Blog

<h2>The Online Shopping Routine I Follow From Search to Delivery</h2><p>People usually ask me about online shopping safety in terms of a single moment, the second before they hit "pay now" on a site they're not sure about. That moment matters, but it's only one part of a longer routine, and most of the actual protection happens before you ever reach checkout and after the parcel's supposedly on its way. I've built a habit around the whole journey rather than just the payment page, and it's the reason I can shop on a site I've never used before without spending twenty minutes second-guessing myself.</p><p><br></p><h2>Where I Start: Avoiding a Fake Site Before I Even Search</h2><p><br></p><p>A surprising amount of shopping fraud starts right at the search stage, not the checkout. Scammers buy paid search ads for popular products, register lookalike domains a single letter off a real retailer's name, and build convincing clone sites that only fall apart if you look closely. I've made it a habit to scroll past the sponsored results at the top of a search and click the genuine listing further down instead, and to type a retailer's address directly into the bar if I already know it rather than searching for it fresh each time. If I land on a site I don't recognise through a link rather than a search, I'll open a new tab and search the brand name separately just to see what comes up, because a company with a real reputation usually has more than one page's worth of results.</p><p><br></p><h2>The Payment Method I Always Choose, and Why</h2><p><br></p><p>Where I put my money in matters as much as where I'm sending it. A credit card gives you protections a debit card simply doesn't, the ability to raise a dispute through the card provider if something never turns up or turns out to be counterfeit, and for larger purchases that protection can cover the retailer's failure even if the retailer itself goes under. I use my credit card for anything over a token amount and keep my debit card mostly for places I already trust completely. Bank transfers are the one method I'll never use for a stranger's online shop, because once that money's sent there's no dispute process standing behind it, and it's the payment method scammers push hardest precisely because it can't be clawed back.</p><p><br></p><h2>What I Do the Moment I've Paid</h2><p><br></p><p>The confirmation email that lands seconds after a purchase feels like a formality, but I've started treating it as the first piece of evidence I might need later. I save it rather than delete it, note the order number somewhere I'll actually find again, and take a screenshot of the final order summary before closing the tab in case the confirmation email never arrives at all, which does happen with less reliable sites. It takes thirty seconds and it's meant almost nothing until the one time it mattered, when a dispute with a card provider needed exactly that paper trail to go anywhere. I keep a dedicated folder for these, sorted by month, so I'm never digging back through years of unrelated messages trying to find the one order that's actually gone wrong.</p><p><br></p><h2>Staying Alert Once the Delivery Window Opens</h2><p><br></p><p>The days between paying and the parcel arriving are when a different kind of scam tends to show up, the "missed delivery" text with a link to pay a small redelivery fee, timed to arrive right when you're actually expecting something and therefore more likely to click without thinking. I've trained myself to check the tracking number directly through the courier's own site or app rather than any link sent by text, because a genuine courier will never ask for a card payment to redeliver something you've already paid for. If a text or email doesn't match an order I actually know is in transit, it gets deleted without a second thought, and if it does match one I'm expecting, I still go to the courier's site directly rather than tapping through.</p><p><br></p><figure id="figure-dfib79dlsmtiphej1"><img id="dfib79dlsmtiphej1" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: undefined undefined;" title="Woman checking her phone at home, My Online Shopping Routine From Search to Delivery" src="https://cdn.durable.co/covers/2DLj7xKFDiOptcvFJMNkt0lNwyA4nwZJW6kLw9dOurAj5Narss34RChvGD7LyedU.jpg" alt="Woman checking her phone at home, My Online Shopping Routine From Search to Delivery" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/2DLj7xKFDiOptcvFJMNkt0lNwyA4nwZJW6kLw9dOurAj5Narss34RChvGD7LyedU.jpg" data-mce-style="aspect-ratio: 16/9; object-position: undefined undefined;"></figure><h2>What I Do If Something Actually Goes Wrong</h2><p><br></p><p>Even with all of that, something occasionally does go wrong, an item that never arrives, a description that turns out to be nowhere close to what showed up. I contact the retailer first and give them a reasonable window to sort it, but I don't let that drag on indefinitely, most card providers give you a limited period to raise a dispute and it's worth knowing roughly how long that is before you need it. Waiting too long "to be fair to the seller" is the single most common reason I've seen people lose the right to a dispute they'd otherwise have won easily. Having the confirmation email and order screenshot saved from the start is what makes that process quick rather than a scramble to prove a purchase actually happened. I've written before about the <a href="https://kellssecurity.com/blog/how-i-decide-whether-to-trust-a-new-online-shop" data-mce-href="https://kellssecurity.com/blog/how-i-decide-whether-to-trust-a-new-online-shop">specific checks I run before trusting a shop I've never used</a>, and about the <a href="https://kellssecurity.com/blog/the-checkout-red-flags-i-check-before-i-enter-my-card-details" data-mce-href="https://kellssecurity.com/blog/the-checkout-red-flags-i-check-before-i-enter-my-card-details">red flags I look for right at the checkout page </a>itself, and this routine is really just those two habits with the bits either side of them filled in.</p><p><br></p><p>None of this needs to slow shopping down once it's a habit rather than a checklist you're consciously running through. Search past the paid ads, pay by credit card where you can, save the confirmation the moment it lands, go straight to the courier's own site for anything delivery-related, and know how long you've got to raise a dispute if it comes to that. I keep my card and account details stored in <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass </a>rather than typed fresh each time, which also means I notice immediately if a form's asking for something a genuine checkout page never would. The rest of what I actually use day to day is covered in my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">free Safety Toolkit</a>, and <a href="https://www.actionfraud.police.uk/" target="_blank" rel="noopener" data-mce-href="https://www.actionfraud.police.uk/">Action Fraud </a>has its own guidance on online shopping scams if you want a second source alongside mine.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

My Online Shopping Routine From Search to Delivery

<p>A client rang me last month convinced she had just spoken to her son. Same voice, same habit of trailing off at the end of his sentences, same slightly impatient tone he gets when he needs something. He was in trouble, he said, and needed money moving that afternoon. It was not him. It was roughly thirty seconds of audio lifted from a video he had posted, run through software that costs less than a takeaway. She did not send anything, and the reason she did not is the whole point of this post.</p><h2>Why Trying to Spot AI Scams Stopped Working</h2><p>For years the advice was to look for the tells. Bad spelling, clumsy phrasing, a logo in slightly the wrong shade of blue. That advice worked when scams were churned out by people rushing through hundreds of messages a day. It does not work now. The spelling is perfect. The phrasing reads like a real person because real people's writing trained the thing that wrote it. The voice on the phone is your daughter's voice, because it was built from your daughter's voice.</p><p>I have written before about how AI scams keep getting harder to spot, and the short version is that the tells people were taught to look for have quietly disappeared. So I stopped teaching people to spot scams a while back and I have not gone back. Detection puts all the pressure on you being sharp at exactly the wrong moment, usually when you are tired, distracted or frightened. Verification does the opposite. It assumes you will be fooled at some point and gives you something to do anyway.</p><h2>The Safe Word Every Family Should Have</h2><p>This is the one I push hardest and it costs nothing at all. Pick a word or a short phrase that your immediate family knows and that would never come up in ordinary conversation. Not a pet's name, not a street you used to live on, nothing that is sitting in a Facebook post somewhere. Something daft works best, because daft is memorable and nobody can guess it.</p><p>The rule is simple. If someone claiming to be family asks for money, or asks for something urgent and out of character, you ask for the word. A real relative will either know it or laugh at you for asking. A cloned voice will stall, get irritated, or try to talk you past it. That reaction is the tell, and it is far more reliable than anything you might think you can hear in the voice itself.</p><p>I have set this up with families where the grandparents felt a bit silly about the whole idea. Two of them have since used it for real. Neither felt silly at the time.</p><h2>Why I Always Hang Up and Call Back</h2><p>The second habit is even simpler. Whoever rings you, whatever they say, you end the call and you ring back on a number you already had. Not the number that just called you. Not a number the caller reads out to you. The one saved in your phone, or printed on the back of your bank card, or on a letter you were sent months ago.</p><figure id="figure-k1bwyvw06qmtbsp3g5"><img id="k1bwyvw06qmtbsp3g5" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Worried older man on a suspicious phone call, The Simple Checks I Use to Stop AI Scams" src="https://cdn.durable.co/covers/53TSLRnp03hV6RbE3sAyBIrtLB7DB0QpFBjOkVjCSmt9lTxV8mwEZUb7Zr3Wxekr.jpg" alt="Worried older man on a suspicious phone call, The Simple Checks I Use to Stop AI Scams" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/53TSLRnp03hV6RbE3sAyBIrtLB7DB0QpFBjOkVjCSmt9lTxV8mwEZUb7Zr3Wxekr.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><p>This works because it breaks the one thing every scam of this kind depends on, which is keeping you inside a conversation they control. A <a href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything" data-mce-href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything">fake bank fraud team</a> cannot follow you onto a line you dialled yourself. Neither can a cloned voice. Leave a minute or two before you dial as well, because older landlines could sometimes be held open by the caller, and a short wait costs you nothing.</p><p>Real organisations are completely relaxed about this. I have never known a bank, a utility company or the police to object to being called back. Anyone who does object, who tells you there is no time or that the line has to stay open, has just told you exactly what they are.</p><h2>Video Calls Are Harder Than People Expect</h2><p>Voice cloning gets the headlines, but faked video is now good enough to fool people on a short call, particularly on a phone screen with a patchy connection. The old advice about asking someone to turn their head or wave a hand in front of their face is getting less reliable every year, and I would not want anyone betting a house deposit on it.</p><p>So I treat video exactly the same as voice. If a video call is asking me to do something that moves money or hands over access, the call itself is not the verification. I go and check through a different channel entirely, which usually means a text to a number I already have, or a phone call I place myself. The point is not which channel you pick. The point is that the person on the screen does not get to choose it for you.</p><h2>The AI Scams I'm Actually Seeing Right Now</h2><p>Most of what lands in my inbox now falls into a few categories: fake investment schemes promising huge AI-powered returns, cloned voice messages asking for urgent money transfers, and chatbot-style customer service scams that string you along for your card details over what feels like a completely normal support conversation. None of these need much technical skill from the scammer anymore, the AI does the convincing for them. I'm also seeing more fake job offers that use an AI-generated recruiter persona, complete with a professional-sounding video introduction, to get a victim comfortable enough to hand over bank details for a "onboarding" payment. The investment schemes worry me most, because they're often dressed up with fake testimonials, fabricated news screenshots, and a chatbot "advisor" that answers questions instantly and convincingly, all designed to make a fabricated returns dashboard feel like something real that you'd be foolish to miss out on.</p><h2>AI Chatbots Posing as Customer Support</h2><p>I've noticed scam sites getting a lot more sophisticated about the "live chat" box that pops up the moment you land on them. It used to be an obvious script with clunky responses, and now some of these bots hold a genuinely natural conversation, answer follow-up questions coherently, and steer you toward entering payment details or personal information without ever feeling like you're talking to something scripted. The tell isn't in how the conversation reads anymore, it's in what the conversation is trying to get you to do. A support chat that pushes hard toward entering card details, remote access software, or a "verification" link outside the platform you started on is worth walking away from, no matter how naturally it's written.</p><h2>What to Do When You Simply Cannot Check</h2><p>Sometimes there is genuinely no way to verify in the moment. A relative is abroad, it is the middle of the night, the one person who could confirm it is unreachable. This is the situation scammers engineer on purpose, because urgency plus isolation is where people make the decision they later cannot explain to themselves.</p><p>My rule for that gap is that nothing irreversible happens inside it. No transfers, no card details, no codes read out loud, no remote access software installed because someone talked you through it. Waiting an hour has never once cost one of my clients anything real. Acting inside that hour has cost people their savings.</p><p>Two things worth having in place long before you ever need them. Turn on two factor authentication for your email and your banking, so that a scammer holding your password still cannot get in. And use a password manager, so one leaked login does not quietly open everything else you own. I use <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass </a>for exactly that reason and it takes an evening to set up properly.</p><p>If you want the official version of all this sitting alongside mine, <a href="https://www.takefive-stopfraud.org.uk/" target="_blank" rel="noopener" data-mce-href="https://www.takefive-stopfraud.org.uk/">Take Five</a> is the national campaign built around the same idea and it is worth ten minutes of anyone's time. And if you would rather just talk it through with a real person, <a href="https://kellssecurity.com/contact" data-mce-href="https://kellssecurity.com/contact">get in touch</a> and I will help you set a family safe word up properly.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The Simple Checks I Use to Stop AI Scams

<p>For years I watched people write off scams and hacking as something that happens to someone else, somewhere else. Not any more. I hear from more people every month who've had a scam text, a dodgy email, or a mate who's lost money to a fake delivery link. The good news is that awareness is finally catching up with the threat, and that's half the battle won. What I want to cover here isn't the doom and gloom version of this story, it's the parts that are actually working, the things I see making a real difference when I talk to people about staying safe online.</p><h2>Community Sessions Are Making a Real Difference</h2><p>Libraries, community centres and local groups everywhere are running free sessions on staying safe online, and I love seeing it. These aren't dry lectures either. They're practical, hands on, and aimed at real problems: spotting a phishing email, setting a password you'll actually remember, and understanding what your social media privacy settings are quietly sharing with the world. If you've never been to one, it's worth a look. And if you can't make it, that's exactly why I write this blog, so you get the same advice without leaving the sofa. I've sat in on a few of these sessions myself over the years, partly out of curiosity and partly to see what questions people are actually asking rather than the ones I assume they're asking, and the gap between the two is bigger than you'd think.</p><h2>Schools Are Teaching the Next Generation</h2><p>I'm genuinely encouraged by how many schools now build online safety into the curriculum rather than treating it as an afterthought. Kids are growing up online from primary school onwards, so teaching them to spot a scam or think before they click matters just as much as teaching them to cross the road safely. It sets habits that last a lifetime, and honestly, some of what they're learning would do half the adults I know some good too. I've had conversations with parents who tell me their kids come home and correct them on password habits, which is exactly the kind of role reversal I'm happy to see. A habit taught at eight years old tends to stick in a way that advice given to a busy adult at thirty five often doesn't.</p><h2>Small Businesses Are Stepping Up Too</h2><p>It's not just individuals either. More small businesses are taking cybersecurity seriously, and not before time, because a single phishing email can cost a small firm thousands and take months to recover from. I've written a full guide on <a href="https://kellssecurity.com/blog/small-business-cybersecurity" data-mce-href="https://kellssecurity.com/blog/small-business-cybersecurity">protecting small businesses</a> if that's you, covering the basics you need without the jargon or the eye watering price tag. What I notice most with small business owners is that they usually know they should be doing more, they just don't know where to start or what actually matters versus what's being sold to them as essential. That gap between knowing and doing is where most of the damage happens.</p><h2>The Advice That's Finally Landing</h2><p>A few years ago, telling someone to use a password manager got a shrug or a "that sounds like a hassle." I'm hearing that a lot less now. Something has shifted, whether it's a friend who got caught out, a news story that hit closer to home, or simply enough repetition that the message has finally sunk in. The same goes for two-factor authentication, which used to feel like an extra step nobody wanted to bother with and now gets treated as basic common sense by a growing number of people I talk to. I think part of what's changed is that the advice itself has gotten simpler. Fewer people are being told to memorise sixteen random characters, and more are being pointed towards tools that do the remembering for them.</p><h2>Where I Still See Gaps</h2><p>I don't want to make this sound like the job is done, because it isn't. The people who are engaging with this advice tend to be the ones who were already halfway there, reasonably tech confident, already a bit cautious. The people I worry about most are the ones who don't see themselves as a target at all, who assume scammers only go after people with obvious wealth or people who are careless. That assumption is exactly what makes them a target. Scammers don't care how careful you think you are, they care whether a message catches you at a distracted moment, and that can happen to anyone regardless of how switched on they normally are. I've spoken to retired professionals who ran entire departments in their careers and still got caught out by a fake courier text, simply because it landed on a busy Tuesday morning between two other things demanding their attention. Confidence in your own judgement is not the same thing as protection, and the sooner people separate those two ideas the better.</p><h2>How You Can Be Part of It</h2><p>You don't need to run a workshop or rewrite your company's IT policy to make a difference. Start small. Use a proper password manager instead of reusing the same password everywhere, I use <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass </a>myself and it's removed the guesswork entirely, learn to spot the signs of a phishing email, and report scams when you see them rather than just deleting and moving on, <a href="https://www.actionfraud.police.uk" target="_blank" rel="noopener" data-mce-href="https://www.actionfraud.police.uk">Action Fraud</a> makes it painless. Have a browse of my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">Safety Toolkit</a> for the tools I actually use myself, or get in touch if you'd like some straight talking advice tailored to you or your business.</p><p>If you want the full picture on spotting the scams that go after your accounts, grab my <a href="https://79516839.sibforms.com/serve/MUIFAAzCSl0YuEwRMq4a4xv696PrjPtci8pqRdpNUvPRnH9fF-gauC1E_eGFVnwYYGIz2Wdg8bfKiwSjYjxoukXt_Dz7JlzqD5-mpQiIXVKfIA0-0B2cjR54xgODntiOjGBJ2K4Pq2-T3AQqxmQ5ER1uv0WQSEUzNeTje1QXmDkFm_sADqNAYtxABtGZXkJfeM24GY5zcWVw8UV1" data-mce-href="https://79516839.sibforms.com/serve/MUIFAAzCSl0YuEwRMq4a4xv696PrjPtci8pqRdpNUvPRnH9fF-gauC1E_eGFVnwYYGIz2Wdg8bfKiwSjYjxoukXt_Dz7JlzqD5-mpQiIXVKfIA0-0B2cjR54xgODntiOjGBJ2K4Pq2-T3AQqxmQ5ER1uv0WQSEUzNeTje1QXmDkFm_sADqNAYtxABtGZXkJfeM24GY5zcWVw8UV1">free Safety Checklist</a> and I'll send you a short email series with the rest. If you'd rather have it all in one place, my book <a href="https://www.amazon.co.uk/dp/B0HJMF41G2" data-mce-href="https://www.amazon.co.uk/dp/B0HJMF41G2">Spot the Scam:</a> A Plain English Guide to the Ten Cons Trying to Catch You Out is on Amazon.</p><p>Affiliate disclosure: some links on this page are affiliate links. If you buy through them I may earn a commission at no extra cost to you. I only recommend tools I'd use myself.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

What's Actually Working to Keep People Safe Online

<p>AI has made scammers far better at their job, and that's not an exaggeration. Deepfake voice calls, chatbots that sound eerily human, and messages written to sound exactly like your bank or a family member. I've seen scam texts so convincing that switched on, careful people have nearly been caught out. Understanding how these scams work is the first step to spotting them before they cost you, and the myths people repeat back to me are usually what gets them caught out rather than any lack of intelligence or care on their part.</p><h2>What AI Scams Actually Look Like</h2><p>The technology behind these scams has moved faster than most people's mental picture of what a scam looks like. A voice clone now needs only a few seconds of audio, often lifted from a video someone posted publicly years ago, to produce a call that sounds convincingly like a parent, a child, or a boss asking for something urgent. Text-based scams have improved just as much. The clumsy spelling and broken grammar that used to be a reliable giveaway has largely disappeared, replaced by messages that read like they were written by someone fluent in exactly the tone your bank or delivery company would use. I've seen scam texts so convincing that switched on, careful people have nearly been caught out, not because they were careless but because the old warning signs simply aren't there anymore.</p><h2>The Myths That Get People Caught Out</h2><p>I hear the same handful of myths again and again, so let's clear them up properly. Myth one, antivirus software has you covered. It helps against malicious files and known threats, but it was never built to catch a scammer pretending to be your grandson on the phone, because there's no malware involved at all, just a very convincing conversation. Myth two, AI scams only target older or less tech savvy people. Rubbish. I've had messages from friends in their twenties who nearly fell for a fake delivery text, and I've heard from IT professionals who paused for a second too long on a voice clone call before catching themselves. Myth three, a strong password solves everything. A strong password is one brick in the wall, not the whole wall. I use <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass </a>to generate and store mine, which takes the guesswork out of it completely. Turn on two factor authentication too, it takes five minutes and it closes the gap a stolen password would otherwise leave wide open.</p><h2>How to Spot One Before It Spots You</h2><p>A few signs crop up again and again once you know what to look for. A request for personal details out of nowhere, whether that's by email, text or social media, is always worth pausing on regardless of how legitimate the sender appears. Pressure to act immediately is another, because scammers know that panic switches off your judgement, and a genuine request from a bank or family member almost never requires an instant, unquestioning response. Links or attachments from someone you don't recognise, or from someone you do recognise but who's messaging oddly, carry a lot of the same warning signs as phishing emails, and the oddness in tone or timing is often the first thing to notice before the content itself gives anything away. If something feels off, it usually is, trust that instinct rather than talking yourself out of it because the message looked polished.</p><h2>The Verification Habit That Actually Works</h2><p>The single most useful habit I've picked up isn't a piece of software, it's a verification step I now do automatically. If I get a call or message that seems to be from someone I know asking for money, personal details, or urgent action, I hang up or stop replying and contact that person through a completely separate channel I already trust, a phone number I've saved myself rather than one given to me in the message. It sounds almost too simple to matter, but it defeats the entire premise of a voice clone or an impersonation text, because the scam only works if you respond within that one hijacked channel. I've started suggesting this to family members explicitly, agreeing in advance on a phrase or question only we'd know the answer to, which sounds dramatic until you consider how convincing these calls have become. I've written up the <a href="https://kellssecurity.com/blog/the-verification-habits-i-rely-on-whenever-i-suspect-an-ai-scam" data-mce-href="https://kellssecurity.com/blog/the-verification-habits-i-rely-on-whenever-i-suspect-an-ai-scam">fuller set of verification habits I rely on whenever I personally suspect an AI scam</a> if you want the step by step version of what I do.</p><h2>Why Education Beats Panic</h2><p>The businesses and families who cope best with AI scams aren't the ones with the most expensive software, they're the ones who talk about it openly. If you run a small business, get your team talking about what a scam attempt looks like, it costs nothing and it works, and it means the first time someone encounters a convincing attempt isn't the first time they've thought about what to do. The same goes for families, particularly ones with members who might be targeted specifically because they're seen as an easier mark. A five minute conversation over dinner about what a fake delivery text looks like does more good than most people expect. If you want a proper primer on the wider landscape, the <a href="https://www.ncsc.gov.uk" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk">National Cyber Security Centre</a> publishes excellent free guidance, it's worth a bookmark. My free <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">Safety Toolkit</a> has more practical steps like this one if you want to go deeper. Stay curious, stay a little bit sceptical, and you'll be miles ahead of most scammers, because the technology may have changed but the habit of pausing before you act hasn't stopped working yet.</p><p>If you want the full picture on spotting the scams that go after your accounts, grab my <a href="https://79516839.sibforms.com/serve/MUIFAAzCSl0YuEwRMq4a4xv696PrjPtci8pqRdpNUvPRnH9fF-gauC1E_eGFVnwYYGIz2Wdg8bfKiwSjYjxoukXt_Dz7JlzqD5-mpQiIXVKfIA0-0B2cjR54xgODntiOjGBJ2K4Pq2-T3AQqxmQ5ER1uv0WQSEUzNeTje1QXmDkFm_sADqNAYtxABtGZXkJfeM24GY5zcWVw8UV1" data-mce-href="https://79516839.sibforms.com/serve/MUIFAAzCSl0YuEwRMq4a4xv696PrjPtci8pqRdpNUvPRnH9fF-gauC1E_eGFVnwYYGIz2Wdg8bfKiwSjYjxoukXt_Dz7JlzqD5-mpQiIXVKfIA0-0B2cjR54xgODntiOjGBJ2K4Pq2-T3AQqxmQ5ER1uv0WQSEUzNeTje1QXmDkFm_sADqNAYtxABtGZXkJfeM24GY5zcWVw8UV1">free Safety Checklist</a> and I'll send you a short email series with the rest. If you'd rather have it all in one place, my book <a href="https://www.amazon.co.uk/dp/B0HJMF41G2" data-mce-href="https://www.amazon.co.uk/dp/B0HJMF41G2">Spot the Scam:</a> A Plain English Guide to the Ten Cons Trying to Catch You Out is on Amazon.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

AI Scams: The Cybersecurity Myths I Keep Hearing

<h2>What I Look at Before Recommending Anything</h2><p>Every business that asks me about cybersecurity thinks it needs the biggest, priciest package on the market. It usually doesn't. A five-person accountancy firm has completely different risks to a warehouse team handling stock for a national retailer, and a two-person design studio working entirely from laptops has different risks again. The first thing I do with any business is work out what data it actually holds, who might want it, and what would genuinely hurt if it went missing. Get that right and the rest of the buying decision gets a lot simpler, because a good chunk of what gets sold to small businesses is priced for problems they don't actually have. I've sat through enough sales calls on behalf of clients to know the pattern: the pitch starts with the worst-case headline, not with a single question about what the business actually does, and by the time the quote lands it bears almost no relationship to the risk in front of you.</p><p>This matters more the smaller the business is, not less. A larger company usually has someone whose job it is to push back on an oversized quote or spot a contract clause that doesn't add up. A five-person team rarely has that person, which is exactly why so many small businesses end up either badly underprotected or paying for a package built for a company ten times their size.</p><h2>The Non-Negotiables, Whatever Your Budget</h2><p>Some things aren't optional, no matter how small the business is. A proper firewall, endpoint protection that actually updates itself rather than sitting untouched after installation, and backups that are tested, not just switched on and forgotten about. I've seen businesses pay for expensive software and never once check whether their backup would actually restore anything if it had to. Set a calendar reminder and test it, it takes twenty minutes and can save you a very bad week. I've written before about <a href="https://kellssecurity.com/blog/small-business-cybersecurity" data-mce-href="https://kellssecurity.com/blog/small-business-cybersecurity">protecting small businesses</a> if you want the fuller version of this advice, covering the basics without the jargon or the price tag some providers attach to them.</p><h2>Two Tools Worth Paying For</h2><p>Beyond the basics, the two upgrades I recommend most often are a proper password manager and a VPN for anyone working off site or on public wifi. If a team is still sharing logins on a spreadsheet, a tool like <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass</a> sorts that out in an afternoon, generating and storing a unique password for every account rather than the same one reused across a dozen logins by whoever set it up first. <a href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" target="_blank" rel="noopener" data-mce-href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902">NordVPN</a> is worth having too if anyone on the team works from cafes, client sites, or home broadband nobody's vetted, since public wifi is exactly the kind of connection a strong password alone won't protect you on. Neither costs much measured against what a breach would.</p><h2>Red Flags When You're Being Sold To</h2><p>Watch out for fear-based sales pitches, generic package deals that ignore what you actually told them about your business, and contracts that lock you in for years with no way out if the service turns out to be wrong for you. A good provider asks questions before they pitch anything, and if they can't explain in plain terms what a piece of software actually does for your specific setup, that's worth noticing. If a salesperson's first move is frightening you with ransomware headlines before they've asked a single question about how your business actually operates, that's a sign they're selling fear, not a solution built for you.</p><h2>The Mistake I See Most Often</h2><p>The single most common mistake isn't a missing piece of software at all, it's a business that bought the right tools and then never revisited the setup again. A password manager rolled out two years ago is only useful if new starters are actually added to it and leavers are actually removed, and I've walked into more than one business where a former employee's login still worked months after they'd left. The same goes for backup and endpoint software installed once during a rushed onboarding and never checked since. Cybersecurity isn't a one-off purchase you tick off a list, it's a handful of habits that need someone to actually own them, even if that's just fifteen minutes a quarter to check what's still active and who still has access to what.</p><h2>What This Actually Costs</h2><p>Business owners usually assume proper cybersecurity is going to be a huge line item, and that assumption alone stops a lot of sensible spending from ever happening. In reality, the non-negotiables I mentioned earlier, decent endpoint protection, tested backups, and a password manager across the whole team, usually cost less per month than a single client lunch. The expensive mistakes come from one of two directions: doing nothing until something goes wrong, or overspending on an enterprise-grade package sold to a five-person team that will never use half of what it includes. I'd rather see a small business spend modestly on the right things consistently than sign an eye-watering annual contract for coverage it doesn't actually need.</p><h2>Getting Started</h2><p>If you want a second opinion before you sign anything, my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">Safety Toolkit</a> page lists the tools I actually use and recommend myself, and you're always welcome to <a href="https://kellssecurity.com/contact" data-mce-href="https://kellssecurity.com/contact">get in touch</a>. I'll give you my honest take, free of charge, no obligation, and if the answer turns out to be that you don't need anything beyond what you've already got, I'll tell you that too rather than talk you into a package you don't need.</p><p>If you want the full picture on spotting the scams that go after your accounts, grab my <a href="https://79516839.sibforms.com/serve/MUIFAAzCSl0YuEwRMq4a4xv696PrjPtci8pqRdpNUvPRnH9fF-gauC1E_eGFVnwYYGIz2Wdg8bfKiwSjYjxoukXt_Dz7JlzqD5-mpQiIXVKfIA0-0B2cjR54xgODntiOjGBJ2K4Pq2-T3AQqxmQ5ER1uv0WQSEUzNeTje1QXmDkFm_sADqNAYtxABtGZXkJfeM24GY5zcWVw8UV1" data-mce-href="https://79516839.sibforms.com/serve/MUIFAAzCSl0YuEwRMq4a4xv696PrjPtci8pqRdpNUvPRnH9fF-gauC1E_eGFVnwYYGIz2Wdg8bfKiwSjYjxoukXt_Dz7JlzqD5-mpQiIXVKfIA0-0B2cjR54xgODntiOjGBJ2K4Pq2-T3AQqxmQ5ER1uv0WQSEUzNeTje1QXmDkFm_sADqNAYtxABtGZXkJfeM24GY5zcWVw8UV1">free Safety Checklist</a> and I'll send you a short email series with the rest. If you'd rather have it all in one place, my book <a href="https://www.amazon.co.uk/dp/B0HJMF41G2" data-mce-href="https://www.amazon.co.uk/dp/B0HJMF41G2">Spot the Scam:</a> A Plain English Guide to the Ten Cons Trying to Catch You Out is on Amazon.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The Cybersecurity Buying Guide I Give Every Small Business

<p>I read a lot of cybersecurity coverage that makes everything sound apocalyptic. Most of it isn't. What I'm actually seeing, working with people day to day, is a shift in who gets targeted and how. It used to be mostly big companies. Now it's just as often an ordinary person checking their phone on the bus between stops. The tools scammers use have got cheaper and easier to access, so the volume of low effort attacks has gone up sharply even where the sophisticated ones haven't changed all that much. That distinction matters more than most coverage lets on, because it changes what you should actually be worried about day to day.</p><p>The businesses and families who come to me worried about the wrong things usually got that worry from a headline, not from anything specific happening to them. I'd rather talk about what I'm genuinely seeing repeat itself across real conversations, because that's a far better guide to where your attention should go than whatever's trending in the news that week.</p><h2>AI Is Changing Both Sides</h2><p>Scammers are using AI to write more convincing messages and clone voices, and I've covered some of <a href="https://kellssecurity.com/blog/ai-scams-the-cybersecurity-myths-i-keep-hearing" data-mce-href="https://kellssecurity.com/blog/ai-scams-the-cybersecurity-myths-i-keep-hearing">the cybersecurity myths I keep hearing</a> about that shift. But the same technology is helping the good side too. Spam filters and fraud detection have got noticeably better at catching things before they reach you, often flagging patterns a human reviewer would never spot at that scale. It's an arms race, and right now neither side is winning outright. What that means practically is that the messages getting through the filters are, on average, the more convincing ones, so the old advice to "just look for the obvious signs" matters less than it used to.</p><h2>Phishing Emails Are Getting Harder to Spot</h2><p>The obvious spelling mistakes and dodgy logos are mostly gone. Today's phishing emails often look identical to the real thing, right down to the footer and the unsubscribe link. If you want the full detail on what to look for, I've written a guide on <a href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything" data-mce-href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything">how to identify email phishing</a> that goes through it step by step. The short version is to check the sender's actual email address, not just the display name, before you click anything, because the display name is trivial to fake and tells you nothing.</p><h2>The Trend I Didn't Expect</h2><p>The one shift that's genuinely surprised me is how much scam activity now starts on platforms that used to feel relatively safe, group chats, marketplace apps, and messaging platforms rather than email. People have spent years training themselves to be suspicious of their inbox, and that caution simply hasn't transferred to a message from someone claiming to be a buyer on a marketplace listing or a new contact in a group chat. Scammers go where the guard is down, and right now that's increasingly not email at all.</p><h2>Why I'm Wary of Fear-Based Marketing</h2><p>There's a growth industry in security products sold purely on fear, and I think it's doing almost as much damage as the scams themselves. I regularly hear from people who've bought an expensive suite of software after a panicked late-night purchase, without ever working out whether it actually addresses the risk that worried them in the first place. Fear makes for a great sales pitch and a genuinely poor buying decision, because it skips the one step that actually matters, working out what you're protecting and from whom. I'd always rather someone spent ten minutes thinking about their own setup than ten seconds panic-buying whatever's been marketed hardest that month.</p><p>This matters more now than it used to, because the marketing has got as sophisticated as the scams it claims to protect you from. Countdown timers, "your device is at risk" pop-ups, and inflated statistics are all designed to short-circuit the same careful thinking that protects you from an actual scam. If a security product is selling itself the way a scammer would, that's worth noticing rather than ignoring.</p><h2>The Basics Still Work</h2><p>With all this change, it's easy to think you need something complicated to stay safe. You mostly don't. Turning on two factor authentication is still one of the single best things you can do, and a password manager like <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass</a> takes away the temptation to reuse the same password everywhere, generating a unique one for every account instead. Neither takes more than a few minutes to set up, and both keep working regardless of how convincing the next wave of scams gets, because they don't rely on you spotting anything in the moment.</p><h2>What I'd Focus On If I Were You</h2><p>If you only do three things this year, make it these. Turn on two factor authentication everywhere it's offered, get a password manager, and use a VPN like <a href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" target="_blank" rel="noopener" data-mce-href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902">NordVPN</a> whenever you're on public wifi or a network you don't fully trust. None of it is exciting, but it's the difference between being an easy target and not being worth a scammer's time, and that's really the whole game. Scammers are running a numbers business, and the goal isn't to be unhackable, it's to be enough friction that they move on to someone easier.</p><p>Have a browse of my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">Safety Toolkit</a> for the full list of what I actually use myself, and if anything here raises a question specific to your own setup, drop me a message and I'll give you a straight answer.</p><p>If you want the full picture on spotting the scams that go after your accounts, grab my <a href="https://79516839.sibforms.com/serve/MUIFAAzCSl0YuEwRMq4a4xv696PrjPtci8pqRdpNUvPRnH9fF-gauC1E_eGFVnwYYGIz2Wdg8bfKiwSjYjxoukXt_Dz7JlzqD5-mpQiIXVKfIA0-0B2cjR54xgODntiOjGBJ2K4Pq2-T3AQqxmQ5ER1uv0WQSEUzNeTje1QXmDkFm_sADqNAYtxABtGZXkJfeM24GY5zcWVw8UV1" data-mce-href="https://79516839.sibforms.com/serve/MUIFAAzCSl0YuEwRMq4a4xv696PrjPtci8pqRdpNUvPRnH9fF-gauC1E_eGFVnwYYGIz2Wdg8bfKiwSjYjxoukXt_Dz7JlzqD5-mpQiIXVKfIA0-0B2cjR54xgODntiOjGBJ2K4Pq2-T3AQqxmQ5ER1uv0WQSEUzNeTje1QXmDkFm_sADqNAYtxABtGZXkJfeM24GY5zcWVw8UV1">free Safety Checklist</a> and I'll send you a short email series with the rest. If you'd rather have it all in one place, my book <a href="https://www.amazon.co.uk/dp/B0HJMF41G2" data-mce-href="https://www.amazon.co.uk/dp/B0HJMF41G2">Spot the Scam:</a> A Plain English Guide to the Ten Cons Trying to Catch You Out is on Amazon.</p><p>Affiliate disclosure: some links on this page are affiliate links. If you buy through them I may earn a commission at no extra cost to you. I only recommend tools I'd use myself.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The Cybersecurity Trends I'm Actually Seeing Right Now

Kells Security Solutions

I teach people around the world how to spot online scams and stay safe on the internet, explained in plain English with no jargon. I cover phishing emails, two-factor authentication, password managers, VPNs and antivirus software, written for people who are not tech experts and want to protect themselves and their families.