Most people are not targeted individually. They are caught by broad, automated attempts: a convincing email, a reused password exposed in someone else's breach, or a download from an unofficial site.
That means the defences that work are unglamorous. A unique password per account removes the value of any single breach. A second factor makes a stolen password almost useless. Updates close the holes automated attacks rely on.
The remaining risk is urgency. Nearly every successful scam pressures you to act immediately — a locked account, a missed delivery, an unpaid fee. Slowing down is itself a security control.