You’ve been told to look for the padlock. It’s worth doing, but it promises far less than most people think, and scammers are counting on the confusion.
You have almost certainly been told the rule: “look for the padlock.” Before you type anything sensitive, check for that little lock icon near the web address. It is good advice, as far as it goes. The trouble is that most people think the padlock means far more than it actually does.
The padlock means your connection to the site is private, so nobody in between can read it. It does not mean the site itself, or the people running it, are honest.
Picture the padlock as a sealed envelope instead of a postcard. With a postcard, anyone who handles it along the way can read every word. With a sealed envelope, only the person you addressed it to can open it. That is all the padlock does: it seals the envelope so nobody snooping on the line can read what you send.
Here is the part that matters, though. Sealing the envelope tells you nothing about who is on the other end. It is like having a conversation that nobody nearby can overhear. Wonderful for privacy, but the person you are whispering to could still be a crook. A private line to a scammer is still a line to a scammer.
The s in https is TLS: everything between your browser and the server is encrypted in transit, which defeats eavesdropping and tampering by anyone on the network path (the coffee-shop Wi-Fi, your ISP, a snoop on the wire). The certificate also proves you are really talking to whoever controls that domain, so you are not being silently redirected.
What it does not prove is intent. Certificates are free and automatic now, which is great for the whole web, but it also means a scam site spun up an hour ago has a perfect padlock too. The lock verifies the pipe, not the person pouring things into it.
The padlock means the line is private. It says nothing about who is on the other end of it.
For years people were taught “padlock equals safe,” and scammers know it. Because a certificate costs nothing, virtually every fake login page and lookalike shop now shows the exact same reassuring lock as your real bank. To a visitor doing the padlock check they were told to do, the fake looks every bit as legitimate as the real thing.
So keep the padlock habit, but downgrade what you expect from it. It protects your connection, not your judgment about who you are dealing with. For that second part, the habits in the scams section are what actually keep you safe.
One short email: the scam making the rounds, one tech word made simple, and one tip to keep you and your family safe. Free, no spam, unsubscribe anytime. Plus a free printable "How to Spot a Scam" sheet for your fridge.
We send one email to confirm it's really you. Your address stays with us and our email service, nobody else. Privacy
The cloud isn't in the sky. It's in giant, humming, refrigerated warehouses full of computers, and they're hungry for electricity and water. Here's what a data center is.
New phones are ditching the little SIM card tray. An eSIM is the same thing, built in and programmed over the air, like a hotel updating your key card without a trip to the front desk.
Click every traffic light. Now do it again. CAPTCHAs are bouncers that keep robots out, and if you keep failing them, the problem is probably your connection, not you.
