Security for Non-Coders: What Actually Happens When You Get Hacked

Most security advice tells you what to do. Use strong passwords. Turn on two-factor authentication. Don't click suspicious links. Fine. But it never explains why those things matter, or what actually happens when they fail.

That's a problem. Because when you don't understand the threat, the advice feels arbitrary. You skip it. You half-do it. You think "that wouldn't happen to me" because you can't picture what "that" actually looks like.

This post is different. I'm going to walk you through what actually happens during the most common types of attack. Not in theory. In practice. What the attacker does, step by step, and why it works.

"You don't need to be a security expert. You need to understand enough that the advice makes sense. Then you'll actually follow it."

The kill chain in plain English

Security professionals talk about a "kill chain" when describing an attack. It sounds dramatic, but it's just a sequence of steps. Every hack follows roughly the same pattern:

1. Get in. Find a way into someone's account or device. This is the hardest part for the attacker.
2. Look around. Once in, figure out what's there. Emails, files, contacts, other accounts.
3. Dig deeper. Use what you found to access more things. One account leads to another.
4. Take what's valuable. Data, money, access to other people, or a foothold for later.
5. Stay hidden. If possible, keep access for future use without the victim noticing.

The key insight: step 1 is where you have the most power to stop things. Once an attacker is past step 1, everything else gets much harder to prevent. That's why "get in" is where all the security advice focuses.

Phishing: the attack that works on everyone

Phishing is the single most common way people get hacked. Not because people are stupid. Because phishing is genuinely good at what it does.

Here's what a modern phishing attack actually looks like, step by step.

Why does this work? Because phishing doesn't attack technology. It attacks attention. You're busy. The email looks legitimate. The request seems reasonable. You're on autopilot.

The people who get phished aren't careless. They're just human. Security researchers have shown that even people who know about phishing can be caught by a well-crafted message that arrives at the right moment.

Credential stuffing: when one breach becomes twenty

This is the attack most people don't know about, and it's arguably more dangerous than phishing because it requires zero interaction from you.

This is why password reuse is the single most dangerous habit in digital security. Not because any one password is weak. Because when one site gets breached (and they do, constantly), every account sharing that password is exposed.

You can check whether your email has appeared in known breaches at haveibeenpwned.com. It's run by a security researcher, it's free, and it doesn't require you to enter your password. Just your email address.

What hackers actually do once they're in

This is the part that most security advice skips entirely. What happens after the password is compromised? Understanding this makes the "why" behind every piece of prevention advice click into place.

First minutes: the email takeover

Email is the master key. If an attacker gets into your email, they can reset the password on almost any other account you have. Here's what they do first:

• Set up mail forwarding. A rule that silently forwards all incoming mail to the attacker's address. Even if you change your password later, they keep getting your emails.
• Search for financial accounts. They search your inbox for "bank", "PayPal", "password", "verification code". In seconds they know every service you use.
• Reset passwords. Starting with the highest-value accounts: banking, payment services, crypto, cloud storage. The reset emails arrive in your inbox. The attacker catches them. You might not even see them.

First hours: lateral movement

"Lateral movement" is the security term for using access to one thing to get access to other things. From your email:

• Cloud storage (Google Drive, Dropbox, iCloud): Personal documents, tax returns, photos, identity documents. Some people store scans of their passport or driving licence.
• Social media: Used to impersonate you. Send messages to your contacts. "Hey, I'm in a bind, can you send me some money?" It works because the message comes from your real account.
• Work email or tools: If your personal and work emails are linked, the attacker can now potentially access your employer's systems. This is how many corporate breaches start.

What they take

It depends on the attacker's motivation. Most automated attacks are looking for:

• Money: Direct transfers, fraudulent purchases, crypto theft
• Identity documents: Passport scans, driving licences, utility bills (used for identity fraud, opening accounts in your name)
• Access to sell: Compromised accounts are valuable. A verified PayPal account, a social media account with followers, a corporate email login. These are sold in bulk.
• A foothold for bigger targets: You might not be the goal. Your employer, your contacts, or someone in your address book might be.

The three things that actually stop most attacks

Now that you understand how the attacks work, the standard advice makes more sense. But instead of a long list, here are the three things that block the overwhelming majority of attacks on personal accounts.

Quick wins you can do today

If the full checklist feels like too much, start with these five things. Each one takes under 5 minutes and meaningfully reduces your risk.

1. Check haveibeenpwned.com. Enter your email. If you're in known breaches, change those passwords today.
2. Turn on 2FA for your email. This one action blocks the majority of account takeover attacks.
3. Check email forwarding rules. Takes 30 seconds. If something's there that shouldn't be, you've found a problem.
4. Install a password manager. Bitwarden is free. Add your top 5 accounts.
5. Update your most-reused password. You know the one. The password you've used on 15 different sites. Change it everywhere, using unique generated passwords.

What to do if you think you've been hacked

If you notice suspicious activity or get a breach notification, speed matters. Here's the order of operations:

1. Secure your email first. Change the password. Check and remove any forwarding rules. Review connected apps and revoke anything unfamiliar.
2. Change passwords on financial accounts. Banking, PayPal, any service with payment methods. Use your password manager to generate new ones.
3. Check for unauthorised activity. Recent logins, unfamiliar devices, transactions you don't recognise. Most services show this in security settings.
4. Enable 2FA on everything you haven't already.
5. Contact your bank if you see any unfamiliar transactions. Faster reporting generally means better outcomes for fraud recovery.

The honest truth about security

Perfect security doesn't exist. Every system can be compromised given enough time and resources. The goal isn't to be unhackable. It's to not be the easy target.

Attackers are lazy. They're efficient. They go after the accounts that are easiest to break into. A unique password and two-factor authentication make you significantly harder to compromise than someone without them. Most automated attacks will simply skip you and move on.

You don't need to understand cryptography. You don't need to run your own VPN. You need a password manager, 2FA on your email, and enough understanding of how attacks work to recognise when something isn't right.

That's the whole thing. The rest is details.