Advice & Guidance
CRIME TYPE: SARS-07
Cybercrime & Passwords
Cybercrime poses a significant threat in the UK, and weak or compromised passwords are a major gateway. The National Cyber Security Centre (NCSC) stresses strong, unique passwords and two-step verification as crucial protection for online accounts.
01
How passwords are stolen
- Phishing — deceptive emails/messages tricking you into revealing credentials.
- Malware — keyloggers record keystrokes.
- Brute-force attacks — guessing weak passwords.
- Credential stuffing — reusing breached username/password pairs.
- Data breaches, man-in-the-middle attacks, and dark-web credential lists.
02
How stolen passwords are used
- Access sensitive accounts (email, banking, social media).
- Commit financial fraud and identity theft.
- Spread malware and launch further attacks.
- Account takeover, ransomware, and service disruption.
03
Password security best practice
- Use 12–16+ characters mixing case, numbers and symbols; avoid personal info and common patterns.
- Use a different strong password for every account.
- Use a password manager to generate and store them.
- Enable multi-factor authentication (MFA) wherever available.
- Never share passwords; beware phishing; don’t write them down insecurely.
- Check "Have I Been Pwned?" for breaches; change compromised passwords immediately.
- Avoid entering passwords on public Wi-Fi; use a VPN.
- Keep devices and antivirus updated.
Report & Support
Want advice or guidance in person? Book an appointment at hello@sarscymru.org.uk.
Next guidance