Cyber Security Tips for Brisbane Homes and Small Businesses

The most important cyber security steps for Brisbane homes and small businesses are, in order: use a password manager, turn on multi-factor authentication, keep devices updated, back up with one disconnected copy, learn to spot scams, and secure your Wi-Fi. Each step is explained below, with where to find the settings.

1. Use a password manager.
2. Turn on multi-factor authentication for your important accounts.
3. Keep Windows, Mac, phones and routers updated.
4. Back up your files, with one copy kept disconnected.
5. Learn to spot phishing emails, texts and phone scams.
6. Secure your home or office Wi-Fi and router.

What is the single best cyber security upgrade?

Use a password manager, and turn on multi-factor authentication for the accounts that matter. The manager means every account gets a long, unique password you never have to remember, so one leaked password can't open your other accounts. Multi-factor authentication means a stolen password alone isn't enough to get in.

You don't need to buy anything to start. Apple, Google and Microsoft all build a password manager into their phones, browsers or accounts, and standalone ones work too. Pick one, protect it with a strong passphrase and multi-factor authentication, and move your most important logins into it first: email, banking, Microsoft, Apple or Google, and your accounting software.

How do I set up multi-factor authentication on important accounts?

Start with your email, because email is the key that resets every other account. Then do banking, your Microsoft, Apple or Google account, social media, and any business software that holds customer or financial data.

• Open the account's security settings and look for "two-step verification", "multi-factor authentication" or "passkeys".
• Choose an authenticator app or a passkey where you can. Text message codes are better than nothing but weaker.
• Save the recovery codes somewhere safe, such as inside your password manager or printed and stored securely.
• Check that your recovery email and phone number are yours and current.

If you've been locked out of a Microsoft account while doing this, see our guide on getting back into a locked Microsoft account.

How do I keep Windows, Mac, phones and routers updated?

Updates close the security holes that attackers rely on. Turn on automatic updates wherever you can, and restart when asked.

• Windows 11: Settings, then Windows Update.
• Mac: System Settings, General, then Software Update.
• iPhone and iPad: Settings, General, then Software Update.
• Android: Settings, then System or About phone, then software update. The wording varies by brand.
• Routers: many update themselves, but some need you to log in to the admin page and apply firmware. If your provider manages the modem, ask them.

Also retire anything that no longer receives updates, such as old computers, phones and routers. That's a real risk, even if the device still works.

How should I back up files to protect against ransomware?

Ransomware locks your files and demands payment to release them. A good backup means you can restore instead of negotiating. The key is that at least one copy is not permanently connected to your computer, because ransomware can encrypt anything it can reach.

For most households, that means automatic cloud backup plus an external drive you plug in, back up to, and disconnect. For businesses, add a backup of your email, accounting data and shared files, and test that you can actually restore from it. The Australian Cyber Security Centre publishes backup guidance for individuals and small business.

How do I spot phishing emails, texts and phone scams?

Scammers rely on urgency. Slow down when a message pressures you to act, asks for a login or payment, or claims to be your bank, a delivery company, a government agency or your boss.

• Don't tap links in unexpected messages. Open the app or type the website address yourself.
• Check the sender's actual address, not just the display name.
• Be wary of changed bank details on an invoice. Confirm by phoning a number you already trust.
• Never give remote access to someone who contacted you unexpectedly, and never read out a verification code sent to your phone. Only allow remote access to an IT provider you contacted yourself.

You can report scams and see current warnings at Scamwatch.

What should I do if I've been hacked or scammed?

1. Change the affected password from a different, trusted device.
2. Sign out all other sessions and turn on multi-factor authentication.
3. Phone your bank immediately if money or card details are involved.
4. Report it to ReportCyber at cyber.gov.au or call the ACSC hotline on 1300 292 371, and report scams to Scamwatch.
5. Contact IDCARE on 1800 595 160 (idcare.org) for identity theft support.
6. Call Geeks Brisbane on 1300 600 004 to check the device and accounts.

How do I secure my home or office Wi-Fi?

Change the router's default admin password, use WPA3 or WPA2 with a long Wi-Fi password, and put visitors and smart devices on a guest network. Those settings cover most of the risk for Brisbane homes and small offices.

• Change the router's admin password if it's still the default printed on the label.
• Use WPA3 if your router supports it, otherwise WPA2, with a long Wi-Fi password.
• Put visitors and smart devices such as cameras and TVs on a guest network.
• Turn off WPS and remote administration unless you need them.

Offices with several devices, cameras or shared printers benefit from a properly set up network. Our network and internet security page covers what that involves.

What extra security steps do small businesses need?

Give every staff member their own login, require multi-factor authentication on email, and remove access the day someone leaves. The rest of this list builds on those three habits.

• Give every staff member their own login. Shared passwords mean you can't tell who did what or cleanly remove access.
• Remove access the day someone leaves, including email, cloud storage and software subscriptions.
• Keep admin accounts separate from everyday ones, and limit who has them.
• Require multi-factor authentication on all staff email accounts.
• Check mailbox rules for hidden forwarding, a common sign of a compromised email account.

We cover common mistakes in five cyber security basics small businesses still get wrong, and our small business checklist mapped to the Essential Eight goes further.

When should I get an IT professional involved?

Get an IT professional involved as soon as you suspect an account has been taken over, or when you need staff accounts, multi-factor authentication or backups set up properly for a business.

• You suspect an account has been taken over.
• You clicked a link or entered a password on a suspicious site.
• You see unknown forwarding rules or sign-ins.
• You need staff accounts, multi-factor authentication or backups set up for a business.

When we help with security, we start with how you sign in to your email. We work in this order, because fixing a later layer is wasted effort if the front door is still open:

1. Email sign-in and multi-factor authentication.
2. Account sessions and settings: which devices are signed in, and whether any forwarding rules or recovery details have been changed.
3. Updates and backups, so the machine can be recovered if something goes wrong.
4. The network and the remaining accounts.

Geeks Brisbane provides onsite and remote cyber security help for homes and small businesses across Brisbane, Ipswich, Logan, Moreton Bay and Redlands. Remote help is $125/hour and onsite help is $205/hour, with a one-hour minimum and no call-out fee. Call 1300 600 004. Our cyber security services page explains what we cover, or book online and we'll help you work through this list.

Last reviewed: October 2026. Settings paths and password manager details are rechecked at each major operating system release.