The words that show up when it goes wrong.

A

Account takeover (ATO)

When someone else gains control of your account and, usually, locks you out by changing the email, phone and password. The goal is your audience, your payouts, or your name.

Authenticator app

An app (Google Authenticator, Authy, 1Password, etc.) that generates six-digit codes for two-factor login. Much safer than text-message codes because a SIM swap can't intercept it.

B

Backup codes

One-time codes a platform gives you when you set up two-factor. They let you in if you lose your phone. Store them somewhere real, not in your notes app.

Brand-deal phishing

A fake partnership offer whose "contract" or "brief" is malware or a credential-stealing page. The most common way creator accounts are taken.

Business Suite / Business Center

Meta's and TikTok's tools for giving team members specific roles on your accounts without sharing your password. The right way to give an editor access.

C

Clone account

A profile using your name, photos and bio to scam your audience, usually with giveaways or investment offers. Also called an impersonator account.

Credential stuffing

Trying email and password pairs leaked from one breach on other sites. Works because people reuse passwords. Stopped by a password manager and unique passwords.

D

Data broker

A company that collects and sells personal information: addresses, phone numbers, relatives, property, income estimates. People-search sites are the consumer-facing end.

Deepfake

Synthetic video or audio of a real person generated by AI. Used in crypto scams on hijacked channels and in voice-clone fraud against families and companies.

Doxxing

Publishing someone's private information, usually a home address, to invite harassment. Public figures are doxxed from people-search sites in minutes.

H

Hardware security key

A small physical device (YubiKey and similar) that proves it's you at login. Phishing-resistant: a fake login page can't use it. The gold standard for accounts that matter.

I

Infostealer

Malware that quietly copies saved passwords, session cookies and files from a device and sends them to the attacker. Often delivered as a "campaign brief" or "game mod."

L

Lookalike domain

A web address designed to resemble a real one: brand-partnersh1ps.co for brand-partnerships.com. The tell behind most phishing emails. Check the age and spelling.

P

Passkey

A newer, passwordless login tied to your device and unlocked with Face ID, a fingerprint or PIN. Can't be phished or reused. Supported by Google, Apple, Meta, TikTok and most major platforms.

Password manager

An app that creates and stores a unique, long password for every account, so you only remember one. Shared vaults let teams access accounts without knowing the password.

People-search site

Websites like Spokeo, Whitepages and TruePeopleSearch that compile and sell your address, phone, relatives and more. The first stop for a stalker.

Port-out / port freeze

Porting moves your phone number to another carrier or SIM. A port freeze (or number lock) is a carrier setting that blocks it without extra verification. Ask for it by name.

R

Recovery chain

The sequence of email addresses and phone numbers that can reset each other's passwords. Attackers go after the weakest link, usually an old email you forgot about.

S

Session cookie / session hijacking

After you log in, your browser holds a token that keeps you logged in. If malware steals it, the attacker is you, without needing your password or two-factor code. Fixed by signing out all sessions.

Sextortion

Blackmail using intimate images, real or fabricated, often starting with a friendly stranger online. Paying never ends it. Document, report, don't engage.

SIM swap

Convincing or bribing a carrier to move your number to the attacker's SIM, so they receive your calls and text codes. Prevented by a carrier PIN, a port freeze, and not using SMS for two-factor.

Smishing / vishing

Phishing by text message (smishing) or voice call (vishing). The "manager with a new number" asking for a code is smishing. The cloned-voice "CEO" is vishing.

Social engineering

Manipulating people instead of hacking machines. Urgency, authority, familiarity. Nearly every attack on this site starts with it.

Spoofing

Faking the sender of an email, text or call so it appears to come from someone you trust. Why "it came from the brand's address" isn't proof.

Swatting

Making a false emergency call to send armed police to someone's home. Requires the home address, which is why removal from people-search sites matters.

T

Takedown

A formal request to a platform, host or search engine to remove content: an impersonator, leaked material, a deepfake. Platforms respond to specific evidence formats; we file in those.

Two-factor authentication (2FA)

A second step at login beyond the password: a code, an app prompt, or a key. SMS codes are the weakest form. Authenticator apps are better. Hardware keys and passkeys are best.

W

Wire fraud / payment redirection

Tricking someone into sending money to the attacker's account, typically by impersonating a vendor, executive or agent and "updating" banking details. Beaten by a callback rule.