DEV Community: Cyber Breach Space

AI Scams: How to Spot Them and What to Do First

Cyber Breach Space — Sun, 08 Nov 2026 06:59:32 +0000

AI scams are ordinary scams with better disguises: a cloned voice of a relative in a fake emergency, a deepfaked executive or official on a video call, flawless AI-written phishing and romance messages, fake AI trading bots, fake AI tools and fake reviews. The FBI and FTC give the same core defence for all of them: slow down, do not trust the voice or the face, verify through a second channel you chose yourself (hang up and call back on a number you already know), agree a family secret word, never pay with gift cards, crypto or wire transfers on request, and report it.

The short version

Stop and slow down. Almost every scam in this guide depends on urgency. An emergency that cannot wait ten minutes for a phone call is a warning sign in itself.
Do not trust the voice or the face. The FTC's consumer alert of 20 March 2023 tells people not to trust the voice. Instead, call the person who supposedly contacted you, using a phone number you know is theirs.
Hang up and call back on a number you find independently. The FBI's alert of 3 December 2024 gives this advice for organisations as well as people: look up the number yourself, do not use the one the caller gives you.
Ask for the family secret word. The FBI recommends agreeing a secret word or phrase with family members to verify identity (December 2024 and May 2025 alerts).
If you cannot reach the person, try another family member or a friend, as the FTC suggests in its March 2023 alert.

Go deeper

Full guide, with the reasoning, the sources and an FAQ: AI Scams: How to Spot Them and What to Do First
Practise it: AI Scam Spotter Lab is a scored scenario where you make the calls and see what each one costs.
More checklists and labs: the PlayCISO cyber hygiene checklist and all tools.

Originally published on PlayCISO. Drafted with AI assistance.

Smart Home Security: A 10-Step Checklist for Your Home

Cyber Breach Space — Sun, 08 Nov 2026 06:59:17 +0000

Secure a smart home from the router outward: change the router's default login, use WPA3 Personal or WPA2 AES, keep firmware updated and turn off remote management, WPS and (after setup) UPnP, as CISA advises. Then change every device's default password, turn on two-step verification and automatic updates, put internet-only devices on the guest network, check the manufacturer still supports each device, and factory reset anything before you sell it, as the UK NCSC advises. Each step has a trade-off, covered below.

The short version

Change the router's login. CISA says to change the default router username and password. Trade-off: if you forget the new one, you may have to factory reset the router and set it up again, so store it in a password manager.
Check the Wi-Fi encryption. CISA says to confirm the router uses WPA3 Personal or WPA2 AES. If it is open, or uses WEP, WPA or WPA2 TKIP, ask your internet provider for an upgrade or buy a new router. Trade-off: older devices may not support the newest mode, so test before you switch everything.
Use a long Wi-Fi passphrase. CISA suggests 5 to 7 unrelated words totalling at least 16 characters, not reused elsewhere, and a network name with no personal details.
Update the router. CISA says routine updates protect against known vulnerabilities; turn on automatic updates if the router offers them. Trade-off: an update can briefly drop your connection, and CISA's guidance does not say how to time it, so pick a quiet hour if the settings allow.
Turn off the risky extras. CISA says to disable remote management, WPS, and UPnP (after any device that needs it during setup has been added). Trade-off: WPS and UPnP are conveniences that make some devices easier to connect, so you may need to enter a Wi-Fi password by hand.

Go deeper

Full guide, with the reasoning, the sources and an FAQ: Smart Home Security: A 10-Step Checklist for Your Home
Practise it: Smart Home Security Lab is a scored scenario where you make the calls and see what each one costs.
More checklists and labs: the PlayCISO cyber hygiene checklist and all tools.

Originally published on PlayCISO. Drafted with AI assistance.

Crypto Wallet Security: A Checklist With Trade-offs

Cyber Breach Space — Sun, 08 Nov 2026 06:59:01 +0000

Never share your recovery phrase with anyone or type it into a site: Ethereum.org says to never, for any reason, share it, and no legitimate support agent needs it. Keep the phrase offline on paper, use a hardware wallet for amounts you would hate to lose, copy recipient addresses from saved contacts rather than history (address poisoning), avoid unlimited approvals and revoke old ones, and treat unexpected tokens and "support" messages as hostile. Transfers are irreversible, so verify before you send. If a phrase was exposed, move to a new wallet with a new phrase. This is security guidance, not financial advice.

The short version

Find your recovery phrase. It should be on paper, offline. If it is in a screenshot, a cloud note, an email or a messaging app, move it to paper and delete the digital copies.
Decide what is a "spending" amount and what is a "savings" amount. Keep small, frequently used amounts in a convenient wallet and anything you would hate to lose on a hardware wallet bought from the maker or an authorised reseller.
Bookmark the sites and apps you use from the wallet maker's own site, and open them from bookmarks, not from links in messages or ads.
Review token approvals and revoke the ones you do not use. Ethereum.org links a guide on how to revoke smart contract access.
Save the addresses you pay regularly in your wallet's address book so you never need to copy one from history.

Go deeper

Full guide, with the reasoning, the sources and an FAQ: Crypto Wallet Security: A Checklist With Trade-offs
Practise it: Crypto Wallet Security Lab is a scored scenario where you make the calls and see what each one costs.
More checklists and labs: the PlayCISO cyber hygiene checklist and all tools.

Originally published on PlayCISO. Drafted with AI assistance.