Even elves don’t click every shiny link.

1. 

   Give the workshop door a second lock.

   Turn on multi-factor authentication (MFA) where available, especially for email and financial accounts. Prefer a passkey or security key when offered. Never share a one-time code or approve a sign-in you didn’t start.

2. 

   One secret per toy chest.

   Use a password manager to make and save long, unique passwords. Reusing a password lets one account’s problem spread to others. Protect the manager with a strong master password and MFA where available.

3. 

   Inspect the tinsel before you click.

   A familiar name or logo doesn’t prove a message is real. Pause before opening unexpected links or attachments. Visit the organization’s site yourself or contact someone using a number you already trust. At work, report suspicious messages through your usual IT channel.

4. 

   Let updates join the nice list.

   Install operating-system, browser and app updates promptly; turn on automatic updates where practical. Get updates through device settings or the official app store—not a surprise “update now” message.

5. 

   Keep a spare copy of the magic.

   Back up important files. Keep a backup separate from your everyday device, such as a disconnected drive or a service with version history. Check that you can restore a file; a synced folder alone may not protect you from deletion or ransomware.

6. 

   Gift cards are gifts, not rescue payments.

   If someone demands gift cards to fix an account, pay a fee or claim a prize, stop. Don’t share the card number or PIN. If you already did, contact the card issuer quickly and report the scam at ReportFraud.ftc.gov.

7. 

   Track the parcel, not the surprise text.

   An unexpected shipping notice asking for a small redelivery fee could be a scam. Open the retailer’s or carrier’s official app or type its known website address yourself. Don’t use the message’s link or phone number.

8. 

   Check the Wi-Fi before the cocoa break.

   Ask the venue for the exact network name. Use HTTPS and don’t bypass certificate warnings; HTTPS protects the connection, not the honesty of a website. Turn off file sharing and auto-join. For sensitive work, use a trusted hotspot or your organization’s approved connection.

9. 

   When in doubt, call another elf.

   Urgency is a reason to pause, not rush. If a message asks for money, passwords or a changed payment destination, verify through a separate trusted channel. Kids: ask a parent or trusted grown-up before downloading or buying anything.

You don’t have to be a tech expert to slow down and double-check.

Next stop: Sleigh Tracker →