Blog

Door lock in golden sunlight with soft focus background. Dust motes drift through light beam.

<h2>The 2FA Excuses I Used to Make, and Why I Stopped Making Them</h2>For years I knew two-factor authentication was something I should turn on, and for years I didn't do it on most of my accounts. Not because I didn't understand what it did or how it worked, but because I had a running list of reasons it could wait until later. None of those reasons were actually good ones, and looking back, I can see exactly why I kept reaching for them instead of just spending the two minutes it takes to switch it on. <h2>It Takes Too Long</h2> My biggest excuse was time. I told myself that unlocking an app to grab a six-digit code every time I logged into an account was going to be more hassle than it was worth, especially for accounts I use daily without thinking. What actually happened once I turned it on was completely different from what I'd pictured. Most services only ask for that second step occasionally, not on every single login, and remember the device you're using for weeks at a time. Even when it does ask, it adds maybe five seconds to the process. I'd genuinely spent more time arguing with myself about whether to turn it on than I've spent entering codes in the months since I actually did it. <h2>My Password Is Already Strong Enough</h2> This excuse felt more reasonable to me at the time than the others. I'd already moved to <a data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener">a password manager</a> and had long, random, unique passwords on every important account, so I told myself the extra step of 2FA wasn't really necessary on top of that. What I hadn't accounted for was that a strong password only protects against someone guessing or cracking it directly. It does nothing at all if the password itself gets exposed somewhere I never expected, a data breach on a site I'd forgotten I even had an account with, a phishing page that caught me on a bad day, or malware quietly logging keystrokes on a device I trusted without question. Two-factor authentication is what still stops someone getting in even after the password itself has already leaked somewhere. I've written before about <a data-mce-href="https://kellssecurity.com/blog/why-my-email-login-gets-more-protection-than-any-other" href="https://kellssecurity.com/blog/why-my-email-login-gets-more-protection-than-any-other">why my email account gets more protection than any other</a> account I own, and turning on 2FA there specifically was the single step that mattered most, well beyond the password sitting underneath it. <h2>I'll Turn It On Eventually</h2> This was the excuse that did the most damage, because it let me put off a five-minute task indefinitely without ever quite admitting I was avoiding it. I told myself I'd get around to it properly once I had a free afternoon, once I'd researched the best authenticator app, once I'd worked out a backup plan for every account in case I lost my phone. None of that groundwork was actually necessary before starting. I could have turned on 2FA account by account, beginning with the one that mattered most, in about the time it takes to make a cup of tea. Waiting for the perfect, fully-planned moment to do it properly just meant I stayed unprotected the entire time I was waiting, which is exactly backwards from what I intended. <h2>Nobody's Actually Targeting Me</h2> I used to assume that account compromises were something that happened to other people, businesses, public figures, people with something obviously valuable attached to their name online. What changed my thinking was realising that most account takeovers aren't targeted at a specific person at all. They're automated. Someone runs a leaked password list against thousands of email addresses at once and simply sees what sticks, and it doesn't matter whether you're an interesting target or not, only whether your password happens to appear on that particular list. I don't need to be interesting to a scammer for this to matter to me. I just need to have an account, which every single one of us does, usually dozens of them. <h2>What Actually Changed My Mind</h2> The moment that finally got me moving wasn't a personal scare of my own, it was reading through account-compromise stories where the person had a strong, unique password and still lost access, because the attacker got in through a leaked credential dump or a hijacked session rather than by guessing anything at all. In every one of those stories, 2FA would have stopped the attack cold, right at the point where the stolen password alone should have been enough to get in. That's really what tipped it for me in the end. A strong password is the first lock on the door. Two-factor authentication is the second one that still holds even if someone else has gotten hold of a copy of the first key.<figure id="figure-brjd3glx9ymtdbazob"><img id="brjd3glx9ymtdbazob" src="https://rjdavx8ozyznxeyh.public.blob.vercel-storage.com/production/websites/infinite-images/ce5186d0-2ca4-4fb5-b55c-a8c6ceea0279-I9254iBsJR7SlnXhxulR6EAngyM9fr.png" alt="Brass house key on white marble with warm golden light and floating dust motes." title="Brass house key on white marble with warm golden light and floating dust motes." class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://rjdavx8ozyznxeyh.public.blob.vercel-storage.com/production/websites/infinite-images/ce5186d0-2ca4-4fb5-b55c-a8c6ceea0279-I9254iBsJR7SlnXhxulR6EAngyM9fr.png" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure> Once I actually sat down and did it properly, the whole process across every account I cared about took less than half an hour, nowhere near the mental hurdle I'd built it up to be in my head over all those months of putting it off. If you're already storing your passwords in a password manager, most of them will generate and store your 2FA codes too, which removes even the small remaining friction of switching between separate apps to log in. If you want the fuller version of what I've put in place across every account I own, I've pulled it together in a <a data-mce-href="https://kellssecurity.com/toolkit" href="https://kellssecurity.com/toolkit">free Safety Toolkit</a>, and the <a data-mce-href="https://www.ncsc.gov.uk" href="https://www.ncsc.gov.uk" target="_blank" rel="noopener" data-mce-selected="inline-boundary">NCSC </a>has clear guidance on setting up two-factor authentication properly if you want the fuller technical detail.

The 2FA Excuses I Used to Make, and Why I Stopped Making Them

Minimalist computer mouse with metallic accents on textured mousepad, studio-lit workspace detail.

<h2>The One Habit That Stops Me Falling for Phishing Emails</h2>I've read a lot of guides on spotting phishing emails, and most of them give you a long checklist. Check the sender address, look for spelling mistakes, check the urgency, check the links, check the attachments. It's good advice, but in the moment, standing in a queue with my phone in one hand and a coffee in the other, I'm not running through a five-point checklist. I've got one habit that catches almost everything, and I built the rest of my defences around it rather than trying to remember a list. <h2>Why I Stopped Trusting the Sender Name</h2> The sender name is the first thing most people look at, and it's also the easiest thing to fake. Any email client will display whatever name the sender wants next to the actual address, so "Royal Mail" or "HMRC" or your own bank's name can sit right above an address that has nothing to do with them. I used to glance at the display name and move on. Now I don't trust it at all, because it tells you what the sender wants you to believe, not who they actually are. That shift mattered more than anything else I changed. Once I stopped treating the display name as evidence, the rest of my approach got much simpler, because there was only one thing left worth checking properly. <h2>The One Thing I Check Before I Click Anything</h2> Before I click a link or open an attachment in any email that's asking me to do something, I check where the link actually goes. On a phone, that means holding the link down until a preview address pops up. On a laptop, it means hovering over it and reading the address that shows in the corner of the screen, not the text of the link itself. If the visible text says "royalmail.com" but the actual address is something like royalmail-redelivery.info or a string of random characters, that's the whole story right there. I don't need to check spelling or tone or urgency after that, because a mismatched link address is close to a guarantee. This one check does more work than any other single thing I do, because it doesn't depend on the email looking convincing or not. A well-written scam email with a mismatched link still fails the check. A badly-written genuine email still passes it. Everything else is secondary to this. <h2>What Convinced Me This Habit Actually Matters</h2> The moment this really landed for me was an email that looked, on every visible measure, completely genuine. Correct logo, correct tone, no spelling mistakes, referencing a real delivery I was actually expecting. If I'd been judging it on how convincing it looked, I'd have clicked without a second thought. But the link, when I checked it, went to a domain I didn't recognise at all, nothing close to the courier's actual site. That's when it clicked for me that the quality of a phishing email tells you almost nothing about whether it's real. The link does.<figure id="figure-anc1aiw9zhmtdaf681"><img id="anc1aiw9zhmtdaf681" src="https://rjdavx8ozyznxeyh.public.blob.vercel-storage.com/production/websites/infinite-images/8bcb0a6a-2f92-4699-b3f2-1a5d7f5af07b-2MFPsIFQSClmEEKpiGoL15qD9GpObm.png" alt="Overhead stacked financial documents with metallic pen, soft volumetric light creating long shadows, and dust motes dancing through organized layers." title="Overhead stacked financial documents with metallic pen, soft volumetric light creating long shadows, and dust motes dancing through organized layers." class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://rjdavx8ozyznxeyh.public.blob.vercel-storage.com/production/websites/infinite-images/8bcb0a6a-2f92-4699-b3f2-1a5d7f5af07b-2MFPsIFQSClmEEKpiGoL15qD9GpObm.png" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure> I've written before about <a data-mce-href="https://kellssecurity.com/blog/why-bad-grammar-doesnt-give-scam-messages-away" href="https://kellssecurity.com/blog/why-bad-grammar-doesnt-give-scam-messages-away">how bad grammar no longer gives these messages away</a>, and this is the other half of that same problem. As scam emails get better written, checking how something looks or reads becomes less and less reliable, and checking where it actually points becomes the thing that still works. <h2>The Other Habits I've Built Around It</h2> The link check is the core of it, but I've added a few smaller habits on top that catch the cases where a link check alone isn't enough. I never enter a password by following a link in an email, even if the link checks out, because I'd rather type the site's address in myself or use a saved bookmark. I look at whether the email is addressed to me by name or with something generic like "Dear Customer," since genuine companies I have accounts with almost always use my actual name. I also treat urgency as a signal to slow down rather than speed up, since "your account will be suspended in 24 hours" is doing exactly the job it's designed to do if it gets me clicking fast. I also use <a data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener">a password manager </a>for logins, since it simply will not offer to autofill my details on a lookalike site even if everything else about the email fooled me. None of these are complicated, and none of them require remembering a long list under pressure. They're small, specific checks that layer on top of the main one, rather than a separate system I have to run through every time. <h2>What I Do When I'm Not Sure</h2> Even with all of that, some emails still leave me genuinely uncertain, usually because the sender is a company I do actually deal with and the request isn't obviously outlandish. In those cases, I don't click anything in the email at all. I open a browser separately, go to the company's site directly, or call them using a number I already have on file, not one from the email itself, and ask them directly whether they sent it. It takes an extra two or three minutes, and it has never once been a wasted two or three minutes. That's really the whole approach. One habit that catches most things on its own, a few smaller habits that catch what it misses, and a fallback for the cases where I'm still not certain. If you want the fuller version of what I've put in place across every account, I've pulled it together in a <a data-mce-href="https://kellssecurity.com/toolkit" href="https://kellssecurity.com/toolkit">free Safety Toolkit</a>, and <a data-mce-href="https://www.actionfraud.police.uk" href="https://www.actionfraud.police.uk" target="_blank" rel="noopener" data-mce-selected="inline-boundary">Action Fraud </a>has clear guidance on reporting phishing attempts if you've had one land in your own inbox.

The One Habit That Stops Me Falling for Phishing Emails

Figure silhouetted against window in soft morning light, gazing outward in moment of quiet reflection and grounding

<h2>Why I Stopped Oversharing on Social Media</h2>For years I posted without thinking twice about it. Holiday photos while I was still away, the school my kids went to tagged in a dozen pictures, a running commentary on my daily routine that anyone could piece together in an afternoon. None of it felt risky in the moment because none of it felt like a secret. It's just what you post, isn't it. The shift for me wasn't a single bad experience. It was slowly realising that a stranger scrolling through my profile could build a surprisingly accurate picture of my life, my habits, and my family, without me ever handing it to them directly. <h2>What I Used to Post Without Thinking</h2> My old habit was simple. If something happened, I posted about it, usually in real time. A weekend away, a new car, a work trip, my daughter's first day at a new school. I liked the connection it gave me with friends and family who weren't nearby, and I still think that part of it is genuinely valuable. What I didn't think about was how much of that content, added together over months, formed a detailed pattern. Anyone could have worked out roughly when my house was empty, which school my children attended, what car I drove and therefore what it was worth, and who was in my immediate circle. None of that felt sensitive individually. A single holiday photo isn't a security risk on its own. The problem was the accumulation, and I wasn't thinking in those terms at all. <h2>What That Information Actually Adds Up To</h2> The specific thing that changed my thinking was reading about how scammers use publicly available information to make fraudulent approaches feel personal and convincing. A message that references your actual holiday dates, your child's actual school, or the name of a relative you've tagged before doesn't read as a generic scam. It reads as something only someone who knows you could have sent, which makes people far more likely to lower their guard. I've written before about a voice clone call that nearly caught me out, and the unsettling part wasn't the cloned voice itself. It was how a scammer could combine a few seconds of publicly posted audio with details lifted from social profiles to build something convincing enough to fool someone who wasn't expecting it. Social media doesn't need to be hacked for this to work. Public information, freely posted, is often enough on its own. <h2>The Specific Things I Stopped Sharing</h2> I didn't delete my accounts or stop posting altogether, because that felt like an overcorrection I wasn't prepared to make. What I changed was more specific. I stopped posting about travel while I was still away, and now wait until I'm back home before sharing anything. I stopped tagging my children's school by name, even in posts that felt otherwise harmless. I got more careful about geotagging, since a location tag on a photo taken at home effectively confirms an address to anyone looking. I also went back through older posts and removed a few that, on reflection, gave away more than I'd intended, a work ID badge visible in a photo, a house number caught in the background of a picture I'd forgotten about. None of it was catastrophic individually, but together it was more than I was comfortable having permanently public.<figure id="figure-0p25ygvd5mtd9tzjo"><img id="0p25ygvd5mtd9tzjo" src="https://rjdavx8ozyznxeyh.public.blob.vercel-storage.com/production/websites/infinite-images/2c7c67e6-da92-4ef0-8ec7-465387a194a4-ThFJoF72OPPG8Ey4r6gZjJKW4UsFv8.png" alt="Hands gently turning pages of a vintage family photograph album with soft natural light creating a contemplative, peaceful mood." title="Hands gently turning pages of a vintage family photograph album with soft natural light creating a contemplative, peaceful mood." class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionX="undefined" data-positionY="undefined" data-fullWidth="false"/></figure><h2>How I Handle Privacy Settings Now</h2> Beyond what I post, I changed who could see it. I moved my main accounts to a more restricted audience rather than fully public, and I went through my friends and followers lists to remove accounts I no longer recognised or had any real connection to. It's an uncomfortable thing to do, culling a list you built up over years, but a follower list full of people you can't actually vouch for isn't really privacy at all. I also locked down the account itself the same way I treat anything else that matters, with a strong unique password kept in a password manager rather than something reused from another site, and two-factor authentication turned on wherever the platform offers it. A social account is still a login like any other, and losing access to it can be just as disruptive as losing access to email or banking. <h2>What I Still Post, and Why That's Fine</h2> I want to be clear that this isn't an argument for disappearing from social media entirely. I still post plenty, and I still enjoy the connection it gives me with people I don't see often enough. What changed is the timing and the specifics, not the overall willingness to share. Holidays get posted once I'm home. Family milestones get shared without naming exact schools or routines. Photos get a quick check for background details before they go up, not an anxious audit, just a habit that takes a few seconds. That's really the whole shift. I didn't need to become paranoid about social media to close the gap I'd been ignoring. I needed to notice that the same basic checks I use for suspicious messages apply just as well to what I choose to post myself, since the goal in both directions is the same: don't hand a stranger more than they need. If you want the fuller version of what I've put in place, I've pulled it together in a free Safety Toolkit, and the NCSC has clear guidance on protecting your personal information online too.

Why I Stopped Oversharing on Social Media

Dramatic spotlight cone illuminating brick wall with swirling dust and theatrical shadows

<h2>Why My Email Login Gets More Protection Than Any Other</h2>If I had to rank every account I own by how much damage its loss would cause, email wouldn't just be near the top. It would be first, by a distance. Not because my inbox is full of anything dramatic, but because almost every other account I have is tied back to it. Forget your banking password and the reset link goes to your email. Lose access to a shopping account, a social media profile, a subscription service, and the recovery path almost always runs through the same inbox. Email isn't just one account among many. It's the key that unlocks most of the others, which is exactly why I stopped treating it the same way I treat everything else. <h2>Why My Email Account Matters More Than People Think</h2> I used to think about account security account by account, as if each one existed in its own little box. A strong password here, a different one there, maybe a bit of extra care on the banking app. What I hadn't fully absorbed was that my email account sat underneath all of it, quietly holding the master key. If someone got into my email, they wouldn't need to guess my other passwords one at a time. They could just request a reset on each service in turn and let my inbox hand them the access directly. That realisation changed how I prioritise my own security effort. It's not that every account deserves equal attention, because they genuinely don't carry equal risk. Email deserves more scrutiny than almost anything else I log into, precisely because it's the one account that can unravel all the others if it fails. <h2>What Actually Happens When Email Gets Compromised</h2> I've read enough accounts of email compromises to know the pattern tends to follow a similar shape. Someone gets into the inbox, often through a reused or guessed password, and the first thing they do isn't send obvious spam. They quietly search the inbox for anything useful, old password reset emails, account confirmations, financial statements, then start working through other services one by one, requesting resets and locking the real owner out as they go. What makes this worse is how long it can take someone to even notice. If a scammer is careful, they'll set up a forwarding rule so copies of anything interesting get sent elsewhere without deleting the originals, meaning the account owner sees nothing unusual for weeks. By the time the pattern becomes obvious, several other accounts may already be compromised too. That chain reaction is the specific thing I've built my own habits around preventing.<figure id="figure-nlo3fhnytymtd50f96"><img id="nlo3fhnytymtd50f96" src="https://rjdavx8ozyznxeyh.public.blob.vercel-storage.com/production/websites/infinite-images/4606ed90-0f13-4d0a-9797-19f1d4687fc0-mwZFjLx11rwE3gv7mc37ADyIWUWeSQ.png" alt="Luminescent golden and teal data threads flowing through darkness with bokeh effects, representing seamless data flow and intelligent automation." title="Luminescent golden and teal data threads flowing through darkness with bokeh effects, representing seamless data flow and intelligent automation." class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://rjdavx8ozyznxeyh.public.blob.vercel-storage.com/production/websites/infinite-images/4606ed90-0f13-4d0a-9797-19f1d4687fc0-mwZFjLx11rwE3gv7mc37ADyIWUWeSQ.png" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure> <h2>The Specific Things I've Done to Lock Mine Down</h2> The first and most obvious step was making sure my email password is nothing like any other password I use, generated randomly rather than something I've adapted from a phrase I like, and stored in <a data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener">a password manager</a> rather than somewhere I'd have to remember it. I've written before about <a data-mce-href="https://kellssecurity.com/blog/why-i-finally-switched-to-a-password-manager" href="https://kellssecurity.com/blog/why-i-finally-switched-to-a-password-manager">why I finally switched to a password manager</a>, and email was the account that made the decision feel non-negotiable rather than just sensible. Two-factor authentication was the second piece, and I treat it as essential on email specifically even in cases where I've been lazier about turning it on elsewhere. An extra prompt or code on login means a stolen password alone isn't enough to get in, which closes off the most common way these compromises actually start. I also went through and removed any old, half-forgotten devices and apps that still had access to my account from years ago, since each one is a door I'd stopped watching. <h2>The Recovery Options I Had to Rethink</h2> The part I'd genuinely overlooked for years was my own account recovery settings. I had an old recovery phone number attached to my email that I hadn't used in ages, and a recovery email address that was, awkwardly, another account tied to the same provider. If one had ever been compromised, the other would have gone down with it. I updated both to something current and genuinely separate, a different provider entirely for the backup email, so a single point of failure couldn't take out my recovery options along with the main account. I also checked what happens if I lose access to my phone specifically, since that's where most of my two-factor codes land. Having backup codes saved somewhere safe, not in the same inbox they're meant to protect, closes a gap that's easy to miss until the moment you actually need it and realise your safety net was inside the thing that just locked you out. <h2>What I'd Tell Someone Setting This Up for the First Time</h2> If someone asked me where to start, I wouldn't tell them to audit every account they own in one sitting, because that's exactly the kind of advice that gets nodded at and then never actioned. I'd tell them to start with email specifically, get a strong unique password on it through a password manager, turn on two-factor authentication, and check that the recovery options actually point somewhere current and separate. That's maybe twenty minutes of work, and it does more to protect everything else you own online than almost any other single change available to you. Once that's done, the rest of your accounts become far less catastrophic to lose individually, because the one account that could cascade into all of them is finally locked down properly. I still keep an eye on <a data-mce-href="https://kellssecurity.com/blog/the-simple-checks-i-use-to-stop-ai-scams" href="https://kellssecurity.com/blog/the-simple-checks-i-use-to-stop-ai-scams">the checks I use to catch AI-driven scams</a> for the messages that try to get me to hand over access directly, but the account-level protection is what stops a single mistake from spreading everywhere else. If you want the fuller version of what I've put in place, I've pulled it together in a <a data-mce-href="https://kellssecurity.com/toolkit" href="https://kellssecurity.com/toolkit">free Safety Toolkit</a>, and the <a data-mce-href="https://www.ncsc.gov.uk" href="https://www.ncsc.gov.uk" target="_blank" rel="noopener" data-mce-selected="inline-boundary">NCSC </a>has solid guidance on email account security too if you want the fuller technical detail.

Why My Email Login Gets More Protection Than Any Other

Overhead layered acrylic sheets with neon teal and purple tones, metallic accents, and light rays.

<h2>What I Used to Tell People About Staying Safe Online, and What I Say Now</h2>For years I gave more or less the same advice to anyone who asked how to stay safe online. Use a strong password, look for the padlock icon in the browser bar, don't click links from people you don't know, keep your software updated. It was solid advice, it was easy to remember, and I genuinely believed it covered most of what mattered. I've since changed almost all of it, not because it was wrong exactly, but because the threats it was built to answer have mostly moved on. I still get asked the same question constantly, usually some version of "what's the one thing I should actually do." I used to have a tidy answer. I don't anymore, and I think that's worth explaining rather than pretending I still have a neat list. <h2>What I Used to Tell People</h2> The old advice was built around spotting things. Spot the fake email by its bad spelling. Spot the fake website by the missing padlock. Spot the scam call by the pushy tone. It worked because for a long time, scams genuinely did look different from the real thing if you knew where to look. A phishing email in 2015 was often clumsy enough that a careful reader had a real chance of catching it on sight. That advice made people feel capable. You didn't need to understand how any of it worked technically, you just needed to notice a few tells, and I could teach those tells in five minutes. It was good advice for the threats of its time, and I don't think it was wrong to give it then. <h2>Why That Advice Stopped Being Enough</h2> The tells mostly aren't there anymore. Scam messages are now written using the same AI tools everyone else uses, which means the spelling is fine, the tone is professional, and the branding is often lifted directly from the real company's own emails. A fake banking site can be an almost perfect copy of the real one, padlock icon included, because getting a padlock is just a matter of installing a free certificate, not a mark of legitimacy anymore. Voice cloning has done something similar to phone scams. The tell used to be that the voice sounded slightly off, or the story didn't quite add up. Now a scammer can clone a few seconds of someone's voice from a video posted online and use it to fake a distressed phone call, which removes the one signal a lot of people were leaning on without realising it. None of this means the old advice is actively harmful. Strong passwords still matter. Updated software still matters. But treating those as the finish line rather than the starting point leaves a gap that's much bigger than it used to be, and I was underselling that gap for longer than I'd like to admit. <h2>What Changed My Approach</h2> The shift for me happened gradually, through writing about specific incidents rather than through any single moment. I've covered<a data-mce-href="https://kellssecurity.com/blog/voice-clone-scam-call-liverpool" href="https://kellssecurity.com/blog/voice-clone-scam-call-liverpool"> a voice clone call that nearly caught me ou</a>t, and it's a strange thing to sit with the fact that a technique like that is no longer rare or expensive to pull off. I've also written about why bad grammar doesn't give scam messages away anymore, which is really the same underlying shift applied to text instead of speech.<figure id="figure-vgidswpjvimtd4h2xd"><img id="vgidswpjvimtd4h2xd" src="https://rjdavx8ozyznxeyh.public.blob.vercel-storage.com/production/websites/infinite-images/e1df7e91-7c7d-4482-9ae2-91522d9081ed-svl6xp1lVPC1y0EvyHILiXobJw7xCv.png" alt="Layered translucent glass with geometric patterns, golden light rays, warm glowing bokeh effect." title="Layered translucent glass with geometric patterns, golden light rays, warm glowing bokeh effect." class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionX="undefined" data-positionY="undefined" data-fullWidth="false"/></figure> What connects all of it is that the old checklist assumed a scammer's effort was the limiting factor. Bad actors used to be constrained by time, language skill, or technical knowledge, and the tells were really just symptoms of those constraints. AI tools removed most of those constraints, so the tells disappeared along with them. That's the part I had to rebuild my thinking around, not just the specific list of do's and don'ts. <h2>What I Actually Tell People Now</h2> These days my advice is less about spotting fakes and more about verifying independently. If a message or call asks you to act, urgently or otherwise, the useful question isn't whether it looks convincing. It's whether you can confirm the claim through a channel you chose yourself, rather than one the message handed you. Open the banking app directly instead of clicking the link. Call the number on the back of your card instead of the one in the text. Ring the family member back on their usual number instead of trusting the voice on an unexpected call. I also tell people to put a small number of things on autopilot rather than relying on vigilance for everything, because vigilance runs out by the end of a long day and scammers know that. A <a data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener">password manager</a> removes the temptation to reuse passwords without you having to think about it each time.<a data-mce-href="https://kellssecurity.com/blog/why-i-run-a-vpn-on-every-device-i-own" href="https://kellssecurity.com/blog/why-i-run-a-vpn-on-every-device-i-own"> I run a VPN on every device I ow</a>n by default, not because I'm doing anything sensitive most of the time, but because it means I don't have to judge every network I connect to. Decisions you've already made ahead of time hold up better than judgement calls made in the moment a message arrives. <h2>The One Thing That Hasn't Changed</h2> If there's a piece of the old advice that's held up completely, it's this: nobody legitimate needs you to do something urgent right now through a channel they chose for you. That was true when the tell was bad spelling, and it's still true now that the spelling is perfect. Everything else I tell people has had to evolve as the threats got more convincing, but that one instinct, slow down and verify independently, has done more work for me than any specific checklist ever did. I'd still rather someone walked away from this with one good instinct than a list of ten rules they'll half remember. If you want the fuller version of what I actually put in place day to day, I've pulled it together in a <a data-mce-href="https://kellssecurity.com/toolkit" href="https://kellssecurity.com/toolkit">free Safety Toolkit</a>. And if something does slip through, <a data-mce-href="https://www.actionfraud.police.uk" href="https://www.actionfraud.police.uk" target="_blank" rel="noopener">Action Fraud</a> is the right place to report it in the UK.

What I Used to Tell People About Staying Safe Online

Close-up circuit board patterns with glowing neon blue lines and bokeh lights, dark moody cybersecurity aesthetic.

<h2>Why Bad Grammar Doesn't Give Scam Messages Away Anymore</h2>For years I had one rule of thumb that rarely let me down. If a message was full of clumsy grammar, strange phrasing, or a greeting like "Dear Valued Customer" from a company that supposedly had my name on file, I binned it without a second thought. Bad writing was practically a watermark for a scam. I passed that advice on to family members too, telling them the typos were the giveaway, the thing that would always save them if nothing else did. I don't give that advice anymore, because it stopped being reliable somewhere in the last couple of years, and I think a lot of people are still relying on a rule that quietly stopped working. <h2>What Changed Once Scammers Started Using AI Properly</h2> The shift is simple enough once you say it out loud. Writing convincing English used to be the hard part of running a scam at scale, especially for operations working from scripts translated badly from another language. AI writing tools removed that bottleneck almost overnight. A scammer with no particular skill in English can now generate a message that reads as smoothly as anything a legitimate company would send, complete with correct grammar, natural phrasing, and a tone that matches whatever brand it's impersonating. That means the entire category of scam that used to announce itself through broken English has largely vanished, or at least stopped being something you can count on spotting. The messages that get through now are fluent, professional, and often genuinely well written. Polish used to be evidence of legitimacy. It isn't anymore, and treating it that way is exactly how people get caught out. <h2>The Message That Actually Caught Me Out</h2> I got a text a while back that I genuinely hesitated over, which almost never happens to me anymore given how much of this I read about for work. It claimed to be from my bank, referenced a recent transaction in a way that felt specific rather than generic, and asked me to confirm my details through a link because of "unusual account activity." The English was flawless. There was no urgency-in-capital-letters, no missing punctuation, nothing that matched the old checklist I used to rely on.<figure id="figure-brfk2msfnmtd3h30f"><img id="brfk2msfnmtd3h30f" src="https://rjdavx8ozyznxeyh.public.blob.vercel-storage.com/production/websites/infinite-images/d0b9652b-d6e4-4e38-9c1a-9f7ec6c92969-OfhHzOkLgN56bt96Lo1yqXx3p4f0vr.png" alt="Glowing blue and cyan light streams flowing through dark space with golden bokeh, abstract digital data visualization with depth." title="Glowing blue and cyan light streams flowing through dark space with golden bokeh, abstract digital data visualization with depth." class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionX="undefined" data-positionY="undefined" data-fullWidth="false"/></figure> What actually stopped me wasn't the writing at all. It was that I hadn't made any transaction resembling the one it referenced, and that my bank has never once, in years of banking with them, asked me to confirm details through a text link. I closed the message, opened my banking app separately, and confirmed nothing was wrong. If I'd been judging it purely on how well it was written, I'd have had no reason to doubt it at all. <h2>What I Actually Look For Instead Now</h2> Since writing quality stopped being a useful signal, I've had to rebuild the checklist around things that are harder for a scammer to fake convincingly, AI or not. The biggest one is whether the message is asking me to act somewhere other than the official channel I already use, a link in a text rather than logging into the app directly, a phone number in the message rather than the one printed on my card. Genuine organisations very rarely need you to do anything urgent through a link they've just sent you. I also pay attention to whether the specific detail in the message actually checks out, not just whether it sounds specific. A scam text can reference "your recent order" convincingly without referencing an order that exists. It costs nothing to open the relevant app or account directly and see whether anything matches, and that single step catches far more than reading the prose carefully ever did. Urgency is still a useful signal, but I look for it in the structure of the request rather than the tone of the sentence. A message that wants a decision made immediately, with a specific narrow action like clicking one link or calling one number right now, is behaving the way a scam behaves regardless of how well it's phrased. I've written before about the checks I use to catch AI-driven scams more broadly, and this fits into the same habit of judging the request rather than the writing. <h2>The Habit That Matters More Than Spotting Bad Writing</h2> If there's one adjustment I'd want everyone to make, it's this. Stop using writing quality as a filter at all, in either direction. A badly written message isn't automatically fake, and a beautifully written one isn't automatically real. The writing tells you almost nothing useful now. What tells you something is whether the request matches how the real organisation actually operates, and whether you can verify the claim independently rather than through the channel the message itself provided. That's a slower habit than scanning for typos, and it asks a bit more of people than the old rule did. But the old rule is broken, and pretending it still works is worse than admitting it and building something sturdier in its place. I'd rather take the extra thirty seconds to check an account directly than trust a message just because it reads well, because reading well has stopped meaning anything at all. If you want a fuller rundown of the other basics I'd put in place alongside this, I've pulled them together in a free Safety Toolkit. It's also worth knowing what a real phishing email actually looks like line by line, so you know what you're comparing a suspicious message against. And if you do get caught out, Action Fraud is the place to report it in the UK.

Blog

The 2FA Excuses I Used to Make, and Why I Stopped Making ...

The One Habit That Stops Me Falling for Phishing Emails

Why I Stopped Oversharing on Social Media

Why My Email Login Gets More Protection Than Any Other

What I Used to Tell People About Staying Safe Online

Why Bad Grammar Doesn't Give Scam Messages Away