Other Author

Western Technology Services builds security into the technology and services used every day at the university, protecting the campus community and blocking millions of automated attempts to identify vulnerabilities. At home, you don’t have a cybersecurity team working behind the scenes – it’s just you.  Brent Fowles is Western University’s chief information security officer and a recognized leader in cybersecurity. He received the 2026 Toronto ORBIE Enterprise CISO Award and regularly speaks to businesses across Southwestern Ontario about cybersecurity through Western Continuing Studies.  Fowles shared his top tips to stay safer online.   

Western News: There are so many scams out there. What’s the most important habit to protect ourselves online? 

Brent Fowles (BF): Our CyberSmart team uses this phrase: Stop, think, verify. You don’t need to be a cybersecurity expert to protect yourself. A little suspicion can go a long way.  Cybercriminals are getting better at making scams look and sound legitimate. A fake text can look like it came from your bank. An email can appear to be from your boss. A phone call can even sound like someone you know. Even a QR code on a poster could take you somewhere you weren’t expecting.  A lot of scams work by getting you to react emotionally. They create fear, excitement, curiosity or urgency That’s where ‘stop, think, verify’ comes in. Here’s how you can use this approach to your benefit:  STOP. Give yourself a few seconds. Pay attention to how the message is making you feel. If it makes you afraid, angry, excited or like you need to act right now, slow down.  THINK. Does this make sense? Was I expecting this? What are they asking me to provide? Be especially cautious if someone unexpectedly asks for a password, verification code, personal information, gift cards, cryptocurrency or money.  VERIFY. Check out the ask in another way. If you receive a suspicious message from your bank, for example, call the number on the back of your card instead of using the contact information in the message.   

But content online is getting harder to tell apart from inaccurate or disingenuous information. How can we verify if what we’re seeing is real? 

BF: Don’t assume something is true just because it looks convincing or has been widely shared. With artificial intelligence (AI), it’s easier than ever to create misinformation and scams. Start by looking for the original source. Check who published the information, when it was shared, and whether other trusted sources are reporting the same thing.  If you’re unsure about a photo, try a reverse image search using a tool such as Google Lens. This can help you find where else the image appears online and whether it is older than the post, from a different event or being shared without the right context. Remember, a real photo can still be used to spread false or misleading information.  You can also use fact-checking websites. Snopes.com has been investigating rumours, viral posts, news claims, scams, urban legends and misinformation since 1994. Snopes can be a useful first stop, but don’t rely on one source alone. Whenever possible, check a primary source and compare information across several reputable sources.   

We all know our passwords could probably be stronger. Where to start? 

BF: One of the best places to start is using a different, strong password for every important account. If you reuse the same password and one account is compromised, criminals can try it on your other accounts. 

• You can visit haveibeenpwned.com to check whether your email and password has appeared in a known data breach.
• A password manager can also do a lot of the work for you. It can create and securely store strong, unique passwords so you don’t have to remember them all.
• Turn on multi-factor authentication (MFA) wherever you can. It adds another layer of protection, so having your password alone isn’t enough to access your account. And remember: never approve an MFA request you didn’t initiate or give someone your verification code.
• If a service offers a passkey, that’s another good option. Passkeys let you sign in using something tied to your device, such as your fingerprint, face or device PIN, and are much harder to steal through phishing. 

When do we really need to worry about our privacy online? 

BF: Think about what you’re agreeing to when you download an app, create an account or use a new service.  Take a look at your privacy and security settings. What information is being collected? Who can see what you share? What have you given the app permission to access?  For example, does an app really need your contacts, location, microphone and photos to do what you downloaded it for? If a permission doesn’t make sense, consider turning it off.  It’s also worth checking these settings from time to time, especially as apps and services change.   

If you click something suspicious or realize you’ve been scammed, what should you do? 

BF: Act quickly. The sooner you respond, the more you may be able to do to protect your accounts, money and information.  Start by saving screenshots, emails, text messages, receipts and other evidence. If money or financial information is involved, contact your bank immediately. They can help you determine what steps to take, which could include locking cards or accounts, lowering transaction limits or adding other protections.  Change the password on any affected account — and anywhere else you used that same password. Review your security settings and turn on MFA if you haven’t already.  You should also report the incident when appropriate. Contact your local police using their non-emergency line and report fraud and cybercrime to the Canadian Anti-Fraud Centre.  

This still sounds like a lot. Where should people start? 

BF: Start with what matters most.Think about it this way: you wouldn’t put an old pair of tennis shoes in a high-security vault, but you might put a valuable family heirloom there. Your digital life is no different.  Start with the accounts that would cause the most harm if someone got into them. Your primary email is especially important because it can often be used to reset passwords for other accounts. Your banking and accounts containing sensitive personal information should also be priorities.  Protect those first using strong, unique passwords, MFA or passkeys, and then work your way through the rest. Keep your devices updated – these updates patch security vulnerabilities.   Technology is changing quickly, and scams are changing with it. You don’t have to know everything about cybersecurity to protect yourself. Being a little suspicious – and taking the time to stop, think and verify – can make a big difference.  

Learn more about cybersecurity and protecting yourself

Faculty or staff at Western? Register for the upcoming CyberSmart: Staying Safer Online session on Zoom on October 21, from 1-2 PM.