Blog

Delivery worker's hands carefully placing labeled package on residential doorstep in afternoon sunlight

<h2>How I Decide Whether to Trust a New Online Shop Before I Buy</h2><p>I buy from stores I've never heard of more often than I used to, mostly because social media ads and search results keep putting them in front of me. Some of them are genuinely good, small independent shops with better prices or products I can't find anywhere else. Some of them are set up to take a payment and disappear. The problem is that on the surface, both types can look almost identical, same polished template, same stock photography, same convincing product descriptions. Over the years I've settled into a fairly consistent process for deciding which is which before I hand over any card details, and it's saved me from a bad purchase more than once.</p><p><br></p><h2>Why New Stores Get More Scrutiny From Me Than Familiar Ones</h2><p><br></p><p>I don't run the same checks on a retailer I've used for years that I run on one I found through an ad this morning. That's not inconsistency, it's proportionate. A store with a track record has already demonstrated it ships what it sells and handles returns properly, so the risk of a first purchase there is genuinely lower. A brand new store, especially one I found through a paid ad rather than a search or a recommendation, hasn't demonstrated anything yet. It might be completely legitimate, plenty of good small businesses start exactly this way, but I treat the first purchase as a trust-building exercise rather than something I do on autopilot, and that changes how carefully I look at everything else on this list.</p><p><br></p><h2>The Company Details I Check First</h2><p><br></p><p>Before I add anything to a cart on a site I don't recognise, I look for the basics that a genuine business almost always has and a scam site often skips or fakes. A proper contact page with a real address, not just a contact form, is one of the first things I check. A company registration number, particularly for anything based in the UK, is another, since that's traceable if something goes wrong. I also check how long the site has actually existed, since a domain registered a few weeks ago selling what looks like an established brand's products is a pattern I've learned to take seriously. None of these checks take more than a couple of minutes, and none of them are foolproof on their own, but a site that fails several of them at once tells me enough to walk away before I've spent anything.</p><p><br></p><h2>What the Reviews Actually Tell Me, and What They Don't</h2><p><br></p><p>Reviews on the store's own website are close to useless as a trust signal, since nothing stops a site from only publishing the good ones or fabricating them entirely. What I actually look for is evidence from somewhere the store doesn't control, an independent review platform, a mention on a forum, someone discussing the brand on social media outside of the store's own posts. A complete absence of any independent trace for a store that claims to be established is itself a signal worth paying attention to. I also read a handful of the negative reviews specifically, not to be put off by every complaint, every retailer gets some, but because the pattern of complaints tells me something the star rating alone doesn't. Slow delivery and an unhelpful returns process is a normal retailer having an off month. Multiple people saying they paid and never received anything is a different category of problem entirely, and it's the one I actually walk away from.</p><figure id="figure-v5oy0jwblfmtdf4say"><img id="v5oy0jwblfmtdf4say" src="https://rjdavx8ozyznxeyh.public.blob.vercel-storage.com/production/websites/infinite-images/20d72678-b287-4fb1-918b-b7888c07c562-EiJi4qM9Tp4cS19VYoeUkugFEYmW0z.png" alt="Close-up of two professionals exchanging business cards during networking moment with warm lighting emphasizing hands and cards detail" title="Close-up of two professionals exchanging business cards during networking moment with warm lighting emphasizing hands and cards detail" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://rjdavx8ozyznxeyh.public.blob.vercel-storage.com/production/websites/infinite-images/20d72678-b287-4fb1-918b-b7888c07c562-EiJi4qM9Tp4cS19VYoeUkugFEYmW0z.png" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><p><br></p><h2>How I Pay Differently Depending on How Much I Trust the Site</h2><p><br></p><p>This is the part of my process that's changed the most over time. For a store I trust completely, an established retailer with years of history, how I pay barely matters. For a new or unverified store, it matters a lot, because the payment method is often the only real protection I have if something goes wrong. I use a credit card rather than a debit card for anything from a store I'm not fully confident in, since the legal protections on a credit card purchase are genuinely stronger if the goods never turn up. I avoid direct bank transfers entirely for anything from a business I haven't verified, since that removes almost every avenue for getting money back if things go wrong. None of this is about assuming the worst of every new store, it's about making sure that if I'm wrong about one, I'm not left with no way to recover the money. If I'm buying from anywhere I haven't fully verified while I'm out on public wifi, I'll run it through <a data-mce-href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" target="_blank" rel="noopener">NordVPN </a>first, since that's exactly the kind of unsecured connection where card details are most exposed in transit.</p><p><br></p><h2>What I Do When Something Still Feels Off</h2><p><br></p><p>Sometimes a store passes every individual check and I still hesitate, and I've learned to trust that hesitation rather than talk myself out of it because the checklist came back clean. When that happens, I'll usually do one more thing before buying, search the store's name alongside words like "scam" or "reviews" specifically, which surfaces complaints that don't always show up in a normal search. If I still can't find anything reassuring, I either wait, buy a small test item first rather than a large order, or find the same product from a retailer I already trust, even if it costs slightly more. I've stopped treating a good price as a reason to skip these checks. If anything, a price that's noticeably better than everywhere else selling the same thing is usually the reason to slow down and run through this process properly rather than the reason to buy quickly before it disappears.</p><p><br></p><p>None of these checks are complicated, and together they take less time than most people spend comparing prices across a few different sites anyway. What they've given me is a way to say yes to genuinely good new stores without also saying yes to the ones designed to take a payment and vanish, which is really the whole point. If you want the fuller version of what I check before buying from somewhere new, including <a data-mce-href="https://kellssecurity.com/blog/checkout-red-flags-before-i-pay-liverpool" href="https://kellssecurity.com/blog/checkout-red-flags-before-i-pay-liverpool">the checkout-specific red flags I look for </a>once I've already decided a store is worth trusting, I've put it together in a <a data-mce-href="https://kellssecurity.com/toolkit" href="https://kellssecurity.com/toolkit">free Safety Toolkit</a>, and <a data-mce-href="https://www.actionfraud.police.uk/" href="https://www.actionfraud.police.uk/" target="_blank" rel="noopener" data-mce-selected="inline-boundary">Action Fraud </a>has its own guidance on spotting fake online shops if you want a second source to weigh mine against.</p>

How I Decide Whether to Trust a New Online Shop Before I Buy

Hands organizing color-coded scheduling notes on wooden desk with natural window light

<h2>The Online Safety Tips I Actually Think Matter, and the Ones I Don't</h2><p>Every few weeks someone sends me one of those lists, forty tips for staying safe online, and asks what I think of it. My honest answer is always some version of the same thing. A handful of the items genuinely matter. Most of it is filler added to hit a word count. And a few items are advice I actively disagree with, the kind that sounds responsible but doesn't actually protect anyone in practice. I've written enough of these posts myself and heard from enough people who tried to follow lists like that to have a fairly settled view on which tips earn their place and which ones I've quietly stopped repeating.</p><p><br></p><h2>Why I Stopped Treating Every Tip the Same</h2><p><br></p><p>The problem with most safety lists is that every item gets presented with equal weight. Use a strong password sits next to clear your browser history weekly as if the two carry the same importance, when one of those genuinely determines whether your accounts get compromised and the other does almost nothing measurable. When everything looks equally urgent, people either try to do all of it and burn out, or they read the whole list and do none of it because it feels like too much. I'd rather tell someone three things that actually matter than forty things where thirty-seven of them are noise dressed up as diligence. That's not the same argument as which order to do things in, it's a separate question: which of these are actually worth your time at all.</p><p><br></p><h2>The Few I Think Genuinely Matter</h2><p><br></p><p>If I'm being honest about what actually moves the needle, it's a short list. A password manager sits at the top, not close to anything else. I've written before about <a data-mce-href="https://kellssecurity.com/blog/why-i-finally-switched-to-a-password-manager" href="https://kellssecurity.com/blog/why-i-finally-switched-to-a-password-manager">why I finally switched to a password manager</a>, and the short version is that it's the one change that fixes the single biggest weakness most people have without them ever noticing, reused or weak passwords sitting across dozens of accounts. I use <a data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener">NordPass </a>specifically because it removes every excuse people have for putting it off. Two-factor authentication comes right after it, because a strong password still fails if it ever leaks somewhere you didn't expect, and 2FA is what catches that. Keeping your software updated rounds out the list, mostly because it closes doors that are already publicly known to be open. Everything else I'd call genuinely important is really just a variation on these three: they're the tips that survive contact with real accounts and real attackers, not just contact with a checklist.</p><p><br></p><h2>The Ones I've Quietly Stopped Recommending</h2><p><br></p><p>There's a second category I used to repeat and don't anymore, because I never saw it change an outcome for anyone. Changing your passwords every ninety days on a fixed schedule is one of them. It sounds disciplined, but in practice it just pushes people toward small predictable variations of the same password, which is worse than leaving a genuinely strong one alone once it's actually strong. Treating incognito or private browsing mode as a meaningful safety measure is another. It hides your history from the next person using your device, that's genuinely useful for that one purpose, but it does nothing against the actual threats people usually mean when they ask about staying safe, phishing, scams, account compromise. I've also gone quiet on blanket advice to avoid all public wifi entirely, memorising which networks are supposedly safe and which aren't. If you're already covering that risk properly elsewhere, treating every coffee shop network as a crisis is energy spent on a problem you've already solved, and it tends to make people paranoid about the wrong layer of the picture. None of these are dangerous pieces of advice exactly, they're just advice that costs someone's attention without buying them much in return, and attention is the one resource every list like this quietly assumes is unlimited. I'd rather someone spent that attention on the three things that actually work.</p><p><br></p><h2>Where I Think the Real Risk Actually Sits</h2><p><br></p><p>If I'm ranking what actually causes people harm, it's rarely a technical gap. It's a moment of being rushed, distracted, or caught off guard by something that looks convincing enough not to question. That's true of most scams I hear about, and it's exactly why I put more weight on <a data-mce-href="https://kellssecurity.com/blog/the-simple-checks-i-use-to-stop-ai-scams" href="https://kellssecurity.com/blog/the-simple-checks-i-use-to-stop-ai-scams">the checks I use to catch AI-driven scams </a>than on most of the technical tips people ask me about. A voice that sounds right, a message that references something real, a sense of urgency, that's what actually gets people, far more often than a weak password or an unpatched app. The technical tips matter, I'm not walking that back, but they protect you from a different category of problem than the one that catches most people off guard.</p><figure id="figure-w40hszbtbimtdeieiy"><img id="w40hszbtbimtdeieiy" src="https://rjdavx8ozyznxeyh.public.blob.vercel-storage.com/production/websites/infinite-images/fba79424-76bd-4bbb-962f-12a806627b31-SMEoLKqhR4uZmduJpRv1VMMnLfBkhq.png" alt="Woman in peaceful meditation with eyes closed, soft side-lighting highlighting serene facial expression" title="Woman in peaceful meditation with eyes closed, soft side-lighting highlighting serene facial expression" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://rjdavx8ozyznxeyh.public.blob.vercel-storage.com/production/websites/infinite-images/fba79424-76bd-4bbb-962f-12a806627b31-SMEoLKqhR4uZmduJpRv1VMMnLfBkhq.png" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><p><br></p><h2>What I'd Actually Tell Someone Starting Today</h2><p><br></p><p>If someone asked me right now, today, for the version of this that actually matters, I'd give them three things and stop there. Get a password manager and let it generate and store everything properly. Turn on two-factor authentication, starting with email. And slow down for ten seconds before clicking anything that's trying to make you feel rushed, because that pause is worth more than most of the tips further down any list you'll find. Everything else on the usual lists is worth doing eventually, in its own time, but it's not what determines whether you're actually protected, and I'd rather be honest about that than hand someone forty items and let them assume each one carries equal weight. I've put the fuller version of what I think is worth prioritising into a <a data-mce-href="https://kellssecurity.com/toolkit" href="https://kellssecurity.com/toolkit">free Safety Toolkit</a>, and the <a data-mce-href="https://www.ncsc.gov.uk/cyberaware/home" href="https://www.ncsc.gov.uk/cyberaware/home" target="_blank" rel="noopener" data-mce-selected="inline-boundary">NCSC </a>has its own guidance on the basics if you want to weigh my list against theirs.</p>

The Online Safety Tips I Actually Think Matter, and the Ones I Don't

Adult hands organizing planning notebook with life goals at wooden desk in natural light

<h2>The Order I'd Actually Fix My Digital Security In, If I Started From Scratch</h2><p>A friend asked me recently where she should even begin with her online security. She'd read a few lists, felt overwhelmed by all of them at once, and ended up doing nothing at all for another six months. That's the real cost of a long checklist with no order to it. It's not that the advice is wrong, it's that when everything looks equally urgent, nothing actually gets done. So instead of giving her another list, I gave her an order, the same order I'd use if I were starting completely from scratch today.</p><p><br></p><h2>Why the Order Actually Matters Here</h2><p><br></p><p>Most security advice gets handed out as a flat list, turn on 2FA, use strong passwords, update your software, review your privacy settings, as if each item carries the same weight and can be tackled in any sequence. In practice, doing them out of order either wastes effort or leaves gaps that undo the whole point. Turning on two-factor authentication before sorting out weak, reused passwords protects the login step but does nothing for the password itself sitting exposed in a dozen other places. Reviewing privacy settings on social media before locking down your actual accounts is tidying the curtains while the front door's still open. The order isn't a small detail, it's most of what makes the difference between an afternoon that actually protects you and an afternoon that just feels productive.</p><p><br></p><h2>Start With a Password Manager, Not Individual Passwords</h2><p><br></p><p>This is where I'd always begin, and it's not close. Every other step on this list either depends on it or works better because of it. I've written before about <a data-mce-href="https://kellssecurity.com/blog/why-i-finally-switched-to-a-password-manager" href="https://kellssecurity.com/blog/why-i-finally-switched-to-a-password-manager">why I finally switched to a password manager</a>, and the short version is that trying to fix passwords one at a time, changing the obvious weak ones while leaving the rest, never actually gets finished. A password manager lets you fix all of them properly in one sitting, generating a long, unique password for every account and remembering it so you never have to. I use <a data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener">NordPass </a>for this specifically because setting it up takes minutes, not a weekend, which matters when the whole point is removing excuses to put it off. Nothing else on this list is worth doing until this one's in place, because everything after it either builds on strong unique passwords or gets undermined by their absence.</p><p><br></p><h2>Then Two-Factor Authentication, Starting With Email</h2><p><br></p><p>Once passwords are sorted, this is next, and I'd resist the urge to switch it on everywhere at once. I'd start with email specifically, because a compromised email account is usually the fastest route into everything else you own, password resets, other logins, personal documents sitting in old messages. I've been through the excuses people make here myself, I used to make most of them, telling myself it would take too long or that my password was already strong enough on its own, and none of them held up once I actually sat down and did it. From email, I'd work outward to banking, then anywhere financial details are stored, then anything else that matters, rather than trying to do all of it in one sitting and losing momentum halfway through. Most services only ask for that second step occasionally rather than on every single login, so the ongoing cost turns out to be almost nothing once it's set up, even though it feels like it'll be a constant hassle beforehand. Twenty minutes on the accounts that matter most beats an afternoon that never gets finished because it felt too big to start.</p><p><br></p><h2>After That, the Software Updates I Used to Click Away</h2><p><br></p><p>This is the step I used to skip for the longest, mostly because update prompts always seem to land at the worst possible moment, usually right as I'm trying to actually use the device for something. What changed my mind wasn't a lecture about security patches, it was realising how many serious breaches trace back to a vulnerability that had already been fixed months earlier, publicly documented and everything, just never installed on the device that got hit. The people writing the fix had already done their part. I turn on automatic updates wherever the option exists now, for my operating system, my browser, and anything handling passwords or payments specifically, rather than relying on myself to remember to check manually. It's the least interesting step on this list and also one of the most effective, precisely because it closes doors that are already publicly known to be open rather than guarding against something theoretical that might happen eventually.</p><figure id="figure-49fyj025h8lmtddbtg6"><img id="49fyj025h8lmtddbtg6" src="https://rjdavx8ozyznxeyh.public.blob.vercel-storage.com/production/websites/infinite-images/abee01c7-0bae-42c1-9864-bd4272dd6078-uHktr6cU3Qm4l77ddH9B3OqPlZmBYw.png" alt="Person's hand with pen marking a checkbox on minimalist daily habit tracker sheet in natural morning light." title="Person's hand with pen marking a checkbox on minimalist daily habit tracker sheet in natural morning light." class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://rjdavx8ozyznxeyh.public.blob.vercel-storage.com/production/websites/infinite-images/abee01c7-0bae-42c1-9864-bd4272dd6078-uHktr6cU3Qm4l77ddH9B3OqPlZmBYw.png" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><p><br></p><h2>Only Then Do I Worry About the Smaller Stuff</h2><p><br></p><p>Everything past this point matters, but it matters less urgently than the first three, which is exactly why it goes last rather than first. This is where I'd review old accounts I've forgotten I even have, since an account I haven't logged into in three years is still a live target if it still holds my details. It's also where I'd go through privacy settings on social media properly rather than skimming past them, since I've written before about <a data-mce-href="https://kellssecurity.com/blog/why-i-stopped-oversharing-on-social-media" href="https://kellssecurity.com/blog/why-i-stopped-oversharing-on-social-media">why I stopped oversharing </a>there in the first place. None of this is wasted effort, but doing it before the first three steps is solving a smaller problem while a bigger one sits untouched.</p><p><br></p><p>I'd rather someone did the first two properly and never got to the rest than tried to do everything at once and burned out after an hour. If you want the fuller version of what I'd actually walk through account by account, I've put it together in a <a data-mce-href="https://kellssecurity.com/toolkit" href="https://kellssecurity.com/toolkit">free Safety Toolkit</a>, and the <a data-mce-href="https://www.ncsc.gov.uk/cyberaware/home" href="https://www.ncsc.gov.uk/cyberaware/home" target="_blank" rel="noopener" data-mce-selected="inline-boundary">NCSC </a>has its own guidance on the basics if you want a second source to check any of this against before you start.</p>

The Order I'd Actually Fix My Digital Security In, If I Started From Scratch

Notary public applying official seal stamp to document with professional precision on mahogany desk

<h2>What Actually Happens When You Report a Scam, and Why I Still Do It</h2><p>For a long time I didn't bother reporting scam messages, even the obvious ones. I'd just delete the text, block the number, or ignore the email, and get on with my day. Reporting felt like it disappeared into a void somewhere, with no way of knowing if it did anything at all. What changed my mind wasn't a single dramatic moment, it was slowly learning what actually happens after you report something, and realising the five minutes it takes is doing more than I'd assumed.</p><h2>Why I Almost Didn't Bother Reporting Anything</h2><p>My honest reason for skipping it for years was that I couldn't see the point. Nobody was going to knock on the scammer's door because I'd forwarded one text message, and it felt like the kind of thing that mattered in theory but achieved nothing in practice. I also didn't know where reports actually went, which made the whole thing feel like shouting into an empty room. It took me a while to understand that individual reports aren't meant to catch one scammer on their own, they're meant to feed a much bigger picture, and that picture is only useful if people like me actually contribute to it.</p><h2>Where I Actually Report Different Types of Scams</h2><p>One thing that used to put me off was not knowing where a report was even supposed to go, so I've settled on a short list depending on what's landed in front of me. Suspicious texts get forwarded to 7726, which routes them straight to my phone provider for free. Scam emails get reported through whatever tool my email provider has built in, which usually takes seconds. Anything involving money, a fraudulent purchase, or a scam I've fallen for even partially goes to Action Fraud, since that's the UK's actual national reporting centre for fraud and cybercrime. Suspicious posts or profiles on social media get reported through the platform itself, since that's the fastest route to getting a fake account or listing actually taken down, even though it doesn't feed into the wider national picture the same way. Having these routes sorted in my head means I'm never standing there wondering where something is supposed to go, which used to be enough friction on its own to stop me bothering, and it means the whole process takes under a minute rather than turning into a research task every single time.</p><h2>What Information Actually Helps</h2><p>I used to think reporting meant writing out a long explanation of what happened, which was part of what put me off. In practice, the most useful thing I can do is forward or screenshot the message exactly as it arrived, rather than paraphrasing it from memory. The sender's number or email address matters more than I expected, since that's often what gets matched against other reports of the same scam. If money changed hands, the amount and the method, bank transfer, card payment, gift cards, matters too, since different payment methods get handled differently on the recovery side. I don't need to write a story about how I felt about it. The raw details are what actually get used.</p><figure id="figure-kqqf4wg0uemtdckfup"><img id="kqqf4wg0uemtdckfup" src="https://rjdavx8ozyznxeyh.public.blob.vercel-storage.com/production/websites/infinite-images/7a0316f7-0abf-4864-9bb4-f117e2a3e277-xsDLMH8MLrXWUkTXJ1xbPEGNXtylTA.png" alt="Close-up overhead view of hands reviewing documents and writing notes at professional workspace desk" title="Close-up overhead view of hands reviewing documents and writing notes at professional workspace desk" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://rjdavx8ozyznxeyh.public.blob.vercel-storage.com/production/websites/infinite-images/7a0316f7-0abf-4864-9bb4-f117e2a3e277-xsDLMH8MLrXWUkTXJ1xbPEGNXtylTA.png" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>What Happens After I Hit Submit</h2><p>This was the part I genuinely didn't understand for years, and once I did, reporting stopped feeling pointless. Reports to 7726 get used by phone networks to identify and block numbers being used at scale, not just for me individually but across their whole network, which is part of why the same scam text tends to stop arriving a while after enough people report it. Reports to Action Fraud get fed into a national database run alongside the National Fraud Intelligence Bureau, used to spot patterns, connect cases that look separate but aren't, and build the evidence that occasionally does lead to prosecutions, even if that outcome is rare for any single report on its own. None of this happens instantly, and I don't get a satisfying update telling me exactly what my report contributed to. But knowing it's going somewhere that actually does something with the pattern, rather than nowhere at all, was what got me to start bothering in the first place, and it's changed how pointless the whole exercise feels while I'm doing it.</p><h2>Why I Keep Doing It Anyway</h2><p>I'll be honest that reporting still doesn't feel dramatic or immediately rewarding, and I don't expect a personal outcome from any single report I file. What changed is that I stopped judging it by whether it caught the specific person who targeted me and started judging it by whether it added one more data point to a system that genuinely uses those data points. I also report things now even when I wasn't close to falling for them, <a data-mce-href="https://www.kellssecurity.com/blog/the-one-habit-that-stops-me-falling-for-phishing-emails" href="https://www.kellssecurity.com/blog/the-one-habit-that-stops-me-falling-for-phishing-emails">a scam I could spot instantly</a>, because the report is still useful even if I personally was never at risk. It costs me almost nothing, and I've stopped assuming that nothing happens with it just because I can't see the result directly.</p><p>If something does slip through and you end up clicking a link or handing over details before catching it, reporting is still worth doing immediately rather than out of embarrassment later, and it's worth changing anything that might be exposed straight away, starting with <a data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener">a password manager </a>if you haven't already moved your important accounts onto one. I've pulled together the fuller version of what I report and how in a <a data-mce-href="https://kellssecurity.com/toolkit" href="https://kellssecurity.com/toolkit">free Safety Toolkit</a>, and <a data-mce-href="https://www.actionfraud.police.uk/" href="https://www.actionfraud.police.uk/" target="_blank" rel="noopener" data-mce-selected="inline-boundary">Action Fraud </a>has its own guidance on what to do if you think you've been scammed, including cases where money has actually left your account.</p>

What Actually Happens When You Report a Scam

Homeowner's hands holding house keys resting on property transaction documents at wooden table with natural window light

<h2>The Four Tools I Actually Rely On to Stay Safe Online</h2><p>People ask me fairly often what security software they actually need, usually expecting a long list. I understand the instinct, there's no shortage of apps and services promising to protect you, and it's tempting to think more tools automatically means more safety. In practice, I've settled on four things I actually use every day, and everything else I've tried over the years has either been redundant, more hassle than it was worth, or solving a problem I didn't really have. Here's what actually earns a permanent place on my devices, and why.</p><h2>A Password Manager Comes First</h2><p>If I had to keep only one tool, this would be it, and it isn't close. Every other security habit I have sits on top of this one. Before I started using a password manager properly, I was reusing variations of the same few passwords across dozens of accounts, which meant a single breach anywhere could unlock everything else I owned. A password manager generates a long random password for every account, remembers all of them for me, and fills them in automatically so I never have to type or memorise anything. I've written before about <a data-mce-href="https://kellssecurity.com/blog/why-i-finally-switched-to-a-password-manager" href="https://kellssecurity.com/blog/why-i-finally-switched-to-a-password-manager">why I finally switched to a password manager</a>, and the honest answer is that I put it off for years for no good reason. It's the one tool on this list I'd tell anyone to install today, before any of the others.</p><h2>A VPN for the Networks I Don't Trust</h2><p>A VPN sits in second place, and I'll be upfront that I don't think it needs to run every single second the way a password manager does. What it does well is protect what I'm doing on networks I don't control, coffee shop wifi, hotel wifi, anywhere I'm connecting through infrastructure someone else owns and manages. I've written before about <a data-mce-href="https://kellssecurity.com/blog/why-i-run-a-vpn-on-every-device-i-own" href="https://kellssecurity.com/blog/why-i-run-a-vpn-on-every-device-i-own">why I run a VPN on every device I own</a>, and while my usage has settled into something less constant than that title suggests, the principle hasn't changed, it's still switched on automatically the moment I'm on a network I didn't set up myself. I use a VPN specifically because it's fast enough that I don't notice it running and it's simple enough that I never have an excuse to skip turning it on.</p><h2>Antivirus Software I Don't Think About</h2><p>This is the tool I actually think about least, which is exactly the point. Good antivirus software should run quietly in the background, catch the small percentage of threats that get past everything else, and never demand my attention unless something's genuinely wrong. I use <a data-mce-href="https://www.bitdefender.com/en-us/consumer/?irclickid=WxSzmdWRXxyZWsOzKNx6sWZFUkrxGHQpm0ekVY0&amp;im_rewards=&amp;irgwc=1&amp;afsrc=1&amp;MPid=6273270&amp;cid=aff|c|IR|Cyber%20Jay" href="https://www.bitdefender.com/en-us/consumer/?irclickid=WxSzmdWRXxyZWsOzKNx6sWZFUkrxGHQpm0ekVY0&amp;im_rewards=&amp;irgwc=1&amp;afsrc=1&amp;MPid=6273270&amp;cid=aff|c|IR|Cyber%20Jay" target="_blank" rel="noopener">security software </a>across my devices for this reason specifically, it's thorough without constantly interrupting me with upsells or false alarms, which was a real problem with software I'd used previously. I don't think antivirus software is the most important tool on this list, most of what actually puts people at risk is behavioural rather than something a scan catches, but it's a reasonable last line of defence for the malware and dodgy downloads that occasionally slip through despite everything else I do.</p><h2>Two-Factor Authentication on Everything That Matters</h2><p>This one is slightly different from the other three because it isn't a piece of software I installed once, it's a setting I turned on individually across every account that matters to me. I don't count it as optional anymore. A strong password from my password manager stops someone guessing their way in, but it does nothing if that password ever gets exposed somewhere I didn't expect, a breach on a site I'd forgotten about, a phishing page that caught me on a bad day. Two-factor authentication is what still holds the door shut even after the password itself has leaked. It costs nothing, takes a few minutes per account, and closes a gap that a password alone genuinely can't.</p><figure id="figure-cuaqownfymtdbww2h"><img id="cuaqownfymtdbww2h" src="https://rjdavx8ozyznxeyh.public.blob.vercel-storage.com/production/websites/infinite-images/8ccfa155-0813-4a10-b46b-0890ea0b2ef5-tVZh6z7WgdwQuZ7xEhw9F3mT3n0gHW.png" alt="Homeowner's hands holding house keys in warm, naturally-lit kitchen with visible signs of age and wear" title="Homeowner's hands holding house keys in warm, naturally-lit kitchen with visible signs of age and wear" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://rjdavx8ozyznxeyh.public.blob.vercel-storage.com/production/websites/infinite-images/8ccfa155-0813-4a10-b46b-0890ea0b2ef5-tVZh6z7WgdwQuZ7xEhw9F3mT3n0gHW.png" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>What I Deliberately Don't Bother With</h2><p>I want to be honest about what I've left off this list, because I think it says as much as what's on it. I don't run a separate firewall app, since the one built into my operating system does the job without me needing to manage it myself. I don't use ad blockers as a security measure, only as a convenience one, they're not designed to stop the kind of threats that actually cause damage. I've also tried a couple of all-in-one "security suite" products that bundled a weaker version of everything I've already listed into one subscription, and found I preferred using one good tool for each job rather than one mediocre tool for all of them at once. More apps isn't the same as more protection, and a cluttered phone full of security software I don't understand isn't a safer one.</p><p>What I'd genuinely recommend is starting with the password manager, since almost everything else on this list becomes easier once that's in place, then adding the rest one at a time rather than trying to overhaul everything in a single weekend. None of these four tools took more than a few minutes to set up individually, and together they cover the overwhelming majority of what actually goes wrong for people online. If you want the fuller version of what I've put in place, including step by step guidance on setting each of these up, I've pulled it together in a <a data-mce-href="https://kellssecurity.com/toolkit" href="https://kellssecurity.com/toolkit">free Safety Toolkit</a>, and the <a data-mce-href="https://www.ncsc.gov.uk" href="https://www.ncsc.gov.uk" target="_blank" rel="noopener" data-mce-selected="inline-boundary">NCSC </a>has clear guidance on choosing security software as well if you want a second, independent source to check any of this against.</p>

The Four Tools I Actually Rely On to Stay Safe Online

Door lock in golden sunlight with soft focus background. Dust motes drift through light beam.

<h2>The 2FA Excuses I Used to Make, and Why I Stopped Making Them</h2><p>For years I knew two-factor authentication was something I should turn on, and for years I didn't do it on most of my accounts. Not because I didn't understand what it did or how it worked, but because I had a running list of reasons it could wait until later. None of those reasons were actually good ones, and looking back, I can see exactly why I kept reaching for them instead of just spending the two minutes it takes to switch it on.</p><p><br></p><h2>It Takes Too Long</h2><p><br></p><p>My biggest excuse was time. I told myself that unlocking an app to grab a six-digit code every time I logged into an account was going to be more hassle than it was worth, especially for accounts I use daily without thinking. What actually happened once I turned it on was completely different from what I'd pictured. Most services only ask for that second step occasionally, not on every single login, and remember the device you're using for weeks at a time. Even when it does ask, it adds maybe five seconds to the process. I'd genuinely spent more time arguing with myself about whether to turn it on than I've spent entering codes in the months since I actually did it.</p><p><br></p><h2>My Password Is Already Strong Enough</h2><p><br></p><p>This excuse felt more reasonable to me at the time than the others. I'd already moved to <a data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener">a password manager</a> and had long, random, unique passwords on every important account, so I told myself the extra step of 2FA wasn't really necessary on top of that. What I hadn't accounted for was that a strong password only protects against someone guessing or cracking it directly. It does nothing at all if the password itself gets exposed somewhere I never expected, a data breach on a site I'd forgotten I even had an account with, a phishing page that caught me on a bad day, or malware quietly logging keystrokes on a device I trusted without question. Two-factor authentication is what still stops someone getting in even after the password itself has already leaked somewhere. I've written before about <a data-mce-href="https://kellssecurity.com/blog/why-my-email-login-gets-more-protection-than-any-other" href="https://kellssecurity.com/blog/why-my-email-login-gets-more-protection-than-any-other">why my email account gets more protection than any other</a> account I own, and turning on 2FA there specifically was the single step that mattered most, well beyond the password sitting underneath it.</p><p><br></p><h2>I'll Turn It On Eventually</h2><p><br></p><p>This was the excuse that did the most damage, because it let me put off a five-minute task indefinitely without ever quite admitting I was avoiding it. I told myself I'd get around to it properly once I had a free afternoon, once I'd researched the best authenticator app, once I'd worked out a backup plan for every account in case I lost my phone. None of that groundwork was actually necessary before starting. I could have turned on 2FA account by account, beginning with the one that mattered most, in about the time it takes to make a cup of tea. Waiting for the perfect, fully-planned moment to do it properly just meant I stayed unprotected the entire time I was waiting, which is exactly backwards from what I intended.</p><p><br></p><h2>Nobody's Actually Targeting Me</h2><p><br></p><p>I used to assume that account compromises were something that happened to other people, businesses, public figures, people with something obviously valuable attached to their name online. What changed my thinking was realising that most account takeovers aren't targeted at a specific person at all. They're automated. Someone runs a leaked password list against thousands of email addresses at once and simply sees what sticks, and it doesn't matter whether you're an interesting target or not, only whether your password happens to appear on that particular list. I don't need to be interesting to a scammer for this to matter to me. I just need to have an account, which every single one of us does, usually dozens of them.</p><p><br></p><h2>What Actually Changed My Mind</h2><p><br></p><p>The moment that finally got me moving wasn't a personal scare of my own, it was reading through account-compromise stories where the person had a strong, unique password and still lost access, because the attacker got in through a leaked credential dump or a hijacked session rather than by guessing anything at all. In every one of those stories, 2FA would have stopped the attack cold, right at the point where the stolen password alone should have been enough to get in. That's really what tipped it for me in the end. A strong password is the first lock on the door. Two-factor authentication is the second one that still holds even if someone else has gotten hold of a copy of the first key.</p><figure id="figure-brjd3glx9ymtdbazob"><img id="brjd3glx9ymtdbazob" src="https://rjdavx8ozyznxeyh.public.blob.vercel-storage.com/production/websites/infinite-images/ce5186d0-2ca4-4fb5-b55c-a8c6ceea0279-I9254iBsJR7SlnXhxulR6EAngyM9fr.png" alt="Brass house key on white marble with warm golden light and floating dust motes." title="Brass house key on white marble with warm golden light and floating dust motes." class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://rjdavx8ozyznxeyh.public.blob.vercel-storage.com/production/websites/infinite-images/ce5186d0-2ca4-4fb5-b55c-a8c6ceea0279-I9254iBsJR7SlnXhxulR6EAngyM9fr.png" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><p><br></p><p>Once I actually sat down and did it properly, the whole process across every account I cared about took less than half an hour, nowhere near the mental hurdle I'd built it up to be in my head over all those months of putting it off. If you're already storing your passwords in a password manager, most of them will generate and store your 2FA codes too, which removes even the small remaining friction of switching between separate apps to log in. If you want the fuller version of what I've put in place across every account I own, I've pulled it together in a <a data-mce-href="https://kellssecurity.com/toolkit" href="https://kellssecurity.com/toolkit">free Safety Toolkit</a>, and the <a data-mce-href="https://www.ncsc.gov.uk" href="https://www.ncsc.gov.uk" target="_blank" rel="noopener" data-mce-selected="inline-boundary">NCSC </a>has clear guidance on setting up two-factor authentication properly if you want the fuller technical detail.</p>

Blog

How I Decide Whether to Trust a New Online Shop Before I Buy

The Online Safety Tips I Actually Think Matter, and the O...

The Order I'd Actually Fix My Digital Security In, If I S...

What Actually Happens When You Report a Scam

The Four Tools I Actually Rely On to Stay Safe Online

The 2FA Excuses I Used to Make, and Why I Stopped Making ...