Cyber Terms

Account takeover: When someone gains unauthorized access to your online account.

Account PIN: A security code used to verify your identity with your mobile carrier or financial institution.

AI-based impersonation: The use of artificial intelligence to mimic someone’s voice, image, or writing style to commit fraud.

AI deepfake: AI-generated audio, video, or images that realistically imitate a real person.

AI enhancement: The use of artificial intelligence to improve or manipulate images, audio, or data.

Anti-malware / Antivirus software: Programs that detect, block, and remove malicious software from devices.

Apps: Software applications installed on phones, tablets, or computers.

Authenticator app: A mobile app that generates secure login codes for multi-factor authentication.

Automated alerts: Automatic notifications about suspicious or important account activity.

Bitcoin: A type of digital currency (cryptocurrency) used for online transactions.

Biometric lock: A device security feature that uses fingerprint or facial recognition to unlock.

Bot/Botnet: A computer connected to the Internet that has been secretly compromised with malicious code to perform activities under the command and control of a remote administrator.

Browser extension: A small software add-on that adds features to a web browser.

Business Email Compromise (BEC): A scam where criminals impersonate executives or vendors to trick organizations into sending money or sensitive information.

Caller ID: A phone feature that shows who is calling.

Cloud: Online servers that store data and run services over the internet.

Cloud service provider: A company that provides online storage or computing services.

Content Delivery Network (CDN): A CDN is a network of distributed servers that delivers web content to users based on their geographic location to improve speed, performance, and reliability.

Credit freeze: A free service that restricts access to your credit report to prevent new accounts from being opened in your name.

Credit monitoring: A service that alerts you to changes in your credit report.

Critical infrastructure: Essential systems and services such as power, water, transportation, and healthcare.

Cryptocurrency: A type of digital asset/credit/currency that generally only exists electronically and uses encryption to ensure the security of transactions. There is no physical coin or bill unless you use a service that allows you to cash in cryptocurrency for a physical token. You usually exchange cryptocurrency with someone online, with your phone or computer, without using an intermediary like a bank. Bitcoin and Ether are well-known cryptocurrencies, but there are many different cryptocurrency brands, and new ones are continuously being created.

Cryptocurrency Job Scam: A scam offering fake remote jobs that involve moving or converting cryptocurrency. Victims may be asked to use their own accounts to transfer funds, which is often linked to money laundering.

Crypto exchange: An online platform where people buy and sell cryptocurrencies.

Cryptojacking: Unauthorized use of someone’s device to mine cryptocurrency.

Cyber incident response plan: A documented plan outlining how an organization responds to cyberattacks.

Cyber intrusion techniques: Methods attackers use to gain unauthorized access to systems.

Cybercriminal: A person who commits crimes using computers or the internet.

Cybersecurity: The practice of protecting systems, networks, and data from digital attacks.

Data: Digital information such as names, emails, financial details, or files.

Data Breach: The unauthorized movement or disclosure of sensitive and private information to a party, usually outside the organization, that is not authorized to have or see the information.

Data exfiltration: The unauthorized transfer of data from a system.

Deepfake: A deepfake is a digitally altered or artificially created video, audio, or image that makes it appear someone said or did something they did not. Deepfakes are often created using artificial intelligence (AI) and can be used for entertainment, but they can also be used to spread misinformation, commit fraud, or impersonate individuals.

Deepfake Scam: A scam using AI-generated video or audio to impersonate someone (such as a family member, executive, or public official) to request money or sensitive information.

.DEV Apps: .DEV apps are software or websites built for development or testing purposes, often using the “.dev” domain. These apps may not be fully secure, so be cautious before downloading or entering sensitive information.

Digital footprint: The trail of personal information you leave online.

Digital wallet: An app or device used to store cryptocurrency or payment information.

Distributed Denial-of-Service Attack (DDoS): A form of cyberattack that aims to make a service such as a website or network unusable by flooding it with malicious traffic or data from multiple sources.

DDoS mitigation tools: Services that help block or absorb DDoS attack traffic.

DDoS response plan: A strategy for responding to a DDoS attack.

DDoS scrubbing services: Services that filter out malicious traffic during a DDoS attack.

Email: Electronic messages sent over the internet.

Email address: The unique address used to send and receive email.

Email Header: An email header is the part of an email that contains technical information about the message, such as who sent it, who received it, the subject, and the path it took to reach your inbox.

Encryption: The process of encoding data to prevent theft by ensuring the data can only be accessed with a key.

Endpoint Detection and Response (EDR): EDR is a security tool that watches your computers and devices for suspicious activity. It helps find, investigate, and stop threats like viruses or hackers quickly.

eSIM: A digital SIM card built into a device instead of a physical card.

Extortion: Threatening to release information or cause harm unless payment is made.

FBI or Law Enforcement Child Exploitation Scam: A scam where criminals pose as law enforcement and falsely accuse you of illegal online activity, demanding payment to “resolve” the matter. Legitimate law enforcement does not demand payment over the phone or by cryptocurrency.

Firmware: Permanent software programmed into hardware devices.

Hacktivism: Hacking done to promote political or social causes.

Impersonation tactics: Methods used by criminals to pretend to be someone else.

Internet Service Provider (ISP): A company that provides internet access.

Internet of Things (IOT): A catch-all term for the growing number of electronics that are not traditional computing devices but are connected to the internet to send data, receive instructions or both. These devices range from ordinary household objects to sophisticated industrial tools.

iPhone Operating System (iOS): iOS is the mobile operating system developed by Apple that runs on the iPhone.

IP Address: An internet version of a home address for your computer, which is identified when it communicates over a network.

Jury Duty Scam: A scam where someone pretends to be a court official and claims you missed jury duty, demanding immediate payment to avoid arrest.

Malicious software (malware): Harmful software designed to damage or exploit devices and data.

Malvertising: Malvertising is a type of online advertising that contains malicious software. Clicking on or sometimes just viewing these ads can infect your device with viruses, spyware, or other harmful programs.

Malware: An umbrella term that describes all forms of malicious software designed to wreak havoc on a computer. Common forms include viruses, trojans, worms and ransomware.

Malware / Cryptojacking Scam: A scam that tricks you into downloading malicious software. In cryptojacking, your device is secretly used to mine cryptocurrency without your permission.

Money laundering: The process of hiding the origin of illegally obtained money.

Multi-factor Authentication (MFA): Authentication that relies on more than one authentication factor, which makes impersonating someone at the time of login much harder to do. There are only three recognized authentication factors:

• Something you know — like a password, PIN, or the answer to a security question.
• Something you have — like a physical token, a signed certificate or a virtual token attached to your cell phone.
• Something you are — which covers biometrics like fingerprints, retinal scans or even the "unlock with your face" function on smart-phones and computers.

Network: A group of connected devices that share data.

Network intrusion: Unauthorized access to a computer network.

Network segmentation: Dividing a network into smaller parts to improve security.

Online Social Media Scam: A broad category of scams conducted through social media platforms, including fake investments, romance scams, fake sales, or impersonation schemes.

Operating system (OS): The main software that runs a computer or device (Windows, macOS, iOS, Android) and manages its hardware and applications.

OSINT (Open-Source Intelligence): Publicly available information that can be gathered about a person or organization.

Password manager / Password vault: A secure tool that stores and generates strong, unique passwords.

Patched / Unpatched / Patching: Installing updates (patches) to fix security flaws in software.

Phishing/Spear Phishing: A method in which fraudulent email messages are sent under the appearance of a trustworthy person with the goal of obtaining information such as login information, credit card information or company data. Some phishing attempts can also set the groundwork for malware by asking users to click on links or download attachments.

Pig butchering: A long-term online scam where criminals build trust before stealing money, often involving fake investments.

PIN: A short numeric password used for account security.

Port: A communication endpoint used by devices to send and receive data.

Ports and services: Network pathways and programs that allow systems to communicate.

Port-out protection: A mobile carrier feature that prevents unauthorized transfer of your phone number.

Private keys: Secret codes that allow access to cryptocurrency funds.

Push notification: A message sent to your device to alert you of activity.

Ransomware: A form of malware that deliberately prevents you from accessing files on your computer while holding your data hostage. It will typically encrypt files and request that a ransom be paid in order to have them decrypted or recovered.

Ransomware attack: Malware that locks files or systems until a ransom is paid.

RDP (Remote Desktop Protocol): A tool that allows remote access to a computer.

Recovery phrases / Seed phrases: A series of words used to restore a cryptocurrency wallet.

Remote access: The ability to connect to a computer or network from another location.

Romance Scam: Individuals adopt a fake online identity to gain a victim's affection and trust. The scammer then uses the illusion of a romantic or close relationship to trick the victim into sending money.

Router: A device that directs internet traffic within a network.

Security keys: Physical devices used as a strong form of multi-factor authentication.

Seed phrases: See Recovery phrases.

Servers: Computers that store, process, and deliver data to other devices.

Sextortion: A form of blackmail where someone threatens to distribute your private and sensitive material if you do not provide images of a sexual nature, sexual favors or money. The perpetrator may threaten to harm your friends or relatives by using information they have obtained from your electronic device, whether true or not, unless you comply with their demands.

Sextortion Scam: A scam where criminals claim to have compromising photos or videos of you and demand payment to prevent them from being shared. Often, the claims are false and sent in bulk emails.

SIM card: A small card in a mobile phone that connects it to a cellular network.

SIM swapping: Fraud where a criminal transfers your phone number to their SIM card.

SIM Swap Scam: A method in which fraudsters hijack a victim's cell phone number by convincing the telecom provider into activating a victim's phone number onto a new phone that the fraudsters own. The scammer can now gain control over the victim's text messages and phone calls and can reset passwords for social media or financial accounts.

SMS: Text messages sent between mobile phones.

SMS-based MFA: Multi-factor authentication that sends login codes by text message.

Smishing: Phishing scams sent through text messages.

Social Engineering: A broad term where an attacker uses human interaction/social skills to obtain or compromise sensitive and private information about an organization or its computer systems. Scams based on social engineering are built around how people think and act. So, once an attacker understands what motivates a person's actions, they can usually retrieve exactly what they are looking for – financial data and passwords.

Social media: Online platforms where users share content and connect with others.

Social Media Impersonation Scam: When a criminal creates a fake profile pretending to be someone you know (or a public figure) to request money, gift cards, or personal information.

Software: Programs and applications that run on computers and devices.

Spoofing: An attempt by an unauthorized entity to gain access to a system by posing as an authorized user. Several types of spoofing included:

• Email spoofing where the email header is forged so that the message appears to have originated from a trusted source.
• URL spoofing in which a phishing website tries to steal your account password or other confidential information by tricking you into believing you are on a legitimate website.
• Caller ID spoofing is when a caller deliberately falsifies the information transmitted to your caller ID display to disguise their identity.

Tech Giveaway / Giveaway Scam: A fake promotion claiming you’ve won a phone, laptop, cryptocurrency, or other prize. Victims are asked to pay fees or provide personal information to “claim” the prize.

Tech Support Scam: A fraud where someone pretends to be from a well-known technology company and claims your device has a virus or problem, then asks for remote access or payment.

Toll Booth Scam: A text message scam claiming you owe unpaid toll fees and must click a link to avoid penalties. The link typically leads to a fake payment site.

Traditional Denial-of-Service (DoS): An attack that overwhelms a system from a single source.

Transaction IDs / Hashes: Unique identifiers that track cryptocurrency transactions.

URL (Uniform Resource Locator): The web address of a website.

Vishing: Phishing scams conducted over the phone.

Virtual Private Network (VPN): A tool that allows the user to remain anonymous while using the internet by masking the location and encrypting traffic.

Wallet address: A unique string used to send or receive cryptocurrency.

Web Application Firewall (WAF): A security tool that filters and blocks harmful web traffic.