Online Safety Myths: 10 Things People Believe That Aren’t True

A lot of online safety advice gets passed around by word of mouth, and some of it was never true or stopped being true years ago. Believing a myth can leave a gap in your defenses, or make you worry about the wrong thing. Here are ten common ones, what’s actually true, and what to do instead.

This article was checked against guidance from the Federal Trade Commission (FTC), the Cybersecurity and Infrastructure Security Agency (CISA) and browser makers’ own help pages on November 7, 2026.

Myth 1: “Incognito or private mode makes me anonymous”

The truth: Private browsing mainly keeps your history, cookies and form entries off the device you’re using once you close the window. Google’s own Chrome help page says Incognito doesn’t hide your activity or location from the websites you visit, your school or employer, or your internet provider. If you sign in to a site, it knows it’s you.

What to do instead: Use private mode for what it’s good at, like shopping for a gift on a shared computer or signing in on a friend’s laptop. For real privacy, review your account privacy settings and limit what apps can track.

Myth 2: “The padlock means the website is safe”

The truth: The padlock (HTTPS) means the connection between you and the site is encrypted, so others on the network can’t read it. It says nothing about who runs the site. Most scam and phishing sites have a padlock too, because certificates are free and automatic.

What to do instead: Check the web address itself, and get to important sites by typing the address or using the official app rather than following a link in a message. See how to find the real government or bill-pay site.

Myth 3: “I have nothing worth stealing”

The truth: Scammers aren’t only after big bank balances. Your email account can reset all your other passwords, your social media account can be used to scam your friends, your phone number can be hijacked to receive codes, and your name and Social Security number can be used to open credit in your name. Most attacks are automated and aimed at everyone, not chosen individuals.

What to do instead: Protect your email first with a strong unique password and two-step verification. Our account takeover guide covers the basics.

Myth 4: “Macs, iPhones and Chromebooks can’t get viruses”

The truth: These systems have strong built-in protections, but no device is immune. And most modern attacks don’t need a virus at all. Phishing pages, fake tech support calls and scam apps work on any device because they trick the person rather than the computer.

What to do instead: Keep every device updated, install apps only from official stores, and treat surprise pop-ups and “your device is infected” warnings as scams. See how to spot a fake tech-support pop-up.

Myth 5: “A long, complicated password is all I need”

The truth: A strong password helps, but if a company you use is breached, your password can leak no matter how strong it is. If you’ve used it anywhere else, criminals will try it there too.

What to do instead: Use a different password for every account (a password manager makes this easy) and turn on two-step verification or passkeys for important accounts.

Myth 6: “Changing my password every month keeps me safe”

The truth: Forced, frequent changes tend to make people choose weaker, predictable passwords (Spring2026!, Summer2026!). U.S. government password guidance from the National Institute of Standards and Technology (NIST) has moved away from routine expiration toward long, unique passwords that you change when there’s a reason to.

What to do instead: Change a password when a service tells you it was breached, when you reused it, or when you think someone else knows it.

Myth 7: “Public Wi-Fi is always dangerous”

The truth: Public Wi-Fi is much less risky than it used to be, because most websites and apps now encrypt their traffic. The bigger risks are fake networks with real-sounding names and fake sign-in pages that ask for personal details.

What to do instead: Confirm the network name with staff, never install anything to “get online,” and use your phone’s hotspot for sensitive tasks if you prefer. Our public Wi-Fi guide goes into detail.

Myth 8: “My phone is secretly listening to my conversations for ads”

The truth: Researchers who tested thousands of apps found no evidence of apps secretly turning on the microphone to target ads. The eerily accurate ads usually come from other tracking: your location, searches, purchases and the people you spend time with.

What to do instead: Read our article Is My Phone Listening to Me? for how ad targeting really works and the settings that reduce it.

Myth 9: “My bank will call and ask me to confirm my code or move my money”

The truth: Banks may call or text about suspicious activity, but they won’t ask you to read out a one-time code, give your full password or PIN, or move money to a “safe account.” Those requests are hallmarks of bank imposter scams.

What to do instead: Hang up and call the number on the back of your card. See Imposter Scams.

Myth 10: “If I already got scammed, there’s nothing I can do”

The truth: Acting fast often helps. Banks and card companies can sometimes stop or reverse payments, and a credit freeze stops thieves opening new accounts. Reporting also helps protect others.

What to do instead: Start with Get Help Now and report at ReportFraud.ftc.gov.

The short version

• Update your devices and apps.
• Use unique passwords, a password manager and two-step verification or passkeys.
• Never sign in or pay from a link in an unexpected message.
• Slow down when anything feels urgent, and check with someone you trust.

These four habits are close to what CISA’s Secure Our World campaign recommends for every household. See our Four Simple Steps to Protect Your Family Online.

FAQ

Do I still need antivirus software?

Windows and Mac computers include built-in protection that is enough for most households when kept up to date. Extra security software is optional; the most important thing is installing updates and avoiding scam downloads.

Is a VPN necessary?

For most people at home, no. A VPN can add privacy on networks you don’t trust, but it doesn’t stop phishing, scam calls or bad downloads. If you use one, choose a reputable paid or well-reviewed service.

Which myth is the most dangerous?

Probably “I have nothing worth stealing,” because it leads people to skip two-step verification on email, the account that unlocks everything else.

Related reading

• Phishing, Malware, and Ransomware: What’s the Difference?
• How to Read Security News and Alerts Without Panicking
• How to Secure Your Home Wi-Fi Router
• The Privacy Toolkit

Sources

• Google Chrome Help, “How Chrome Incognito keeps your browsing private,” support.google.com, accessed November 7, 2026.
• Federal Trade Commission, “Use Two-Factor Authentication To Protect Your Accounts,” consumer.ftc.gov, accessed November 7, 2026.
• Federal Trade Commission, “How To Avoid a Scam,” consumer.ftc.gov, accessed November 7, 2026.
• National Institute of Standards and Technology, “Digital Identity Guidelines: Authentication and Lifecycle Management” (SP 800-63B), nist.gov, accessed November 7, 2026.
• Cybersecurity and Infrastructure Security Agency, Secure Our World, cisa.gov, accessed November 7, 2026.
• Pan, Ren, Lindorfer, Wilson and Choffnes, “Panoptispy: Characterizing Audio and Video Exfiltration from Android Applications,” Proceedings on Privacy Enhancing Technologies, 2018, petsymposium.org.

This is general information, not legal or technical advice.