NZAI Security
Student checking privacy settings, app permissions, and messages on a device in a learning environment
Cyber Basics

Digital Safety Basics for Students in New Zealand

Guide Students Updated 1 Jun 2026

A practical student-friendly guide to safer passwords, suspicious messages, privacy settings, app permissions, and knowing when to ask for help.

Written and reviewed by Feroze Ashraff Last reviewed Editorial standards

Quick answer

Protect your accounts with strong passwords and MFA, slow down around suspicious messages, check what apps are allowed to access, and ask for help early when something feels off. Digital safety for students is mostly about everyday habits that stop small mistakes from turning into bigger problems.

This guide covers the things that matter most for students in New Zealand: protecting your accounts, spotting suspicious messages, understanding what you are agreeing to when you use an app or website, and knowing who to go to when something goes wrong.

Why account security matters to students

Your online accounts contain information about you — your name, your school, your email, and often your communications. If someone gets access to your account, they can:

  • read your messages or emails
  • post things in your name
  • access personal information stored in the account
  • use the account to trick people you know into clicking something

This is not just about losing your Instagram followers. It is about your information being used in ways you did not choose. Account security is your first line of defence.

Creating passwords that actually protect you

A weak password is one of the most common ways accounts get broken into. Here is what to avoid:

  • your name, birthday, or pet’s name — these are easy to guess from a quick search
  • the word “password” or “123456” — these are the first things hackers try
  • the same password on multiple accounts — if one service gets hacked, all your accounts are at risk

A stronger approach: use a passphrase. Think of a sentence you can remember, then use the first letters or a mix of words. For example, “My dog Pip loves running in the park” becomes a passphrase like “MdpLr1tP” or similar — long, unique, memorable (1). For more detail, Passwords, passphrases, and MFA: a simple guide has a full explanation of how this works in practice.

Never share your password with friends. Friendship is not a reason to share login details — if a friend unexpectedly asks for your password, it is okay to say no and ask a parent or teacher about it.

Multi-factor authentication — what it is and why it matters

MFA means that to log into your account, you need something more than just your password — usually a code sent to your phone or generated by an app.

This is important because even if someone finds out your password, they still cannot get into your account without also having your phone or authenticator app. Turn MFA on for any account that offers it, especially your school email, any account connected to your real name, and any account that has payment or personal information in it (1).

Spotting suspicious messages

If you receive a message — email, text, or a direct message on a platform — that asks you to:

  • click a link and log in
  • give your password or a code
  • download an attachment you were not expecting
  • buy something or transfer money for someone you have not met in person

Treat it as suspicious until you have checked it is real. Even if the message looks like it comes from a friend, a popular game, or a brand you know, it could be a fake (2).

Signs it might be fake:

  • the sender address looks unusual or has extra numbers and letters
  • the message creates urgency — “act now”, “your account will be closed”
  • it asks for something a real company or friend would not ask for by message
  • the link destination does not look right when you hover over it

For a full guide, see How to Spot Phishing Emails, Scams, and Fake Messages.

A student signing into an account with a strong password on a laptop — digital safety basics for NZ students.

What to do if something feels wrong online

Trust that instinct. If something feels off — a message, a website asking for too much information, a person online who is asking questions that make you uncomfortable — you do not have to push through it.

Here is what to do:

  1. Do not click or respond if you are not sure.
  2. Tell a parent, teacher, or another adult you trust. You do not have to handle it alone.
  3. If it is something serious — like someone asking for personal information, a friend who has been hacked, or something that has made you feel unsafe — you can also contact Netsafe at netsafe.org.nz for free, confidential support in New Zealand (3).

Understanding privacy settings and app permissions

When you download a new app or sign into a website with your Google or Apple account, it often asks for permissions — access to your camera, microphone, contacts, location, or photos.

Ask yourself:

  • Does a simple game really need access to my contacts?
  • Does a homework tool need to know my location?
  • Does a new platform need access to my camera and photos?

It is okay to say no, or to say “only while I am using the app.” You can also go into your device settings later and adjust permissions for any app (4).

Your school email account should only be used for school-related tools and platforms — not for signing into random apps or websites you find through a search.

Being careful about what you share

Anything you post online can be copied, saved, or shared by someone else — even if you delete it. Before posting or sharing:

  • Would I be comfortable if my parents, teachers, or future university or employer saw this?
  • Does this reveal where I live, my school, or other personal details?
  • Am I sharing something about someone else that they have not agreed to?

If the answer to any of these is unclear, pause before posting.

Knowledge check

Q1 You get a text message from an unknown number saying your online banking has been locked and you need to tap a link to unlock it. You do not have an account with that bank. What should you do? tap to flip
Answer: Do not tap the link. This is a smishing (SMS phishing) pattern — fake messages sent to get you to click a malicious link or enter personal information. If you receive an unexpected message about an account you do not have, treat it as suspicious regardless of how official it looks. If you are genuinely concerned about a real account, go directly to the bank's official website by typing it into your browser — do not use the link in the message (2).
Q2 A friend has started sharing their password for a streaming account with several classmates so everyone can use it for free. Why might this be a problem? tap to flip
Answer: Sharing passwords means you lose control of your account security — you do not know what the other people will do with it, whether they will change settings, or whether they will use it for something that gets the account flagged or suspended. It also often violates the terms of service of the platform. A better option is to use a family or shared account plan that the service actually offers, or to use a free tier within the service's rules. If cost is a genuine barrier, talk to a parent or teacher about legitimate options (1).
Q3 An app you want to use for a school project asks for access to your contacts, camera, and location. Should you grant all these permissions? tap to flip
Answer: Not automatically. Ask yourself whether each permission is genuinely needed for the app to function — a note-taking app does not need your location, a drawing app does not need your contacts. You can go to your device settings and grant only the permissions that make sense for what you are using the app for. You can also say "Only while using the app" for things like camera and location, so the permission does not persist when you are not using the app. If an app will not work without permissions that seem excessive, consider whether there is a better alternative (4).

Sources and references

[1] National Cyber Security Centre UK. (2023). Password managers. https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online/password-managers

[2] New Zealand Police. (2024). Internet scams, spam and fraud. https://www.police.govt.nz/advice/email-and-internet-safety/internet-scams-spam-and-fraud

[3] Netsafe New Zealand. (2025). Staying safe online. https://netsafe.org.nz/

[4] New Zealand. Office of the Privacy Commissioner. (2025). Your rights. https://www.privacy.org.nz/your-rights/

What to do next