[Florin_Andrei]

> He has even clicked through on a "You have been chosen to win an iPhone 7" link recently - he saw no harm in at least seeing what might happen.

Show him one of those videos with deep-sea fish that use a luminescent lure to eat smaller fish. The pop-up is the lure. The small fish is him. The Internet is like the deep sea, and it's full of lures like that.

One simple criterion I give non-technical people: if it's unsolicited, it's hostile. End of story. No exceptions.

[peterwwillis]

Plus these:

* If it sounds too good to be true, it is.

* If anything related to it says Nigeria, run screaming.

* Nothing is free and you will never win anything.

* Never enter your social security number at any time for anything.

* Surfing the Internet is like walking down a back alley in Hong Kong. They claim to have everything, but you probably aren't going to like it when you get it.

* Illegal software and marginally legitimate sites are breeding grounds for viruses.

* Even if it seems legitimate, make sure it comes from a source you have heard of.

* Always check the URL bar. Just because the website looks like Paypal doesn't mean it is Paypal.

* Get on all of the 2nd factor auth.

* Never download anything.

* Never run anything.

* Learn to close windows without clicking on anything (Alt+F4 or similar)

* If you enter your credit card anywhere, just assume that number is now compromised.

[nitrogen]

Learn to close windows without clicking on anything (Alt+F4 or similar)

One has to be careful with this one; this can get you auto-upgraded to Win10, which not everybody wants.

[reitanqild]

This sysadmin/programmer enjoy Windows 10.

Finally I can have multiple desktops on a stock Windows PC.

[drdaeman]

> says Nigeria

After a recent review of my spam folder (totally biased and subjective) I believe the princes are actively exploring another castles. Saw UAE sheikhs (surely, having the same last name as mine - proves the email's totally legit!) and even Russian billionaires in UK, all asking for my help to unlock transfer of a few bajillion dollars. ;) So, I don't think this recipe works reliably here.

(Guess, normal Nigerians must be really upset by 419 scammers.)

[nickpsecurity]

"if it's unsolicited, it's hostile."

I like that. It's simpler than what I was saying. Should be true vast majority of the time. Only modification I'd make is explaining updates, which ones to trust, and to ignore any of "updates/upgrades" that pop up in the web pages.