Blog

<p>A fake parking fine text lands on your phone, says you owe money and gives you a short deadline to pay. Here is how the scam works and how I spot it in seconds.</p><p>The message looks official and it is built to rush you. It says a parking fine is unpaid, warns of extra charges, and sends you to a link. If you have not parked anywhere, that is your first clue. Even if you have, the text is still not what it seems. Councils and the DVLA do not chase fines by text. This one has been doing the rounds across the UK, so it is worth knowing what it looks like.</p><h2>How the fake parking fine text works</h2><p>The text usually comes from a spoofed mobile number, so it can look like it is from a normal person. It says your record shows an unpaid parking fine, and that you must pay quickly or face extra fees. Some versions even threaten damage to your credit file. The pressure is the whole point, because a rushed person does not stop to check.</p><p>The link takes you to a very convincing copy of a government website. It asks for your vehicle registration, and here is the trick: Which? found that it accepts random characters and still produces a fine. It then shows a made-up penalty charge notice number and a small fine, often around £25, because a small amount feels easy to just pay and forget.</p><p>To get that far, the site asks for your name, email, phone number and home address, then your card details. The site can use your location so the fine looks local. It also links to real GOV.UK pages to look genuine. Once you pay, the scammers have your card and your personal details, and they can use both again.</p><figure id="figure-215x0szwijmv0meg34"><img id="215x0szwijmv0meg34" src="https://cdn.durable.co/covers/36rLVysG8ROh8p3XhIeqS3YcA2I07Io0J602dx62R3tbm9tizyMoFciRlmGsh92O.jpg" alt="" title="" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionX="undefined" data-positionY="undefined" data-fullWidth="false"/></figure><h2>The signs it is a scam</h2><p>You do not need to be technical to spot this one. Run through these quick checks before you tap anything:</p><ul><li>It arrived by text. Councils do not send parking fines by text.</li><li>It uses pressure, such as a short deadline or threats of extra charges.</li><li>The web address does not end in gov.uk. That is often the only visible clue.</li><li>It accepts any registration number you type in, even nonsense.</li><li>It asks for far more personal detail than paying a small fine should need.</li></ul><p>If it fails even one of those, stop. My <a href="https://kellssecurity.com/blog/is-this-text-a-scam" data-mce-href="https://kellssecurity.com/blog/is-this-text-a-scam">30-second test for any suspicious text</a> works on this one too, and it takes less time than reading the message twice.</p><h2>How real parking fines actually arrive</h2><p>A genuine penalty charge notice is attached to your vehicle, handed to you, or posted to the registered keeper. It is not a surprise text with a link. City of York Council, for example, says plainly that it never sends fines by text. Other councils say the same.</p><p>The official <a href="https://www.gov.uk/parking-tickets" target="_blank" rel="noopener" data-mce-href="https://www.gov.uk/parking-tickets">GOV.UK guide to parking fines and penalty charge notices</a> explains that you usually have 28 days to pay, and that you can challenge a ticket you think is unfair. So there is no need to panic, and no need to pay anything through a link in a text. If you are unsure whether you really have a fine, type the council or DVLA address in yourself, or ring the number printed on a genuine letter.</p><h2>What to do if you tapped the link</h2><p>First, do not beat yourself up. These sites are built to fool sensible people. What you do next depends on how far you went.</p><p>If you only opened the page and typed nothing, close it, delete the text and run a scan on your phone. If you typed your registration or other details, change the passwords on any account that shares them. A password manager makes that far quicker, and I use and recommend <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener sponsored" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass</a>. If you entered your card details, ring your bank straight away on the number on the back of your card and tell them what happened. Do not use any number from the text.</p><p>Then watch for follow-up scams. Once your details are out there, calls and texts that use them tend to follow. If anyone rings claiming to be your bank, hang up and call back on a number you trust.</p><h2>Report it and protect your family</h2><p>Reporting takes a minute and helps stop it reaching others. Forward the text to 7726, which is free and goes to your mobile network. You can report the fake website to the <a href="https://www.ncsc.gov.uk/collection/phishing-scams" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/collection/phishing-scams">National Cyber Security Centre</a>, and report the scam itself to <a href="https://www.reportfraud.police.uk/" target="_blank" rel="noopener" data-mce-href="https://www.reportfraud.police.uk/">Report Fraud</a>, or call 101 if you are in Scotland. My guide on <a href="https://kellssecurity.com/blog/where-to-report-a-scam" data-mce-href="https://kellssecurity.com/blog/where-to-report-a-scam">where I actually report a scam</a> walks through each option.</p><p>Then tell someone. Older parents and grandparents are often targeted with these because they tend to take official-looking messages seriously. Have a quick chat about it, and read my guide to <a href="https://kellssecurity.com/blog/helping-an-older-parent-stay-safe-online" data-mce-href="https://kellssecurity.com/blog/helping-an-older-parent-stay-safe-online">helping an older parent stay safe online</a> if you want an easy way to start.</p><p>For more everyday help, my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">Safety Toolkit</a> lists the tools I trust, and you can <a href="https://tinyurl.com/kells-checklist" data-mce-href="https://tinyurl.com/kells-checklist">sign up for my free online safety checklist</a> to keep the key checks to hand. My book <a href="https://www.amazon.co.uk/dp/B0HJJSMVKB" target="_blank" rel="noopener" data-mce-href="https://www.amazon.co.uk/dp/B0HJJSMVKB">Spot the Scam</a> explains the ten cons most likely to catch you out, in plain English. You can also find me back at <a href="https://kellssecurity.com/" data-mce-href="https://kellssecurity.com/">Kells Security Solutions</a>, read more <a href="https://kellssecurity.com/about" data-mce-href="https://kellssecurity.com/about">about me and why I do this</a>, or <a href="https://kellssecurity.com/contact" data-mce-href="https://kellssecurity.com/contact">get in touch</a> if you have had a message you are not sure about, and I will take a look.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

Fake Parking Fine Texts: How to Spot the Scam

<p>Your phone buzzes. It says a parcel could not be delivered, or your bank has spotted something odd, or you owe the DVLA a few quid. There is a link, and a reason to hurry. Your thumb is already hovering over it. Before you tap, stop. Most texts like this are scams, and a few seconds of checking is all it takes to know for sure.</p><p>I run <a href="https://kellssecurity.com/" data-mce-href="https://kellssecurity.com/">Kells Security Solutions</a> to explain scams in plain English, and "is this text a scam?" is the question I get asked more than any other. This page gives you a quick test you can use on any message, then the most common fake texts in the UK, and what to do if you have already clicked.</p><h2>The 30-Second Test for Any Suspicious Text</h2><p>Ask yourself four questions. If any answer worries you, treat the message as fake.</p><p>First, were you expecting it? A "missed delivery" when you have ordered nothing, or a refund from a company you have never dealt with, is a red flag straight away. Second, does it rush you? Scammers always add a deadline, such as "within 24 hours" or "your account will be closed", because panic stops you thinking. Third, does it ask you to tap a link or ring a number you have not heard of? Fourth, does it ask for money, a card number, a password or a code, however small the amount?</p><p>A real company can prove who it is without hurrying you. If you are not sure, do not use anything in the message. Open the official app yourself, type the website address in by hand, or ring the number on the back of your bank card.</p><h2>The Fake Texts I See Most Often in the UK</h2><figure id="figure-ksstx1oct"><img id="ksstx1oct" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="" src="https://cdn.durable.co/blocks/20iIqusNslSdQqymCCSZCqwBwJcew8Uddz7b1Xyjk62J27L1tPFVciaeEyZM2hdd.jpg" alt="Man receiving a parcel at the door, the kind of delivery that fake parcel delivery text scams copy in the UK" data-corners="default" data-aspect="16/9" data-caption="" data-positionx="50" data-positiony="50" data-fullwidth="false" data-mce-src="https://cdn.durable.co/blocks/20iIqusNslSdQqymCCSZCqwBwJcew8Uddz7b1Xyjk62J27L1tPFVciaeEyZM2hdd.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><p>Parcel delivery texts are the big one. They claim to be from Royal Mail, Evri, DPD or DHL and say a package is waiting, with a small fee to pay for redelivery. The fee is tiny on purpose, because the real aim is your card details. If you are expecting a parcel, go to the courier's own website or app and use your tracking number there.</p><p>Bank texts come next. They say there has been a suspicious payment or your account is locked, and give you a link to "verify" yourself. Your bank will not ask you to confirm your PIN, full password or a one-time code by text link. Some scammers even send these into the same message thread as genuine texts from your bank, so a familiar-looking thread is no proof.</p><p>Then there are the government ones. A text from the DVLA about vehicle tax, a tax refund from HMRC, or a council tax rebate all follow the same pattern: a payment owed or due to you, and a link that leads to a copycat website. Genuine refunds do not arrive by tapping a link in a text.</p><p>The "Hi Mum" or "Hi Dad" text deserves a mention too. A message from an unknown number says your son or daughter has lost their phone and needs money sent urgently. Ring the real number you already have before you do anything. I cover the phone version of the same trick in <a href="https://kellssecurity.com/blog/ai-voice-clone-scams" data-mce-href="https://kellssecurity.com/blog/ai-voice-clone-scams">how to protect your family from AI voice clone scams</a>, including the family safe word that beats both.</p><p>Finally, watch for texts offering prizes, energy bill rebates, or a job you did not apply for. If it sounds too good, it is.</p><h2>How to Spot a Fake Link</h2><p>Scammers copy the look of real websites, but the address gives them away. Be wary of web addresses full of random letters, extra words such as "secure" or "refund" stuck to a real brand name, or strange endings. Shortened links hide where they lead, so never trust one in an unexpected text. On a phone, you can press and hold a link to preview the address without opening it. If the address does not clearly belong to the company, do not tap.</p><p>Do not rely on a message looking professional either. Logos and wording are easy to copy, and criminals can even make a text appear in the same conversation as a real one by faking the sender name. The only safe habit is to go to the company yourself through a route you trust.</p><h2>What To Do With a Scam Text</h2><figure id="figure-ksstx2oct"><img id="ksstx2oct" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="" src="https://cdn.durable.co/blocks/23GgC67yV8ug2JmXM9i7Ix0vBwLUxuBC8N5frtDDwbLUDHa8TUZLIAlqkNTQtyPL.jpg" alt="Smartphone showing an unknown caller, a reminder to report and block scam text message senders" data-corners="default" data-aspect="16/9" data-caption="" data-positionx="50" data-positiony="50" data-fullwidth="false" data-mce-src="https://cdn.durable.co/blocks/23GgC67yV8ug2JmXM9i7Ix0vBwLUxuBC8N5frtDDwbLUDHa8TUZLIAlqkNTQtyPL.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><p>If you have not clicked, do not reply, not even to say "stop". A reply tells them your number is live. Instead, forward the text to 7726, the free spam reporting service run by the mobile networks. It spells SPAM on the keypad, and the networks use reports to block the sender. Then delete the message and block the number.</p><p>You can also report fraud and scams to <a href="https://www.reportfraud.police.uk/" target="_blank" rel="noopener" data-mce-href="https://www.reportfraud.police.uk/">Report Fraud</a>, the service that replaced Action Fraud, or ring Police Scotland on 101 if you are in Scotland. The <a href="https://www.ncsc.gov.uk/" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/">National Cyber Security Centre</a> has further advice on spotting and reporting phishing. I have laid out the other options in <a href="https://kellssecurity.com/blog/where-to-report-a-scam" data-mce-href="https://kellssecurity.com/blog/where-to-report-a-scam">where I actually report a scam</a>, and my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">Safety Toolkit</a> keeps the main links in one place.</p><h2>If You Have Already Clicked or Paid</h2><p>Do not panic, and do not feel daft. These messages are built by professionals. What matters now is speed.</p><p>If you entered card or bank details, ring your bank straight away on 159, the number the banking industry set up for exactly this, or use the number on the back of your card. Tell them what happened and ask them to stop or block any payments. If you typed in a password, change it on the real website straight away, and anywhere else you use the same one. Turn on two-step verification where you can. If you gave away a one-time code, treat that account as compromised and tell the provider.</p><p>Keep a screenshot of the text, then report it as above. If you are worried about an older relative who might tap without thinking, my guide to <a href="https://kellssecurity.com/blog/helping-an-older-parent-stay-safe-online" data-mce-href="https://kellssecurity.com/blog/helping-an-older-parent-stay-safe-online">helping an older parent stay safe online</a> shows how to bring it up kindly.</p><h2>Make a Habit of Pausing</h2><p>You do not need to be a tech expert to beat scam texts. You need one habit: pause, then check through a route you trust. Scammers make their money from the half-second when you act before you think, and a pause takes that away. Scammers also pick up details from what people post, so it helps to read <a href="https://kellssecurity.com/blog/the-social-media-habits-that-quietly-put-people-at-risk" data-mce-href="https://kellssecurity.com/blog/the-social-media-habits-that-quietly-put-people-at-risk">the social media habits that quietly put people at risk</a>.</p><p>If you would like the checks on one page for the fridge door, <a href="https://tinyurl.com/kells-checklist" target="_blank" rel="noopener" data-mce-href="https://tinyurl.com/kells-checklist">sign up for my free online safety checklist</a>. My book <a href="https://www.amazon.co.uk/dp/B0HJJSMVKB" target="_blank" rel="noopener" data-mce-href="https://www.amazon.co.uk/dp/B0HJJSMVKB">Spot the Scam</a> explains the ten cons most likely to catch people out, in plain English. You can read <a href="https://kellssecurity.com/about" data-mce-href="https://kellssecurity.com/about">about me and why I do this</a>, and if you have a text you are not sure about, <a href="https://kellssecurity.com/contact" data-mce-href="https://kellssecurity.com/contact">get in touch</a> and I will take a look.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

Is This Text a Scam? How to Spot Fake Texts in the UK

<p>The phone rings. It is your son, or your daughter, or your gran. They sound scared. They say they are in trouble and need money sent straight away, and please don't tell anyone. Every instinct tells you to help. That is exactly what the criminals are counting on.</p><p>Voice cloning scams use software to copy a real person's voice, often from a few seconds of audio taken from a social media video. I run <a href="https://kellssecurity.com/" data-mce-href="https://kellssecurity.com/">Kells Security Solutions</a> to explain scams like this in plain English, and this one worries me more than most, because it goes after love, not greed. The good news is that there is a simple, free defence, and it takes about five minutes to set up.</p><h2>How Voice Clone Scams Work</h2><p>The scammer finds a voice online, usually a clip from Facebook, Instagram or TikTok. They feed it into software that can copy the sound and speech patterns. Then they ring a relative, often an older one, pretending to be the person in the clip.</p><p>The story is nearly always the same. An accident, an arrest, a lost phone, a stranded trip abroad. There is always a deadline, always secrecy, and always a request for a fast payment by bank transfer, gift cards or crypto. Not every call uses a cloned voice. Some are just a crying stranger saying "it's me". But the technology has made the fake far more convincing, so I no longer tell people to trust their ears.</p><p>If you want the wider picture of how scammers use what you post, I have covered it in <a href="https://kellssecurity.com/blog/the-social-media-habits-that-quietly-put-people-at-risk" data-mce-href="https://kellssecurity.com/blog/the-social-media-habits-that-quietly-put-people-at-risk">the social media habits that quietly put people at risk</a>.</p><h2>The Family Safe Word</h2><figure id="figure-kssvc1oct"><img id="kssvc1oct" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: 50 50;" title="Three generations of a family at the table agreeing a family safe word to beat AI voice clone scams" src="https://cdn.durable.co/blocks/38L2J3FKDrWNig5kRVm7tijtC9m8TWQ2kY0KhHvmQ18Erk9Iy3GcoNNVlVdOvPfd.jpg" alt="Three generations of a family at the table agreeing a family safe word to beat AI voice clone scams" data-corners="default" data-aspect="16/9" data-caption="" data-positionx="50" data-positiony="50" data-fullwidth="false" data-mce-src="https://cdn.durable.co/blocks/38L2J3FKDrWNig5kRVm7tijtC9m8TWQ2kY0KhHvmQ18Erk9Iy3GcoNNVlVdOvPfd.jpg" data-mce-style="aspect-ratio: 16/9; object-position: 50 50;"></figure><p>This is the single best defence I know. Agree one word or short phrase with your close family that only you know. If anyone rings in an emergency asking for money or help, you ask for the safe word. No word, no help, whoever it sounds like.</p><p>A few rules make it work. Pick something that cannot be guessed from social media, so not a pet's name or a street. Make it unusual and easy to say, like "purple lighthouse". Never post it, text it or put it in a group chat. Tell everyone who might be targeted, especially grandparents, and practise it once so it feels normal rather than awkward.</p><p>If you would like a ready-made list of checks to stick on the fridge, <a href="https://tinyurl.com/kells-checklist" target="_blank" rel="noopener" data-mce-href="https://tinyurl.com/kells-checklist">sign up for my free online safety checklist</a>.</p><h2>What To Do When the Call Comes</h2><figure id="figure-kssvc2oct"><img id="kssvc2oct" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="" src="https://cdn.durable.co/blocks/3aJQzZAl5oC2piZcFDWmyJiBla1fHcFRmU4rZ7qSxrWlcgLQoOp7NjRG2uNpoCpq.jpg" alt="Hands dialling a trusted number on a smartphone to check a suspected voice clone scam phone call" data-corners="default" data-aspect="16/9" data-caption="" data-positionx="50" data-positiony="50" data-fullwidth="false" data-mce-src="https://cdn.durable.co/blocks/3aJQzZAl5oC2piZcFDWmyJiBla1fHcFRmU4rZ7qSxrWlcgLQoOp7NjRG2uNpoCpq.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><p>Even without a safe word, you can beat this scam if you slow it down. Scammers rely on panic, so your job is to break the spell.</p><p>Hang up. Then ring the person back on the number you already have for them, not one the caller gives you. If they don't answer, try someone else who would know where they are, such as a partner, a friend or their workplace. Ask a question only the real person could answer, like the name of a childhood pet or what you had for dinner on Sunday. Be very suspicious of anyone who begs you not to tell other family members.</p><p>Never send money, buy gift cards or move cash in response to an urgent call, however real it sounds. A genuine family member in trouble will still be there in ten minutes when you ring back.</p><h2>Making Yourself and Your Family Harder to Copy</h2><p>You can't stop a voice being copied altogether, but you can make it harder. Set social media accounts to private where you can, and think before posting videos of yourself or your children talking. Check what your older relatives have posted too, because it is often their own grandchildren's clips that get taken.</p><p>Turn on two-step verification for your email and banking apps, so a scammer who does get information from a call can't walk straight into your accounts. I explain how in <a href="https://kellssecurity.com/blog/helping-an-older-parent-stay-safe-online" data-mce-href="https://kellssecurity.com/blog/helping-an-older-parent-stay-safe-online">helping an older parent stay safe online</a>, which is also worth reading if you are the family's unofficial IT support.</p><p>Veterans and serving personnel are targeted too, because our families are often posted about online. I write about this for <a href="https://civvymagazine.co.uk/" target="_blank" rel="noopener" data-mce-href="https://civvymagazine.co.uk/">CIVVY Magazine</a>, the independent magazine written by veterans for veterans.</p><h2>If You Think You Have Been Caught Out</h2><p>Ring your bank straight away. You can reach most UK banks by dialling 159, the number set up by the banking industry for exactly this. The sooner they know, the better your chance of stopping the payment or getting the money back.</p><p>Then report it to <a href="https://www.reportfraud.police.uk/" target="_blank" rel="noopener" data-mce-href="https://www.reportfraud.police.uk/">Report Fraud</a>, the service that replaced Action Fraud, or ring Police Scotland on 101 if you are in Scotland. The <a href="https://www.ncsc.gov.uk/" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/">National Cyber Security Centre</a> also has good advice on spotting and reporting scam calls. My <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">Safety Toolkit</a> pulls the main reporting links into one place, and I have set out the other options in <a href="https://kellssecurity.com/blog/where-to-report-a-scam" data-mce-href="https://kellssecurity.com/blog/where-to-report-a-scam">where I actually report a scam</a>.</p><p>Please don't feel embarrassed. These calls are designed by professionals to get past even careful people. Tell your family what happened so they are ready if the same number rings them.</p><h2>Five Minutes Tonight</h2><p>Pick your safe word. Tell your close family. Write it down somewhere private, not on your phone. That is the whole job, and it could save someone you love a great deal of money and heartache.</p><p>If you want the bigger picture on the cons most likely to catch people out, my book <a href="https://www.amazon.co.uk/dp/B0HJJSMVKB" target="_blank" rel="noopener" data-mce-href="https://www.amazon.co.uk/dp/B0HJJSMVKB">Spot the Scam</a> explains ten of them in plain English. You can read more <a href="https://kellssecurity.com/about" data-mce-href="https://kellssecurity.com/about">about me and why I do this</a>, or <a href="https://kellssecurity.com/contact" data-mce-href="https://kellssecurity.com/contact">get in touch</a> if you have had a call you are not sure about and I will take a look.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

How to Protect Your Family from AI Voice Clone Scams

<p>Every autumn, as the poppies start to appear, people get more generous. Collection tins come out, fundraising pages get shared around Facebook, and most of us put our hands in our pockets without thinking twice. Scammers know that. A charity appeal is one of the easiest disguises going, because nobody wants to be the person who questions a good cause.</p><p>I served in the Royal Green Jackets, so anything with a cap badge or a poppy on it gets my attention straight away. That is exactly why I check before I give. It takes me about two minutes, and it means my money ends up where I meant it to go. Here is the routine I use, and the one I teach through <a href="https://kellssecurity.com/" data-mce-href="https://kellssecurity.com/">Kells Security Solutions</a>.</p><h2>Why Fake Charity Appeals Work So Well</h2><p>Most scams rely on fear or greed. This one relies on decency. A photo of a wounded soldier, a sad story about a veteran who has fallen on hard times, a countdown to Remembrance Sunday, and a link to donate. It feels rude to hesitate.</p><p>The criminals behind these appeals copy real charity names with one word changed, lift photos from genuine posts and set up pages that look the part. They post them into community groups and veterans' groups because they know those are the places people give quickest. I have written about this from a veteran's point of view for <a href="https://civvymagazine.co.uk/" target="_blank" rel="noopener" data-mce-href="https://civvymagazine.co.uk/">CIVVY Magazine</a>, the independent magazine written by veterans for veterans, and the same tricks are aimed at everybody else too.</p><p>It also ties in with <a href="https://kellssecurity.com/blog/the-social-media-habits-that-quietly-put-people-at-risk" data-mce-href="https://kellssecurity.com/blog/the-social-media-habits-that-quietly-put-people-at-risk">the social media habits that quietly put people at risk</a>. The more a scammer can see about what you care about, the easier it is to put the right appeal in front of you.</p><h2>The Two-Minute Check I Do Before I Donate</h2><figure id="figure-kss2chk2oct"><img id="kss2chk2oct" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="" src="https://cdn.durable.co/blocks/17wrxk9PBrrkaGgsuHy5N86Shd3tdDhzkPGDSKYwSbTqDPVc3QJGJHjxYBAXONLZ.jpg" alt="Older man checking a charity appeal on his phone beside a laptop before donating online" data-corners="default" data-aspect="16/9" data-caption="" data-positionx="50" data-positiony="50" data-fullwidth="false" data-mce-src="https://cdn.durable.co/blocks/17wrxk9PBrrkaGgsuHy5N86Shd3tdDhzkPGDSKYwSbTqDPVc3QJGJHjxYBAXONLZ.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><p>I never give through a link somebody else has sent me. I close the message, open my browser and look the charity up myself. If it operates in England or Wales, I search the official <a href="https://www.gov.uk/find-charity-information" target="_blank" rel="noopener" data-mce-href="https://www.gov.uk/find-charity-information">charity register on GOV.UK</a>. It shows the registered name and number, who the trustees are and what the charity does with its money. Scotland has its own register, run by <a href="https://www.oscr.org.uk/" target="_blank" rel="noopener" data-mce-href="https://www.oscr.org.uk/">OSCR, the Scottish Charity Regulator</a>, and Northern Ireland has one as well.</p><p>Then I compare. Does the name on the appeal match the register exactly, or is it one word out? Does the charity number on the page belong to that charity? Does the website address on the register match the one I have been sent? A very small charity may not be on the register at all, so if I can't find one I ask who is behind it and give somewhere I can check instead.</p><p>My last step is the <a href="https://www.fundraisingregulator.org.uk/directory" target="_blank" rel="noopener" data-mce-href="https://www.fundraisingregulator.org.uk/directory">Fundraising Regulator's directory</a>, which lists the charities that have signed up to its standards for fundraising. It is not a legal requirement, but it is a good sign.</p><h2>Collection Tins, Doorsteps and Street Collectors</h2><figure id="figure-kss1chk2oct"><img id="kss1chk2oct" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="" src="https://cdn.durable.co/blocks/15NvMktc02nFmIL3PpJ2oTiNu1GFiYrmwC42V1KoCBv7HLP6sSfcT9u1BXRFYTRw.jpg" alt="Hands holding a glass charity collection jar full of coins, showing why to check a charity appeal is genuine before donating" data-corners="default" data-aspect="16/9" data-caption="" data-positionx="50" data-positiony="50" data-fullwidth="false" data-mce-src="https://cdn.durable.co/blocks/15NvMktc02nFmIL3PpJ2oTiNu1GFiYrmwC42V1KoCBv7HLP6sSfcT9u1BXRFYTRw.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><p>Not every appeal arrives on a screen. Genuine street and door-to-door collectors should be able to show you ID and tell you which charity they are collecting for, and their tin or bucket should be sealed and clearly labelled with the charity's name and registered number. A collector who gets awkward when you ask is telling you something.</p><p>If I am not sure, I don't give on the spot. I go home and donate directly through the charity's own website. For the Poppy Appeal, that means going straight to the <a href="https://www.britishlegion.org.uk/" target="_blank" rel="noopener" data-mce-href="https://www.britishlegion.org.uk/">Royal British Legion</a> myself. The charity still gets the money and the doubt is gone.</p><p>The same goes for poppy pins, wristbands and other merchandise sold online. If the seller is not the charity or one of its named partners, there is no guarantee a penny of it reaches the cause.</p><h2>Fundraising Pages and Posts Shared by Friends</h2><p>Personal fundraising pages are harder, because there is no register to check. A collection for a named person can be completely genuine, or it can be a stolen photo and an invented story.</p><p>So I look at who set the page up and how long it has existed. I ask the person who shared it whether they actually know the family. If the post has come from a friend's account and reads a bit out of character, I ring them, because hijacked accounts are used for exactly this. And I am wary of any appeal that wants a bank transfer to a personal account, a gift card or cryptocurrency. Real charities don't collect that way.</p><p>This is worth a conversation with older relatives too. Postal and phone appeals still catch a lot of people out, and I cover how to raise it gently in <a href="https://kellssecurity.com/blog/helping-an-older-parent-stay-safe-online" data-mce-href="https://kellssecurity.com/blog/helping-an-older-parent-stay-safe-online">helping an older parent stay safe online</a>.</p><h2>If You Think You Have Given to a Fake</h2><p>Ring your bank straight away on the number on the back of your card. The sooner they know, the better your chance of getting the money back. Then report it to <a href="https://www.reportfraud.police.uk/" target="_blank" rel="noopener" data-mce-href="https://www.reportfraud.police.uk/">Report Fraud</a> (the service that replaced Action Fraud), or to Police Scotland on 101 if you are in Scotland. I have set out the other places worth telling in <a href="https://kellssecurity.com/blog/where-to-report-a-scam" data-mce-href="https://kellssecurity.com/blog/where-to-report-a-scam">where I actually report a scam</a>, and the main reporting links are all in one place on my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">Safety Toolkit</a>.</p><p>Tell the real charity as well if its name has been used, and warn the group where you saw the appeal. There is no shame in being caught out by this one. It works because you were trying to do something kind.</p><h2>Keep Giving, Just Check First</h2><p>None of this is a reason to stop giving. Genuine charities need the support, and a real one will never mind you checking. Look it up yourself, match the name and number, and donate through the charity's own website. That is the whole routine.</p><p>If you would like the full set of checks on one page, <a href="https://tinyurl.com/kells-checklist" target="_blank" rel="noopener" data-mce-href="https://tinyurl.com/kells-checklist">sign up for my free online safety checklist</a>. And if you want the bigger picture, my book <a href="https://www.amazon.co.uk/dp/B0HJJSMVKB" target="_blank" rel="noopener" data-mce-href="https://www.amazon.co.uk/dp/B0HJJSMVKB">Spot the Scam</a> explains the ten cons most likely to catch you out, in plain English.</p><p>You can read more <a href="https://kellssecurity.com/about" data-mce-href="https://kellssecurity.com/about">about me and why I do this</a>, and if you have had an appeal you are not sure about, <a href="https://kellssecurity.com/contact" data-mce-href="https://kellssecurity.com/contact">get in touch</a> and I will take a look.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

How I Check a Charity Appeal Is Genuine Before I Give

<p>More people are asking me about passkeys than about almost anything else at the moment. They'll be logging into their bank or their email, see a prompt asking if they want to "create a passkey instead", and message me wondering if it's safe, if it's a trick, or if they're about to lock themselves out of their own account. So here's the honest, plain-English version of what I tell them.</p><h2>What a Passkey Actually Is</h2><p>A passkey replaces your password with something tied to your actual device, usually unlocked with your face, your fingerprint, or your phone's PIN. There's no string of characters to type, remember, or accidentally hand over to a fake login page. Behind the scenes it's a pair of cryptographic keys, one that stays locked on your phone or computer and never leaves it, and one that sits with the website you're logging into. Neither one is any use without the other, which is the whole point.</p><p>You don't need to understand the cryptography to use one safely. All you need to know is that when a site asks you to create a passkey, it's asking to swap a password (a shared secret that can be guessed, leaked, or phished) for something that can't be typed into a fake page by mistake, because there's nothing to type.</p><h2>Why They're Safer Than a Password, Even a Good One</h2><p>I've written before about the <a href="https://kellssecurity.com/blog/the-method-i-actually-use-to-build-a-password-worth-trusting" data-mce-href="https://kellssecurity.com/blog/the-method-i-actually-use-to-build-a-password-worth-trusting">method I actually use to build a password worth trusting, </a>and even a properly random, unique password still has one weakness: you or your browser has to enter it somewhere, and a convincing fake login page can catch that. A passkey can't be phished the same way, because it only works on the genuine site it was created for. If a scam page copies your bank's login screen pixel for pixel, your passkey simply won't respond to it, because the underlying address doesn't match. That single fact removes one of the most common ways people get caught out, without you having to spot anything suspicious yourself.</p><h2>What Happens If You Lose Your Phone</h2><p>This is the question I get asked most, and it's a fair one. Passkeys are usually backed up to your Apple, Google, or Microsoft account and sync across your other devices, so losing one phone doesn't lock you out for good, the same way losing your phone doesn't delete your saved passwords from a password manager. Most sites also let you register more than one passkey, or fall back to a traditional login method if you genuinely lose access everywhere. I'd still treat losing a phone as a reason to check your account recovery options are up to date, the same as I would with any account, passkey or not.</p><h2>Where I've Already Switched, and Where I Haven't</h2><p>I've moved over on my email and a couple of accounts where a breach would genuinely hurt, and it's been painless every time, a face scan or a fingerprint and I'm in. I haven't switched everywhere yet, mostly because not every site supports it, and I'm in no rush to chase it down site by site. That's the realistic way to approach this: switch where it's offered on the accounts that matter most, and let the rest catch up over time rather than treating it as an all-or-nothing project.</p><h2>A Word for Families Sharing One Device</h2><p>I get asked about this a lot by people helping an older parent or a partner who shares a tablet or a family computer. Because a passkey is tied to a face, fingerprint, or device PIN rather than something typed in, it can actually make shared devices safer, nobody can peer over a shoulder and memorise a password if there's no password to see. The one thing worth checking is that each person is set up with their own face or fingerprint profile on a shared device before you start creating passkeys, otherwise you can end up with everyone's accounts unlocking for everyone. Two minutes in the device's settings sorts that out properly.</p><h2>Passkeys and Password Managers Aren't Rivals</h2><p>This is the bit that trips people up. A passkey isn't something you need to remember or store yourself, it lives on your device or in your password manager, and a good password manager will actually create, store, and sync your passkeys alongside the passwords you still need for the sites that haven't caught up yet. I use <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass </a>for exactly this, it handles both without me having to think about which system a particular login is using. If you're still relying on your browser to remember everything or, worse, reusing the same password everywhere, that's genuinely the more urgent fix to make first.</p><h2>Should You Switch Today?</h2><p>If a site you use offers a passkey, I'd say yes, set it up, it takes less time than resetting a forgotten password ever did. I wouldn't go out of your way to demand it from every service you use, and I definitely wouldn't panic if half your accounts still ask for a password next year, this is a genuine industry shift but it's happening gradually, not overnight. Pair it with<a href="https://kellssecurity.com/blog/why-i-treat-two-factor-authentication-as-non-negotiable" data-mce-href="https://kellssecurity.com/blog/why-i-treat-two-factor-authentication-as-non-negotiable"> two-factor authentication</a> on anything that doesn't support passkeys yet, I still treat that as non-negotiable on every account that matters, and you're covering the gap sensibly while the rest of the web catches up.</p><p>If you want a clearer picture of where passkeys fit into your wider setup, the UK's<a href="https://www.ncsc.gov.uk/blogs/passkeys-are-more-secure-than-traditional-ways-to-log-in" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/blogs/passkeys-are-more-secure-than-traditional-ways-to-log-in"> National Cyber Security Centre</a> has straightforward guidance on moving away from passwords, or you can <a href="https://kellssecurity.com/contact" data-mce-href="https://kellssecurity.com/contact">get in touch</a> and I'll talk you through your specific accounts.</p><p>If you want the full picture on spotting the scams that go after your accounts, grab my <a href="https://79516839.sibforms.com/serve/MUIFAAzCSl0YuEwRMq4a4xv696PrjPtci8pqRdpNUvPRnH9fF-gauC1E_eGFVnwYYGIz2Wdg8bfKiwSjYjxoukXt_Dz7JlzqD5-mpQiIXVKfIA0-0B2cjR54xgODntiOjGBJ2K4Pq2-T3AQqxmQ5ER1uv0WQSEUzNeTje1QXmDkFm_sADqNAYtxABtGZXkJfeM24GY5zcWVw8UV1" data-mce-href="https://79516839.sibforms.com/serve/MUIFAAzCSl0YuEwRMq4a4xv696PrjPtci8pqRdpNUvPRnH9fF-gauC1E_eGFVnwYYGIz2Wdg8bfKiwSjYjxoukXt_Dz7JlzqD5-mpQiIXVKfIA0-0B2cjR54xgODntiOjGBJ2K4Pq2-T3AQqxmQ5ER1uv0WQSEUzNeTje1QXmDkFm_sADqNAYtxABtGZXkJfeM24GY5zcWVw8UV1">free Safety Checklist</a> and I'll send you a short email series with the rest. If you'd rather have it all in one place, my book <a href="https://www.amazon.co.uk/dp/B0HJMF41G2" data-mce-href="https://www.amazon.co.uk/dp/B0HJMF41G2">Spot the Scam:</a> A Plain English Guide to the Ten Cons Trying to Catch You Out is on Amazon.</p><p>Affiliate disclosure: some links on this page, including NordPass and NordVPN, are affiliate links. If you buy through them I may earn a commission at no extra cost to you. I only recommend tools I'd use myself.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

What I Actually Tell People When They Ask About Passkeys

<p>My mum is seventy-three and she is not daft. She reads more than I do, she manages her own money, and she has been running a household since before I was born. So when I started helping her with online safety, the worst thing I could have done was talk to her like she was a child who had wandered into traffic. I did it anyway at first, and it went about as well as you would expect.</p><p>What follows is what I actually do now, after getting it wrong for a good while. It works because it treats the person as capable, which they are, and because it puts the boring protective stuff in place quietly in the background rather than turning every phone call into a lecture.</p><h2>Why the big scary talk never works</h2><p>The instinct is to sit someone down and list everything that could go wrong. Fake bank texts. Cloned voices. Romance scams. Dodgy links. By the end of it they feel got at, slightly stupid, and no safer than when you started, because nothing has actually changed on their devices.</p><p>Worse than that, it makes them less likely to tell you when something does happen. Nobody wants to ring the person who warned them and admit they clicked the thing. That silence is the real danger. Most of the damage in a scam happens in the hours after the click, not the click itself, and those are exactly the hours when someone is sat there feeling too embarrassed to say anything.</p><p>So I stopped doing the talk. I do the setup instead, and I keep the conversation short and specific.</p><h2>The three things I set up before anything else</h2><p>First, two-factor authentication on email. Not on everything, just email to begin with. Email is the master key, because it is where every password reset lands, and if someone else has it they can walk into everything else. It takes about five minutes and it is the single biggest jump in safety you can give anyone. I have written out the exact steps I use in my guide to <a href="https://kellssecurity.com/blog/the-step-by-step-way-i-set-up-two-factor-authentication-for-clients" data-mce-href="https://kellssecurity.com/blog/the-step-by-step-way-i-set-up-two-factor-authentication-for-clients">setting up two-factor authentication </a>if you want to follow along.</p><p>Second, a password manager. This is the one that gets the most resistance, because it sounds technical and it sounds like one more thing to remember. It is genuinely the opposite. It means they remember one password instead of forty, and it means the same password stops being reused across the bank, the supermarket and some forum they joined in 2011. I use <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass </a>myself and I set it up on my mum's phone in an afternoon.</p><p>Third, and this one costs nothing, I made myself the safe person to ring. I said, out loud and more than once, that if anything ever looks off she should ring me and I will never make her feel silly about it. That sentence has been worth more than every other bit of setup combined.</p><h2>The scams I see catching that generation most</h2><p>It is rarely the exotic stuff. Three formats do most of the damage.</p><p>Delivery texts, because everyone is expecting a parcel and the message arrives with a plausible tracking number and a link that wants a small redelivery fee. The fee is not the point. The card details are.</p><p>Bank impersonation calls, where someone rings claiming to be from the fraud team and creates just enough panic that thinking straight becomes difficult. The tell is always the same: a real bank will never ask you to move money to a safe account, because no such thing exists.</p><p>And the slow ones. Someone friendly turns up in a comment section or a messaging app, builds a rapport over weeks, and only asks for anything much later. These are the ones that hurt the most, because by the time it goes wrong there is real affection involved.</p><p>I go through the<a href="https://kellssecurity.com/blog/the-scams-people-ask-me-about-most-often" data-mce-href="https://kellssecurity.com/blog/the-scams-people-ask-me-about-most-often"> scams people ask me about most often </a>in more detail elsewhere, but those three cover the bulk of it.</p><h2>How I explain things without the jargon</h2><p>I have one rule. If I cannot explain it using something from ordinary life, I have not understood it well enough myself to be teaching it.</p><p>Two-factor authentication is not two-factor authentication. It is the chain on the front door. The key gets you to the door, the chain means someone still has to prove who they are before you let them all the way in.</p><p>A password manager is not a vault with encryption. It is the drawer where you keep all your keys, and only you have the drawer key.</p><p>Phishing is not phishing. It is somebody in a high-vis jacket walking into a building like they belong there, because nobody questions a man with a clipboard.</p><p>Nobody needs the technical word. They need the picture. Once the picture is in their head, the behaviour follows on its own and you never have to nag about it again.</p><h2>What to do when it has already happened</h2><p>Sometimes you are not preventing anything, you are cleaning up. The order matters more than the speed.</p><p>Ring the bank first, on the number printed on the back of the card, never a number from the message that started all this. Then change the email password, then the passwords for anything that used the same one. Then report it, which in the UK means <a href="https://www.actionfraud.police.uk/" target="_blank" rel="noopener" data-mce-href="https://www.actionfraud.police.uk/">Action Fraud</a>, and which matters even when nothing was lost, because the reporting is how the patterns get spotted.</p><p>And then, and I mean this, do not do the post-mortem. Do not talk them through everything they should have spotted. They know. What they need is to come out of it still willing to tell you next time.</p><p>Everything I have mentioned here, the password manager, the two-factor setup, the lot, is in my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">safety toolkit </a>if you would rather see the tools in one place than piece it together yourself.</p><p>If you want the full picture on spotting the scams that go after your accounts, grab my <a href="https://79516839.sibforms.com/serve/MUIFAAzCSl0YuEwRMq4a4xv696PrjPtci8pqRdpNUvPRnH9fF-gauC1E_eGFVnwYYGIz2Wdg8bfKiwSjYjxoukXt_Dz7JlzqD5-mpQiIXVKfIA0-0B2cjR54xgODntiOjGBJ2K4Pq2-T3AQqxmQ5ER1uv0WQSEUzNeTje1QXmDkFm_sADqNAYtxABtGZXkJfeM24GY5zcWVw8UV1" data-mce-href="https://79516839.sibforms.com/serve/MUIFAAzCSl0YuEwRMq4a4xv696PrjPtci8pqRdpNUvPRnH9fF-gauC1E_eGFVnwYYGIz2Wdg8bfKiwSjYjxoukXt_Dz7JlzqD5-mpQiIXVKfIA0-0B2cjR54xgODntiOjGBJ2K4Pq2-T3AQqxmQ5ER1uv0WQSEUzNeTje1QXmDkFm_sADqNAYtxABtGZXkJfeM24GY5zcWVw8UV1">free Safety Checklist</a> and I'll send you a short email series with the rest. If you'd rather have it all in one place, my book <a href="https://www.amazon.co.uk/dp/B0HJMF41G2" data-mce-href="https://www.amazon.co.uk/dp/B0HJMF41G2">Spot the Scam:</a> A Plain English Guide to the Ten Cons Trying to Catch You Out is on Amazon.</p><p>Affiliate disclosure: some links on this page, including NordPass and NordVPN, are affiliate links. If you buy through them I may earn a commission at no extra cost to you. I only recommend tools I'd use myself.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

Helping an Older Parent Stay Safe Online

Kells Security Solutions

I teach people around the world how to spot online scams and stay safe on the internet, explained in plain English with no jargon. I cover phishing emails, two-factor authentication, password managers, VPNs and antivirus software, written for people who are not tech experts and want to protect themselves and their families.