You may have seen news reports this week about a security problem affecting websites around the world.
The problem involves software called PHP, which helps many websites work. A fault in this software was found that could allow criminals to break into websites and steal information.
The organisations running these websites are responsible for fixing the problem. Anchor’s website was updated to fix it on the evening of Wednesday 21 October 2026.
Having an account with a website does not mean your information has been stolen.
We’re sharing four practical steps below which you can take to help protect your online accounts. These are useful whenever you use the internet.
1. Use a different password for each account
If someone steals a password, they may try using it on other websites. Having a unique password for each website helps stop them getting into several accounts. Start with your email account. This is especially important because your email can be used to reset passwords for other accounts.
Choose a password you do not use anywhere else. Using three unrelated words, such as ‘apple-pillow-reindeer’, can help make it easier to remember. Also including a number, capital letter or symbol, will make it much more secure. Avoid using names, birthdays or your address.
Your mobile phone or web browser can usually save your passwords for you. This means you do not have to remember lots of different ones. This feature is called a “password manager”.
Only save passwords on your own device and avoid saving them on a public or shared computer.
The National Cyber Security Centre, the UK’s national authority on online security, has more advice in its guide to managing your passwords.
You do not need to change all your passwords because of this news. Start with any important accounts where you have used the same password.
2. Add an extra security check
Some accounts let you add another check when you sign in. This is often called “two-step verification” or “two-factor authentication”.
You enter your password as usual and then you will receive a code by text or email, which you enter on the sign-in screen.
This makes it harder for someone else to get into your account, even if they know your password.
Look in your account’s “Settings” or “Security” section to turn on this extra check. If you need help, ask someone you trust to guide you. You can enter the password and codes yourself.
Some websites also offer “passkeys”. Once set up, these let you sign in using your fingerprint, face or device PIN instead of a password.
Passkeys are safer because they cannot be guessed like passwords and will not work on a fake website. You can find out more in the National Cyber Security Centre’s guide to passkeys.
3. Take care with unexpected messages and calls
Criminals sometimes use news about security problems to trick people into sharing their details.
You might receive a message saying your account is unsafe. It may ask you to click a link or enter your password.
If this happens, pause. Open the app you normally use, or visit the website in your usual way instead of clicking any links they have provided. You can check your account there.
If you would rather telephone, use a number from a bill, statement or the company’s official website. Avoid numbers in the unexpected message.
If a caller asks you to act straight away, you can end the call and check with the company yourself.
4. Keep passwords and security codes private
Do not tell someone your password or a security code because they have called, emailed or texted you.
They might say they work for your bank or are helping to protect your account. A convincing story does not prove who they are.
A code can act like a key to your account. Read the message that comes with it before doing anything.
It is normal to enter a code when signing in yourself. It is different if someone contacts you and asks you to read it out.
If you are unsure, stop and check before continuing. You can ask someone you trust for help without sharing your password.
If you think you have been scammed
Stop contact with the person and do not reply to any more messages.
If money or bank details are involved, contact your bank or card provider straight away. Use the telephone number on your bank card or statement.
Change the password on any account you think is affected. Start with your email if you think someone has accessed it. If you used that password elsewhere, change it on those accounts too.
You can report fraud and online crime through Report Fraud or by calling 0300 123 2040. Its website also provides advice and support if you think you have been scammed.
This website uses cookies which track activity so that you get the best possible experience. By continuing to use this website we will assume you are happy and cookies will be set. You can change your cookie settings at any time.
