Part 1 · The government course
Do the NCSC course first
The National Cyber Security Centre (NCSC, part of GCHQ) made a short course called "Top Tips for Staff". It covers phishing, passwords, two-step login and keeping devices safe. It takes under 30 minutes and ends with its own short quiz.
When you reach the final screen, take a screenshot. You can attach it at the end of this page (optional).
Part 2 · How it applies to CCA
The scams aimed at us
Agencies that move money between brands and creators are a favourite target. Watch for these:
- Fake brand deals. A "brand" sends a contract or brief as a zip file, or a link that asks you to log in to see it. Real brands send normal documents and don't need your password.
- "New bank details". An email (sometimes from a real address that's been hacked) asks us to pay a creator or supplier into a new account. Always confirm by phone on a number you already have, never one in the email.
- Platform scare DMs. "Your Instagram will be deleted for copyright, log in here." Platforms don't do this by DM.
- Urgency from "the boss". A message that seems to come from Edric or Reece asking for something urgent and unusual, like gift cards, a payment or a password. Check with them on a different channel.
Your four habits
- Two-step login on your CCA Google account and on any account you use for CCA work
- A different password for everything, kept in a password manager (Apple Passwords is fine)
- Updates on for your laptop and phone, and a screen lock
- Report anything odd straight away to Edric or Reece, especially if you've already clicked. Speed matters more than embarrassment.
Part 3 · Creator accounts
Never hold a creator's password
- If we need access to a creator's account, use the platform's own tools (collaborator, partner or business access). Never ask for their password.
- If a creator sends you their password anyway, don't use it or save it. Ask them to change it.
- Passwords never go in documents, spreadsheets, chats or the hub's notes.
Quiz · 5 questions · Get 4 right to pass
Check what stuck
Questions are picked at random from a bigger set. If you don't pass, re-read the sections it names and try again: you'll get different questions.
Last step