around your laptop.

By: Brenden Mulligan
So this crazy thing happened recently with an old Mac I sold on Craigslist a few years ago. I noticed it was still showing up in my Find My iPhone app. Well, at first I didn’t realize it was that particular Mac. I just happened to notice there was a computer I didn’t recognize in Find My iPhone called “Michael’s iMac”.

I clicked in and saw a computer that wasn’t mine showing up on a map about 100 miles north of my house.

I vaguely remembered selling an iMac on Craigslist 3 years ago, and figured that was this one. Then I realized that meant for over 3 years, I had access to this person’s exact location. That’s insane to me.
How the hell did that happen?

Before selling, I erased the computer and re-installed a fresh OS X
I did a hard erase of the computer and reinstalled OS X factory fresh. The mistake I made was that before erasing the computer, I didn’t sign out of iCloud / Find My Mac. I figured erasing the computer would do that. It didn’t.

I sold the computer and the user didn’t log into iCloud
For whatever reason, this person didn’t need to sign into iCloud. So this meant that Apple still associated the computer hardware with my iCloud account. The computer wasn’t logged into my iCloud account, but was still associated with my account, so I still could track the computer’s location in real time.

For me (the seller), this isn’t much of a security risk
The buyer won’t see or have access to any private iCloud data; the hardware is just associated with it. But the seller can’t disassociate it without the buyer’s help (and I didn’t have any way to contact them), so it’s a pain.
No, logging all devices out of iCloud doesn’t work. And no, this has nothing to do with if the computer is in your Support Profile.
The only options I had were Play Sound, Lock, and Erase.

For the buyer, there are massive privacy concerns.
The biggest privacy issue is for the buyer. If they don’t turn on Find My Mac with their own iCloud account, they leave a lot of power in the previous owner’s hands.

The previous owner can track the buyer’s location.
At any time in the past 3 years I could have tracked this computer’s exact location. Not a huge deal with an iMac, but if this was a laptop, I’d basically know where this person was at all times. Terrifying.

The previous owner can erase everything remotely.
With two clicks, at any point, I could shut down this user’s computer and completely wipe it clean. They couldn’t stop it and would have no control. They’d lose everything.

The previous owner can lock the buyer out.
This is what I ended up doing. It was the only way I could get in touch with the owner. So I remotely locked the computer and in the lock message, put my phone number.

The new owner texted and we got it resolved. As mentioned, it wasn’t that they were still logged into my iCloud account, it was that they never signed into their own iCloud account.

Resolving it showed one last nugget of privacy ugh.
When Michael finally logged into his own iCloud account and turned on Find My Mac, the computer was nice enough to tell him my full name.

Not a huge deal, but for people who want to remain anonymous when selling a computer, this sucks.

Overall, this seems like a massive privacy / security flaw. Maybe Apple has patched this in a more recent OS X update. Again, I sold this computer 3 years ago. But just in case, if you sell a computer, turn off Find My Mac BEFORE wiping it. And if you buy a computer, immediately sign into iCloud so there’s no chance the seller can track you.

​Your home Internet router has a lot of security features under its hood that you might not be using. You paid a lot for that box with all those blinking lights on it, which is why you should make sure you’re taking advantage of all the security it has to offer you.
Depending on how old your router is, it may offer you more or less security features. You might need to upgrade its firmware to ensure you have access to all the latest bells and whistles offered by your router manufacturer.
If your router is really old, it might be too old to be “secure” anymore and it may be time for an upgrade.

Let’s take a look at 6 router security features that you should consider turning on right now:

1. WPA2 Encryption
Do you leave your doors and windows open and unlocked at night? If you aren’t using WPA2 encryption (or a more current standard) on your wireless router or access point, then you might as well not even have a door because you’re letting hackers and everyone else into your home via your wireless network.
This means not only do they have a connection to your network and possibly its shared resources, but they are also likely leeching off of the Internet connection that you are paying for. Check out these Tips For Securing Your Wireless Network.

2. Guest Network Access
Do you have visitors that need access to the Internet but you’re not to keen on giving them your wireless password because you don’t want them having access to the rest of your network resources and you don’t want to have to change the password on all your devices when they leave?
Turning on your router’s Guest Network feature might be just what the doctor ordered. If your router has this feature, consider using it to provide temporary Internet access for your visitors. It can be turned on and off at will, which is nice when you have visiting kids who shouldn’t be on the Internet after bedtime.
You can shut it off for them while you still stay connected.

3. Built-in Firewall
Your router may feature a built-in firewall that you might not even know it had. This can be a great tool for allowing or denying traffic originating from the Internet, preventing it from reaching your computer. You can also use it to control what traffic leaves your network as well.
Check out our guide on Why You Need a Firewall and also read Best Practices for Firewall Configuration for information on how to set it up. When you're ready to test it to see if it works, check out How to Test a Firewall.  

4. Enhanced Parental Controls
Many newer routers now offer advanced parental controls such as content filtering DNS. Routers like the Netgear Nighthawk R7000 have integrated with content filtering providers such as OpenDNS to offer malware, phishing, and adult content filtering.

5. Time-Based Access Restrictions
When you go to bed you make sure you lock all your doors to your residence, don’t you? What about your Internet connection? Many people leave it connected all day and all night. What if you could automatically have your Internet connection shut off every night to prevent hackers from connecting to your internal network via the Internet or prevent your kids from late-night browsing activities?
Most routers now offer time-based access restrictions that basically sever your network connection at whatever time you choose so that no Internet-based shenanigans can take place in the wee hours of the morning when everyone in your house should be sleeping.   

6. VPN at the Router
If you haven’t heard of Personal VPN services and how they can help secure your data, check out our article: Why You Need a Personal VPN. Some routers let you set this feature up at the router-level which allows you secure all the devices on your network without the hassle of having to configure each device to use the VPN.
Set it up at the router level and all network traffic going in and out of your network will be protected from prying eyes by encryption.

by Andy O'Donnell for lifewire

It’s a bad idea to fill a Windows system drive completely full, and this could cause a variety of problems. But just how much empty space do you really need?
Why You Need Empty Space.
You need some available space for a variety of reasons. If your drive fills up, you won’t be able to save new files to the drive or download anything, including Windows Updates. Programs often need to create cache files, so they may crash or experience other errors. If you open a large number of programs and need extra memory, the Windows paging file will need to grow—but it won’t be able to grow and programs may crash or not open.

For example, when we filled a Windows 10 PC’s drive completely full and attempted to run its included troubleshooters, we just saw a message saying “A problem is preventing the troubleshooter from starting”. Windows provides no further detail, but freeing up space allowed the troubleshooters to start. These tools can’t function without some free space, and other programs may also break for no apparent reason unless you realize your system drive is full and free up some space.

However, there’s no firm percentage or number of gigabytes of free space you need to maintain. Microsoft does not disclose a specific amount of free space you should keep.
There are a few rules of thumb going around online, but they aren’t necessarily applicable today. Let’s talk about why.
The 15% Rule of Thumb for Mechanical Hard Drives
You’ll commonly see a recommendation that you should leave 15% to 20% of a drive empty. That’s because, traditionally, you needed at least 15% free space on a drive so Windows could defragment it.

If you don’t have 15% free space, Windows won’t be able to properly defragment the drive. Windows will only partially defragment the drive, and it will grow increasingly fragmented over time. However, this just applies to mechanical hard drives that need defragmentation, and not the solid-state drives generally found in more modern PCs.

The 25% Rule of Thumb for SSDs Is Probably Too Conservative

Solid-state drives traditionally needed a large chunk of available free space, too. They slow down over time as they’re filled up. In 2012, Anandtech recommended leaving 25% of a solid state drive empty to avoid a decrease in performance based on their testing.

However, modern solid state drives are “overprovisioned”. This overprovisioning actually means the solid state drive has more memory than it exposes to you. So, even if you fill a solid state drive near full, there’s still a bunch of spare memory on the drive to help maintain performance. That 25% figure is likely too conservative on a modern solid-state drive, although it depends on how overprisioned the drive is. You can afford to use more of the drive and fill it up with more data.

The Answer: It Depends

There’s no specific number or percentage that fits every Windows PC. All Microsoft will tell you is that you need 20 GB of space before you install a 64-bit Windows 10 system on a modern PC. After that, you’re on your own.
The rules of thumb can help. If you have a mechanical hard drive, leaving at least 15% of it empty can reduce fragmentation in newly created files and make it easier for Windows to properly defragment the drive, which is something modern versions of Windows do automatically in the background. If you don’t leave enough empty space, Windows won’t be able to move files around to defragment them and the contents of the drive will become fragmented and slower to access over time. If you have an SSD, this doesn’t apply.

If you have an SSD, leaving at least 25% of the SSD empty will ensure you have excellent performance. On modern SSDs with overprovisioning, this is probably much too conservative, and even 10% could be an okay number. It really depends on the SSD.
​
If you need to temporarily fill your drives up and only have 5% of disk space to spare, that’s not a problem. Things will just slow down over time, so you’ll probably want to free up some space when you can.

The All-Important Rule of Backups.
The most important rule of backups is that any important data should exist in two or more physical locations at once. You cannot create a backup and delete the original. If you do, it’s no longer really a backup. You still have just one copy of your data—you just moved it to a different place.
You might think this is obvious, but you’d be surprised how often we’ve been approached by readers that lost their data after their “backup” drive died.

How to Back Up Your Files.
​There are many ways to back up your data, from backing up to an external drive to uploading copies of your data to a remote server over the Internet. You can use the tools integrated into Windows or download a third-party backup tool. Choose the best backup solution that works for you—we discuss some of our favorites here.

Back Up Your Files, Not Your Full System.
There are two types of backups you can create. Most common backup tools will back up a list of files and folders you specify. This allows you to back up just the files and folders you need. Your backups won’t be any larger than they need to be, and they’ll complete quickly.
However, it’s also possible to create full system image backups of your computer’s hard drive using built-in or third-party tools. These will back up everything, from your Windows system directory and installed program files to your personal data. These backups will be much larger and take much longer to create.
For most people, we recommend you stick with just backing up your files and folders. System image backups sound nice, but there are some big catches. For example, you can’t easily restore a system image on another computer, as a Windows installation will generally only run properly on its original system. You’re better off just starting from a fresh Windows installation and reinstalling your programs.
System image backups have their place, but avoid them unless you’re sure you need them. They’re not the best general purpose backup solution.

The most important thing is to back up your personal files. On a modern Windows PC, you’ll generally find these under C:\Windows\USERNAME, where USERNAME is your user account name.
By default, this directory contains your user account’s data folders. These include the Documents folder where your documents are saved to by default, the Pictures folder that likely contains any family photos you have, the Downloads folder where files are downloaded, the Music folder where your music files are probably stored, and the Videos folder where videos are stored. If you use iTunes for your music, iTunes stores its music library in your music folder by default. It even includes your Desktop folder, where many people store files.
It also includes other important folders, like OneDrive, Dropbox, and Google Drive, where offline copies of your cloud files are stored if you use these services.
There’s also an AppData folder here, but you won’t see it unless you’re showing hidden files and folders. This is where programs store the settings and data specific to your user account. You may be able to use this data to restore an individual program’s settings if you ever need to recover from a backup.

With that in mind, we recommend you back up your entire user account directory, including the hidden AppData folder. This ensures you have all your personal files and settings, and you don’t have to spend much time thinking about it. If multiple people use the same PC and have their own files, back up each user account’s folder.
You may choose to exclude certain folders from the backup if you don’t want them present. For example, if you store a bunch of downloaded videos in the Videos folder and you don’t mind redownloading them in the future, exclude it from the backup. If you have a many gigabytes of virtual machines that take a large amount of space and you wouldn’t mind setting them up from scratch again, exclude the virtual machine folder. But, if those virtual machines are important and it would take you a good amount of time to configure them again, you probably want to back them up.

Any other personal data and settings that aren’t located in your user account folder should be backed up, if you care about it. For example, you may want to back up application settings that are located in the C:\ProgramData folder for some applications.

PC games in particular have files all over the place. Many games synchronize their save files online using Steam Cloud or a similar service, so they won’t need backups. Many store their save games in your Documents or AppData folders, while others dump their save games in C:\ProgramData or another location, like somewhere in your Steam folder. The PCGamingWiki website has a good database of games with information about whether they synchronize their save games or not and exactly where their save files are located on your PC.

Ensure whatever data you care about—whether it’s your family photos, settings for a mission-critical application, or save games for that RPG you’ve been playing for 100 hours—is backed up.

There’s never a reason to back up your Windows directory or Program Files folder. Leave these folders alone.

The Windows directory contains Windows system files, and they aren’t portable between different PC hardware. Windows will set up these files when it’s installed on a new PC, so you don’t need them.

The Program Files folder contains files for your installed applications. You usually can’t just copy these folders over. You’ll have to reinstall most applications from scratch, so there’s generally no point in backing up this folder.

​A handful of programs can be simply moved between PCs. For example, you can back up your Steam or Battle.net directories and copy them over to a new PC, saving the big download of these games. However, even these folders aren’t critical to back up. They can make setting up a new PC faster and save some of download time, but they aren’t full of critical files you can never get back. You can always just reinstall your programs, so they aren’t the priority if you’re limited on space.

Back Up Regularly.
Once you’ve started backing up your files, you should continue creating regular backups. Back up your files daily, if possible. This will be a fast process if you back up regularly, as your backup tool will just back up the few personal files that have changed.
Automating your backups helps ensure those backups get performed regularly. That’s one reason why online backup solutions are so good. They can be configured to automatically back up your PC every day when you aren’t using your computer, so you won’t even have to think about it.

Everyone loses data at some point in their lives. Your computer’s hard drive could fail tomorrow, ransomware could hold your files hostage, or a software bug could delete your important files. If you’re not regularly backing up your computer, you could lose those files forever.
Backups don’t have to be hard or confusing, though. You’ve probably heard about countless different backup methods, but which one is right for you? And what files do you really need to back up?

It’s All About Your Personal Data
Let’s start with the obvious: what do you need back up? Well, first and foremost, you need to back up your personal files.
You can always reinstall your operating system and redownload your programs if your hard drive fails, but your own personal data is irreplaceable.
Any personal documents, photos, home videos, and any other data on your computer should be backed up regularly. Those can never be replaced.
​If you’ve spent hours painstakingly ripping audio CDs or video DVDs, you may want to back those files up, so you don’t have to do all that work over again.
Your operating system, programs, and other settings can also be backed up. You don’t have to back them up, necessarily, but it can make your life easier if your entire hard drive fails. If you’re the type of person that likes to play around with system files, edit the registry, and regularly update your hardware, having a full system backup may save you time when things go wrong.

The Many Ways to Back Up Your Files
There are many ways to back up your data, from using an external drive to backing up those files on a remote server over the Internet. Here are the strengths and weaknesses of each:

• Back Up to an External Drive: If you have an external USB hard drive, you can just back up to that drive using your computer’s built-in backup features. On Windows 10 and 8, use File History. On Windows 7, use Windows Backup. On Macs, use Time Machine. Occasionally connect the drive to the computer and use the backup tool, or leave it plugged in whenever your home and it’ll back up automatically. Pros: Backing up is cheap and fast. Cons: If your house gets robbed or catches on fire, your backup can be lost along with your computer, which is very bad.

While backup programs like BackBlaze and cloud storage services like Dropbox are both online backups, they work in fundamentally different ways. Dropbox is designed to sync your files between PCs, while BackBlaze and similar services are designed to backup large amounts of files. BackBlaze will keep multiple copies of different versions of your files, so you can restore the file exactly as it was from many points in its history. And, while services like Dropbox are free for small amounts of space, BackBlaze’s low price is for as big a backup as you want. Depending on how much data you have, one could be cheaper than the other.
BackBlaze and Carbonite do have one big limitation you should keep in mind. If you delete a file on your computer, it will be deleted from your online backups after 30 days. You can’t go back and recover a deleted file or the previous version of a file after this 30 day period. So be careful when deleting those files if you might want them back!

One Backup Isn’t Enough: Use Multiple Methods
So which should you use? Ideally, you’d use at least two of them. Why? Because you want both offsite and onsite backups.
“Onsite” literally means backups stored at the same physical location as you. So, if you back up to an external hard drive and store that at home with your home PC, that’s an onsite backup.
Offsite backups are stored at a different location. So, if you back up to an online server, like BackBlaze or Dropbox, that’s an offsite backup.
Onsite backups are faster and easier, and should be your first line of defense against data loss. If you lose files, you can quickly restore them from an external drive. But you shouldn’t rely on onsite backups alone. If your home burns down or all the hardware in it is stolen by thieves, you’d lose all your files.
Offsite backups don’t have to be a server on the Internet, either, and you don’t have to pay a monthly subscription for one. You could back up your files to a hard drive and store it at your office, at a friend’s house, or in a bank vault, for example. It’d be a bit more inconvenient, but that’s technically an offsite backup.
Similarly, you could also store your files in Dropbox, Google Drive, or OneDrive and performing regular backups to an external drive. Or you could use BackBlaze to back up online and Windows File History to create a local backup. There are a lot of ways to use these services in tandem, and it’s up to you how to do it. Just make sure you have a solid backup strategy, with onsite and offsite backups, so you have a wide safety net against ever losing your files.

Automate It!
All that may sound complicated, but the more you automate your backup system, the more frequently you’ll be able to back up and the greater the odds you’ll stick with it. That’s why you should use an automated tool instead of copying files to an external drive by hand.
​You can just set it up once, and forget it.
That’s one reason we really like online services like BackBlaze. If it’s backing up to the internet, it can automatically do that every single day. If you have to plug in an external drive, you have to put in more effort, which means you’ll back up less often and you may eventually stop doing it. Keeping everything automatic is well worth the price.
If you don’t want to pay anything and want to primarily rely on local backups, consider using a file-syncing service like Dropbox, Google Drive, or Microsoft OneDrive to synchronize your important files online. That way, if you ever lose your local backup, you’ll at least have an online copy.