Online safety

Before sharing information online, consider who may be able to access it and whether it contains personal or sensitive details. Anything you post contributes to your Digital Footprint and may remain accessible even after deletion.

Your online behaviour can affect your studies, placements and future employment, particularly on professional courses such as nursing, healthcare and social work where professional standards may apply online as well as offline. Developing good online habits now can help protect your reputation and future opportunities.

Social media platforms also collect information about you, including:

• your location.
• profile details
• interactions 
• the content you engage with. 

This data is often used for advertising, analytics and service improvement. Protect your privacy by reviewing your account settings regularly. Be cautious about what you share, limit personal information in public profiles and consider disabling location tracking when it is not needed.

Email communication is not always private, particularly when using institutional accounts.

Your email and network usage at the university may be monitored by Digital IT services, in line with the University’s Acceptable Use Policy. Employers may legally monitor work email accounts. 

This monitoring is usually for security, legal compliance, and system maintenance, not personal surveillance. However it means you should treat institutional emails as a professional communication space.

If you walk away from a university computer without signing out of your account someone else may be able to access your personal information, online accounts, saved passwords, emails or university data.

An unlocked mobile device makes it easy for others to view personal data, to reset passwords and access your accounts.

What to do instead: 

• Never walk away from a library computer without locking it or signing out of your account.
• Set a PIN, password, or biometric lock on your mobile devices and use it every time.

Sharing passwords removes your control over how accounts are used. This makes it impossible to know who is responsible for actions taken in your name.

If one shared password is compromised, your other accounts may be put at risk as well.

What to do instead: Keep passwords to yourself and use different passwords for different accounts.

Thieves target mobile devices such as phones, tablets and laptops. If you haven’t password protected them, a thief could use them to access your accounts or pretend to be you online.

What to do instead: Lock your devices, enable location tracking or remote‑wipe features, and report lost or stolen devices as soon as possible.

Phishing is a scam where criminals try to trick you into sharing personal information, clicking malicious links, downloading harmful software, or sending money. These scams can arrive by email, text message or phone call, and often appear to come from trusted organisations such as your university, bank, delivery companies or even people you know. 

Phishing emails remain the most common way cybercriminals gain access to accounts, and universities are a frequent target.

Visit Phishing Scams for practical advice on: 

• identifying a phishing email
• what to do if you receive one
• reporting scams to the University’s Information Security Team to help protect yourself and others.

Fake login pages look like real websites. They're designed to steal your username and password when you log in.

How to spot this: Check the website address carefully. Fake pages often have unusual URLs, spelling mistakes, or missing security indicators (such as “https”).

Malware links install harmful software on your device when clicked. This can allow attackers to:

• steal information
• monitor your activity
• damage your files.

How to spot this: Be cautious of links or attachments you weren’t expecting, especially if the message urges you to click quickly or download something.

Email scams are only the tip of the iceberg. Social media is very attractive to hackers. It's a quick way to spread malware, viruses, identity fraud or scams. This is partly because people are more likely to trust and click on links they see on social media.

Hackers can combine information about you from different social media sources to guess your identity. They look for your:

• full name
• address
• names of pets
• mother's maiden name and so on.

All of which may be used as passwords or could verify your identity. Social media quizzes asking for personal details may also be used for identity theft.

How to spot this: When we feel rushed or reassured, we're more likely to:

• Click links without checking them.
• Share passwords or personal information. 
• Download harmful files.

Fake QR codes are used to send you to harmful websites, such as:

• fake login pages
• sites that install malware.

Scammers may stick fake QR codes on parking machines or advertising posters. Designed to look legitimate, they can also be sent via email or text messages. 

How to spot this: Always inspect physical QR codes for signs of tampering, such as a physical sticker placed over a printed image. Be cautious of QR codes in unexpected messages. If scanning takes you to a login page or asks for personal details, stop and check the web address carefully.

AI can be used to create scam messages that sound:

• natural
• professional
• personalised.

These messages may closely imitate real emails or texts from trusted organisations or individuals.

How to spot this: Even if a message sounds convincing, check for urgency, unexpected requests, or pressure to act quickly. Always verify requests through official websites or trusted contact details.

Deepfake technology can be used to mimic someone’s voice or appearance, such as a:

• lecturer
• manager
• family member.

These impersonations may be used to persuade you to share information or take urgent action.

How to spot this: Be cautious if a message or video asks for sensitive information or immediate action. If in doubt, confirm the request using a different method, such as a known phone number or official email address.