Blog

<p>Scams have always been a numbers game, but the ones landing in my inbox right now are sharper than anything from a couple of years back. AI tools have made it cheap and easy for criminals to write convincing messages, clone voices, and build fake websites that look identical to the real thing. The volume hasn't dropped either, it's just got harder to spot the fakes among everything else competing for your attention.</p><p>I hear about new scams from clients and readers most weeks, and while the underlying ideas rarely change, the execution keeps getting sharper. So I want to walk through what I'm actually seeing land right now, why it's catching people who'd normally spot a scam a mile off, and the handful of habits that still work regardless of how convincing the fake has become.</p><h2>The Three Scam Types I'm Seeing the Most Right Now</h2><p>Right now the ones cropping up again and again are delivery scams, a fake missed parcel text with a link to pay a small redelivery fee, impersonation scams, someone posing as your bank, HMRC, or even a family member in trouble, and investment scams promising unrealistic returns, often pushed through social media ads or direct messages. None of these are new ideas, but the execution has got noticeably slicker, and the targeting has got more personal, sometimes referencing a detail a stranger shouldn't have any way of knowing, like the name of a courier you've genuinely used before or a family member's actual first name pulled from a public profile.</p><h2>Why AI Has Changed the Playing Field</h2><p>The gap between a lazy, obviously-fake scam and a genuinely convincing one used to take real skill and time to close. AI has collapsed that gap almost completely. A scammer can now generate a passable impersonation of your bank's tone of voice, or a voice clone of someone you know, in minutes rather than days. I've covered <a href="https://kellssecurity.com/blog/the-cybersecurity-trends-im-actually-seeing-right-now" data-mce-href="https://kellssecurity.com/blog/the-cybersecurity-trends-im-actually-seeing-right-now">the fuller picture of how AI is changing things on both sides of this fight</a> if you want to go deeper into it, but the short version is that the old advice about spotting clumsy wording or broken logos matters far less than it used to. I've had messages read out to me by clients that I genuinely couldn't have called fake from the wording alone, and the only reliable tell left was where the link actually pointed.</p><h2>Nobody Is Too Careful to Be a Target Anymore</h2><p>There's a lingering assumption that scams mostly catch out older, less tech savvy people. That's out of date, and I say this as someone who talks to a wide range of people about it every week. I've seen students lose money to fake job offers that asked for an upfront "training fee," young professionals caught out by convincing "your account has been compromised" texts that mimicked their bank's exact template, and small business owners targeted by invoice fraud that looked exactly like a message from a real, existing supplier. Anyone with an email address and a phone is a target now, regardless of age or how careful they think they are. If anything, the people who assume they're too switched on to be caught are sometimes the easiest targets, because that confidence makes them less likely to pause and check.</p><h2>The Habits That Still Work Even as the Scams Get Slicker</h2><p>The advice hasn't really changed even though the scams have. Slow down before clicking anything that feels urgent, that pressure is almost always manufactured. Verify unexpected requests for money or information through a separate channel, call the company back on a number you already know and trust, never reply to the text or email itself. Keep your accounts protected with two factor authentication everywhere it's offered, and a proper password manager like <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass </a>so a single leaked password can't cascade into every account you own. If you're regularly on public wifi, a service like <a href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" target="_blank" rel="noopener" data-mce-href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902">NordVPN </a>adds a genuinely useful extra layer between you and anyone else on that network. None of these habits are complicated or expensive, which is exactly why I keep repeating them, they work quietly in the background rather than requiring constant vigilance.</p><h2>What I Do the Moment I Spot One</h2><p>If I come across a scam, whether it's aimed at me directly or I just spot one doing the rounds among people I know, I report it. <a href="https://www.actionfraud.police.uk/" target="_blank" rel="noopener" data-mce-href="https://www.actionfraud.police.uk/">Action Fraud</a> is the place to do that in the UK, and it genuinely helps build the wider picture that stops the next wave from landing in someone else's inbox. Most email providers also have a dedicated report button that feeds straight into their own filtering, so it's worth using both rather than just deleting and moving on. It costs a minute of your time and it means the next version of that same scam has a slightly harder job landing in someone else's inbox unnoticed.</p><h2>Building the Habit That Keeps You Ahead</h2><p>None of this requires becoming paranoid or treating every message as a threat. It just means building the pause into your routine before you act on anything urgent, and keeping the basics like two factor authentication and a password manager switched on so a single mistake doesn't cascade into something worse. If you want a second opinion on anything that's landed in your inbox looking dodgy, my free <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">Safety Toolkit</a> has the tools I recommend and use myself, and you're always welcome to get in touch with me directly if something feels off.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

What's Actually New in Scams Right Now

<p>I get asked about phishing emails more than almost anything else I deal with. Everyone's heard of them by now, but the myths around what they actually look like and who they actually target are still doing a lot of damage, and they're the reason so many otherwise careful people end up caught out. So let's clear a few of them up properly. I've pulled every check together in one guide on <a href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything" data-mce-href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything">how to identify a phishing email</a>, if you want the full version.</p><p>Every one of these myths made sense once. The trouble is the scams moved on years ago and a lot of the advice floating around never caught up with them. I want to go through the ones I hear most often, why each one is more dangerous than it sounds, and the one question I actually ask myself now instead of ticking off a checklist.</p><h2>The Myth That Phishing Emails Are Badly Written</h2><p>That was true a decade ago. These days the scam emails landing in inboxes are polished, on brand, and often better formatted than the genuine emails they're copying. I've seen fake delivery company and bank messages that used the correct fonts and logos down to the pixel, right along with a footer that matches and an unsubscribe link that even works. Spelling mistakes are a nice bonus clue when you happen to get them, but you cannot rely on their absence to mean an email is safe anymore. What actually gives a phishing email away is the sender's domain, the urgency baked into the subject line, and a link that doesn't quite match where it claims to go. I go through <a href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything" data-mce-href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything">the red flags I always check first</a> in a lot more detail if you want the full checklist rather than just this one myth.</p><h2>The Myth That Only Older People Fall For This</h2><p>I wish this one was true, because it would make my job a lot easier. In reality I see just as many students and young professionals get caught out, usually because they're moving fast on a phone between apps and don't give a message a second look before tapping it. Scammers know this, which is part of why so many phishing attempts now arrive as texts and app notifications rather than plain emails sitting in an inbox. Confidence with technology doesn't protect you from a message specifically designed to make you panic first and think second. If anything, I've noticed the newer wave of AI-written scams and deepfake voice notes hits younger people just as hard, simply because that's where they spend most of their time and attention.</p><h2>The Myth That My Email Provider Catches Everything</h2><p>Spam filters are genuinely good these days, and they do stop a huge volume of junk before it ever reaches you. But treating your inbox filter as a complete security system is where people come unstuck. New scam domains get registered every single day, faster than any filter can realistically catalogue them, so a fresh phishing campaign will often slip through in its first few hours simply because nothing has flagged it as suspicious yet. A password manager like <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass </a>helps here too, because it won't autofill your login details on a lookalike site even if the email itself gets past your filter completely. That mismatch, where your saved login just doesn't appear, is often the first real sign something's wrong.</p><h2>The Myth That I'm Safe As Long As I Don't Click Anything</h2><p>Mostly true, and it's still the best rule of thumb I can give anyone in a hurry. But it's not quite the full picture. Some phishing emails use tracking pixels that confirm your address is active the moment you open them, even without a click anywhere in the message, and that alone is enough to get you added to a list for the next wave of attempts. It's a good reason to turn on two factor authentication on your main accounts regardless, so that even if a password does leak somewhere down the line, it isn't enough on its own to get anyone into your account. Belt and braces, as my old boss used to say, and it costs you nothing once it's set up.</p><h2>The One Question I Ask Instead of Chasing Red Flags</h2><p>Forget trying to spot bad grammar or a slightly-off logo. I ask myself one question with every unexpected email: would this organisation actually contact me this way, about this, right now? A bank will never ask you to confirm your password by email. A delivery company won't threaten to bin your parcel in six hours flat. Once you start asking that question automatically, most phishing emails fall apart in about two seconds flat, no checklist required. If you're ever unsure, report it to <a href="https://www.actionfraud.police.uk/" target="_blank" rel="noopener" data-mce-href="https://www.actionfraud.police.uk/">Action Fraud </a>rather than just deleting it and moving on, since that helps build the wider picture that stops the next wave landing in someone else's inbox too.</p><h2>Where This Leaves You</h2><p>None of these myths are stupid to believe, they're just out of date, and the scams have quietly moved on while the old advice stayed still. If you want a proper walkthrough of every safeguard I recommend in one place, my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">Safety Toolkit </a>covers all of it in plain English, free to browse any time. And if a message ever lands in your inbox that you're genuinely not sure about, <a href="https://kellssecurity.com/contact" data-mce-href="https://kellssecurity.com/contact">get in touch</a> with me directly and I'm always happy to take a look.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The Phishing Myths I Still Hear All the Time

<p>People ask me for a shortlist all the time. Something they can actually stick to, not a fifty-point checklist that gets skimmed once and then forgotten. So here's the handful of things I genuinely tell friends, family, and clients to do, roughly in the order I'd tackle them if I were starting from nothing today.</p><p>None of this is complicated or expensive, and it's not exhaustive either, there are entire books written on this subject. But get these six things properly in place and you'll be ahead of most people online, and ahead of what the overwhelming majority of scams and attacks are actually built to catch. I'd genuinely rather someone did these six things well than half-heartedly attempt every tip on a much longer list and abandon it by February.</p><h2>Get a Password Manager Before You Do Anything Else</h2><p>Everything else on this list assumes you're not reusing the same password across a dozen accounts, and a password manager is what actually fixes that in an afternoon rather than a New Year's resolution that never happens. I use <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass</a> myself, mainly because it won't autofill your login on a lookalike site even if a phishing email gets past your filter, which has caught me out at least once. Once it's set up, every account gets its own long, random password and you never have to remember or type one again. This single change closes off the single biggest way accounts actually get compromised: one leaked password reused somewhere else.</p><h2>Turn On Two-Factor Authentication Everywhere It's Offered</h2><p>A password manager fixes weak and reused passwords. Two-factor authentication is the backstop for the day a password leaks anyway, through a data breach you had nothing to do with, or a moment your judgement slips on a convincing fake. It takes minutes to set up on each account and it stops almost every automated account takeover attempt cold, even when the attacker already has your correct password in hand. If an app offers an authenticator-based option rather than a text message code, take it, it's meaningfully harder to intercept.</p><h2>Slow Down Before You Click Anything That Feels Urgent</h2><p>Urgency is the one ingredient every convincing scam has in common, a locked account, a missed delivery, a payment that needs confirming within the hour. It's designed to make you react before you think, and it works on careful, switched-on people just as often as anyone else. I've gone through <a href="https://kellssecurity.com/blog/the-phishing-myths-i-still-hear-all-the-time" data-mce-href="https://kellssecurity.com/blog/the-phishing-myths-i-still-hear-all-the-time">the specific phishing myths I still hear all the time</a> in more detail elsewhere, but the short version is this: whatever the message claims is urgent, it can wait the thirty seconds it takes you to check it properly, through a channel you already trust rather than the one it handed you.</p><h2>Keep Everything Updated, Even When It's Annoying</h2><p>Software updates exist largely to patch security holes that have already been found and are already being exploited somewhere. Delaying an update because the prompt is inconvenient right now leaves that door open for exactly as long as you put it off. I set most of my own devices to update automatically overnight so I never have to think about it, and I'd genuinely recommend doing the same rather than relying on remembering to do it manually.</p><h2>Back Up Anything You'd Be Gutted to Lose</h2><p>This one isn't really about scams at all, it's about ransomware, a dead phone, a stolen laptop, or just an update that goes badly wrong. A proper backup, ideally an automatic one that runs somewhere other than the device itself, turns any of those from a genuine disaster into an afternoon's inconvenience. Photos, documents, anything you'd actually notice losing, cloud storage or an external drive both work, the important part is that it happens automatically rather than depending on you remembering to do it manually every few months.</p><h2>Know Where to Report It When Something Slips Through</h2><p>Even doing everything right, something will eventually get through, an unusually good fake, a moment of distraction, bad luck. What matters then is knowing what to do next rather than just feeling embarrassed and moving on. In the UK that's <a href="https://www.actionfraud.police.uk/" target="_blank" rel="noopener" data-mce-href="https://www.actionfraud.police.uk/">Action Fraud</a>, and reporting genuinely helps, it feeds into the intelligence that gets the next version of that same scam caught before it reaches someone else. It costs a couple of minutes and it means the mistake wasn't wasted.</p><h2>Why This Shortlist Works</h2><p>None of this requires becoming paranoid or treating every message as a threat. It's six habits, most of which you set up once and then barely think about again, that together cover the vast majority of how people actually get caught out, from the accounts a scammer might target to the device itself failing on an ordinary Tuesday. If you want the fuller version of everything I recommend, my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">Safety Toolkit</a> has the tools and settings I use myself, free to browse any time. And if you're ever unsure about something that's landed in your inbox, <a href="https://kellssecurity.com/contact" data-mce-href="https://kellssecurity.com/contact">get in touch</a> with me directly, I'm always happy to take a look.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The Shortlist I Give People Who Ask How to Stay Safe

<p>Social media is where most of the scams and impersonation attempts I hear about actually start now, more than email most weeks. It's not because the platforms are badly built, it's because that's where everyone already is, friends, family, strangers, and the people trying to take advantage of all three. Here's what I actually tell people when they ask me how to use it without becoming an easy target.</p><p>None of this means deleting your accounts or treating every message as a threat. It means knowing which few things are actually worth locking down, and not wasting energy on the rest.</p><h2>The Friend Request That Isn't Your Friend</h2><p>Cloned profiles are the one I get asked about most. Someone copies a real person's profile picture, name, and public photos, builds a near-identical account, and sends friend requests to that person's actual friends list. Once you've accepted, the message usually follows within a day or two, an emergency, a gift card, a "can you lend me this until Monday". The photos and mutual friends make it convincing at a glance, especially now that AI makes it trivial to generate a full set of fake images rather than just steal real ones, something I've covered in more detail in <a href="https://kellssecurity.com/blog/ai-scams-the-cybersecurity-myths-i-keep-hearing" data-mce-href="https://kellssecurity.com/blog/ai-scams-the-cybersecurity-myths-i-keep-hearing">the AI scams I keep hearing about</a>. Before accepting any request from someone you're apparently already friends with, check whether the original account still exists. If it does, that request is fake. It costs ten seconds and it's the single most useful habit I can give you here.</p><h2>The Privacy Settings Most People Skip</h2><p>Most people set their privacy settings once when they first sign up and never touch them again. It's worth a five minute check every so often. Turn off public visibility on your full friends list, since that's exactly what a cloned profile needs to look convincing. Limit who can find you by phone number or email, and switch off location tagging on photos unless you genuinely need it there. I also keep the password on each account unique and stored in <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass</a>, since a reused password is often the quickest way in if a friend's account gets compromised first. None of this makes your account bulletproof, but it makes you a noticeably less appealing target than the account next to yours with everything left wide open.</p><h2>What Not to Post, Even If It Feels Harmless</h2><p>Some of what gets shared without a second thought is exactly what scammers and identity thieves are looking for. Your full date of birth, your child's school, a photo of a boarding pass, or a "which decade do you belong in" quiz that quietly asks for your mother's maiden name along the way. None of it looks dangerous in isolation. Pieced together, it's often enough to answer a bank's security questions or guess a password. I'm not saying don't post, I'm saying think about what a stranger could actually do with it before you do.</p><h2>Quizzes and Apps Are Data Harvesting in Disguise</h2><p>Every personality quiz and every app asking to connect to your account is collecting something, usually your friends list, your email, and whatever personal questions the quiz itself asked you to answer publicly. Most of it is genuinely used for nothing worse than ad targeting. Some of it ends up being sold on, or used to build exactly the kind of profile a scammer needs to impersonate you convincingly. I treat any app requesting more access than it obviously needs to function as a reason to say no, not a reason to read the fine print.</p><h2>Marketplace and Buy-Sell Groups Have Their Own Rules</h2><p>Buying and selling through social media has its own specific scams: fake listings for items that don't exist, buyers who "accidentally" overpay and ask for a refund of the difference, sellers who ask you to pay outside the platform's protection where there's no way to get your money back if it goes wrong. Meet in a public place for anything local and worth more than pocket change, and treat any request to move the conversation off the platform as the red flag it usually is.</p><h2>Protecting Kids Without Spying on Them</h2><p>If you've got children on social media, the aim isn't to read every message they send, it's to make sure they know what to do when something feels wrong. Talk to them about what a cloned or fake profile looks like, and agree that any online friend requesting money or private photos gets reported and told to you, not handled alone. Age-appropriate privacy settings and a genuinely open conversation do more than any parental control app I've come across.</p><h2>What I Do the Moment Something Feels Off</h2><p>If a message asks for money, the urgency feels manufactured, or a "friend" is suddenly writing completely differently to how they normally do, I stop and verify through a separate channel, a phone call, a text, anything that isn't the account that just messaged me. A lot of these messages are really just phishing wearing a different platform, so the same red flags I check when I try to <a href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything" data-mce-href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything">spot a phishing email</a> apply here too. If it turns out to be a scam, I report it through the platform and, if money or personal details were involved, through <a href="https://www.actionfraud.police.uk/" target="_blank" rel="noopener" data-mce-href="https://www.actionfraud.police.uk/">Action Fraud</a> as well, since that feeds the intelligence that gets the next version of that scam caught earlier. My <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">Safety Toolkit </a>has the settings and tools I actually use to keep my own accounts locked down, and it's worth five minutes of anyone's time.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

What I Actually Tell People About Social Media Safety

<p><strong>The short answer:</strong> to spot a phishing email, check the real sender address rather than the display name, hover over or long-press any link to see where it actually goes, and treat urgency as a warning sign on its own. If an email wants you to act fast, click a link or open an attachment you weren't expecting, go to the company's website or app directly instead. You can forward anything suspicious to report@phishing.gov.uk.</p><p>I get sent screenshots of dodgy emails more than almost anything else I deal with. Someone's not sure if it's real, something about it feels off, and they just want a second opinion before they delete it or click something they shouldn't. Over the years I've turned that instinct into an actual routine, the same handful of checks in the same order, every single time. Here's exactly what I look at.</p><p>None of this takes more than about thirty seconds once it's a habit. The point isn't to become paranoid about every email, it's to have a routine you can run through automatically so the decision isn't a guess.</p><h2>The First Thing I Check: The Sender Address</h2><p>Before I read a single word of the message, I look at who it's actually from, not the display name, the address underneath it. A message claiming to be from your bank should come from your bank's actual domain, not something like a random free email address or a string of nonsense letters. Most email apps let you tap or hover on the sender name to reveal the real address behind it. It takes two seconds and catches more fakes than anything else on this list, because the display name is the one thing that's trivial for a scammer to fake convincingly. Watch for lookalike domains too, where a scammer swaps a letter or adds a word so the address looks close enough at a glance.</p><h2>What I Do Before Clicking Any Link</h2><p>I never click a link straight from an email if I can help it. On a computer, hovering over the link shows the actual destination in the corner of the screen, and it's astonishing how often that destination has nothing to do with the company the email claims to be from. On a phone, a long press does something similar. If a link looks even slightly off, a misspelled domain, an unfamiliar country code, a string of random characters, I go to the actual company's website directly by typing the address myself rather than trusting the link at all. That single habit has saved me more than once, and I've written more on the specific red flags I always check first if you want the fuller list.</p><h2>The Urgency Is the Tell, Not the Content</h2><p>Every convincing phishing email I've ever seen has one thing in common: it wants you to act before you think. A locked account, a missed delivery, a payment that needs confirming within the hour. Genuine organisations very rarely operate that way, and the ones that do usually give you a proper amount of time and a way to verify through a channel you already trust, not just the link in the message itself. Whenever I feel that little jolt of urgency reading an email, that's my actual signal to slow down, not speed up. It's the single most reliable check I have, more reliable than spelling or logos, because the emotional pressure is the one thing scammers can't fake away.</p><h2>Attachments Get the Same Suspicion as Links</h2><p>An unexpected attachment, especially one you weren't told to expect, gets treated exactly like a suspicious link in my routine. Invoices I didn't order, delivery notices for parcels I'm not expecting, documents that need me to "enable content" to view them properly, all of these are extremely common ways malware actually gets onto a device. If I'm not expecting the attachment, I contact the supposed sender through a separate channel to check it's genuinely from them before I open anything, even if the email itself looks polished and professional.</p><h2>The Logo and Formatting Trick People Into False Confidence</h2><p>I still hear from people who assume a professional-looking email with the right logo and colours must be genuine. It's one of the most out of date pieces of advice still floating around. Copying a company's branding pixel for pixel takes minutes with tools freely available online, and I've seen fake bank and delivery emails that were indistinguishable from the real thing at a glance, footer and all. Polish tells you nothing about authenticity anymore. What actually matters is the sender address, the link destination, and whether the message is trying to rush you, exactly the checks above, not how nice it looks.</p><h2>The Same Checks Apply to Texts and App Notifications</h2><p>Phishing doesn't stay in your inbox anymore, and I run through more or less the same routine for texts and app notifications too. A text claiming to be from a delivery courier with a link to "reschedule" your parcel gets the same treatment as a suspicious email: I don't tap the link, I go to the courier's actual app or website directly. Scam texts are often even harder to check the sender address on than email, since a phone just shows a name or short number, so the urgency test becomes even more important on mobile than it is on a laptop. If a text is trying to rush you into tapping something right now, that's the same signal, regardless of which app it arrived through.</p><h2>The Newer Tricks: QR Codes and Fake Login Pages</h2><p>Two things have changed how I check emails over the last couple of years. The first is QR codes. Some phishing emails now put the link inside a QR code instead of a normal link, partly because email filters struggle to read them, and partly because scanning one moves you onto your phone where it's harder to check the address. If an email asks you to scan a code to "re-verify" an account or sign a document, I treat it exactly like a suspicious link. The second is fake login pages. A lot of phishing no longer tries to install anything at all. It just sends you to a perfect copy of a Microsoft, Google or bank login page and waits for you to type your password in. That's why I never log in through a link in an email, and why two-factor authentication matters so much, because it means a stolen password on its own isn't enough.</p><h2>What I Actually Do Once I've Decided It's Fake</h2><p>I don't click unsubscribe, and I don't reply asking what it wants, both just confirm to whoever sent it that your address is active and being read. I delete it, or mark it as phishing if my email provider offers that option, since that helps train their filters for the next person too. If you ever do click something you shouldn't have, report it through <a href="https://www.actionfraud.police.uk/" target="_blank" rel="noopener" data-mce-href="https://www.actionfraud.police.uk/">Action Fraud</a> so it's on record, and change your passwords straight away, starting with whichever account the email was impersonating. A password manager like <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass </a>also helps here in a quieter way, since it won't autofill your login details on a lookalike site even when the email itself looks completely convincing, which is often the first real sign something's wrong. My <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">Safety Toolkit</a> has the tools I use myself to keep my own inbox clean, and if you want a second pair of eyes on a suspicious email, feel free to <a href="https://kellssecurity.com/contact" data-mce-href="https://kellssecurity.com/contact">get in touch</a>.</p><h2>What to Do If You've Already Clicked</h2><p>Don't panic, and don't beat yourself up about it, it happens to careful people and it doesn't make you careless. Change the password for that account straight away, and for any other account using the same password, which is exactly why a password manager like <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass </a>earns its keep, since it makes giving every account its own password painless rather than a chore. Turn on two factor authentication if you haven't already. If you entered card details, ring your bank immediately using the number on your card. And if it's a work account, tell your IT contact even if it feels embarrassing, they would genuinely rather know now than find out later.</p><h2>Reporting It Helps Everyone, Not Just You</h2><p>Reporting a phishing email doesn't undo anything that's already happened, but it does help going forward, both for you and for whoever else was targeted in the same wave. If you want to report a phishing email you've received in the UK, <a href="https://www.actionfraud.police.uk/" target="_blank" rel="noopener" data-mce-href="https://www.actionfraud.police.uk/">Action Fraud</a> is the place to do it, and most email providers also have a dedicated report button that feeds the same intelligence back into their filters. I report every one I get, even the obvious ones, because that reporting data is part of what makes spam filters better at catching the next wave before it lands in someone else's inbox.</p><h2>The Body Copy Follows a Formula</h2><p>The message body had three parts, and I see this same shape constantly. First, a brief statement of the problem, kept vague on purpose so it could apply to almost anyone. Second, a consequence if you do not act, in this case the parcel being returned to sender. Third, a single button to fix it.</p><p>Notice what is missing. No parcel number that matches anything I could check independently. No specific date. No named person. Genuine companies tend to over include this kind of detail because it reduces their own support queries. Scam emails tend to under include it because specific, checkable detail is exactly what would let you catch them out.</p><p>The tone is also flatter than a real company's marketing usually is. Real courier emails often have a house style, a bit of personality, maybe an offer or a link to their app. This one read like it had been generated to be as universally applicable as possible, which is another way of saying it read like it had been generated for a mass send.</p><h2>The Bank Phone Call That Catches the Most People Out</h2><p>This one worries me more than any text message, because it doesn't rely on a dodgy-looking message, it relies on a confident voice on the other end of the phone. Someone calls claiming to be from your bank's fraud team, tells you there's suspicious activity on your account, and talks you through moving your money somewhere safe. Real banks will never ask you to transfer money to a new account to protect it, and they'll never ask for your full PIN or a one-time passcode over the phone. If you get one of these calls, hang up and ring your bank back on the number printed on your card, not a number the caller gives you. The <a href="https://www.takefive-stopfraud.org.uk/" target="_blank" rel="noopener" data-mce-href="https://www.takefive-stopfraud.org.uk/">Take Five to Stop Fraud </a>campaign has some excellent guidance on exactly this kind of call, and it's worth five minutes of anyone's time. I've had clients who work in banking tell me they still hesitate for a second on these calls, and they know exactly what to listen for, so don't judge yourself for not spotting it instantly.</p><h2>Phishing Email Questions I Get Asked</h2><h3>What is a phishing email?</h3><p>It's an email pretending to be from someone you trust, like your bank, a delivery company or a well-known brand, designed to get you to click a link, open an attachment or hand over personal details. The aim is usually to steal a password or money.</p><h3>What happens if I click a link in a phishing email?</h3><p>Don't panic. Clicking alone doesn't usually do much damage. If you typed in a password, change it straight away and turn on two-factor authentication. If you entered card or bank details, ring your bank on the number on your card. If you downloaded something, run a full security scan.</p><h3>Can you get hacked just by opening an email?</h3><p>It's very rare these days on an up-to-date device. The real risk comes from clicking links, opening attachments or enabling content in a document, so keep your device updated and be careful with anything you weren't expecting.</p><h3>How do I report a phishing email in the UK?</h3><p>Forward it to report@phishing.gov.uk, which is run by the National Cyber Security Centre. For scam texts, forward the message to 7726. I've written up <a href="https://kellssecurity.com/blog/where-to-report-a-scam" data-mce-href="https://kellssecurity.com/blog/where-to-report-a-scam">where to report a scam depending on what kind it is</a> if you need the full list.</p><h3>Why am I suddenly getting so many phishing emails?</h3><p>Usually because your email address has turned up in a data breach or a marketing list somewhere. I've explained <a href="https://kellssecurity.com/blog/why-you-are-getting-more-scams-than-you-used-to" data-mce-href="https://kellssecurity.com/blog/why-you-are-getting-more-scams-than-you-used-to">why you might be getting more scams than you used to</a> in a separate post.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

How I Spot a Phishing Email Before I Click Anything

<p><strong>The short answer:</strong> to choose a cybersecurity company, start with what your business actually needs protecting, then shortlist providers that hold Cyber Essentials (ideally Cyber Essentials Plus), can explain their incident response in plain English, include out-of-hours support in the price, and don't lock you in. If a provider leads with fear or product names instead of questions about your business, keep looking.</p><p>When someone asks me how to pick a cybersecurity company, my first question back is always what problem they're actually trying to solve. A corner shop worried about card machine fraud needs something completely different to a logistics firm handling client data across three sites. Get honest about what you're protecting and what a bad day actually looks like if it goes wrong. That's the starting point, not a company's logo or how slick their website is.</p><p>None of this is about finding the biggest name or the cheapest quote. It's about finding someone who actually understands your business well enough to protect the right things, and who's still answering the phone in a year's time. I've sat in on enough of these first conversations, on both sides of the table, to know the difference between a provider who's genuinely listening and one who's already decided what package they're going to recommend before you've finished explaining your business.</p><h2>Start With What You're Actually Protecting, Not the Sales Pitch</h2><p>Before I'd even look at a single provider, I'd write down what actually matters: customer data, payment systems, email accounts, whatever keeps the business running day to day. A good cybersecurity company asks about this before they mention a single product. If the first conversation is entirely about their tools and packages rather than your business and what you'd stand to lose, that tells you something about how the relationship is likely to go once you've signed.</p><h2>The Questions I'd Actually Ask Before Signing Anything</h2><p>I'd want to know exactly what happens if something goes wrong at 2am on a Sunday, not just during office hours. Who actually responds, how quickly, and what does that cost on top of the monthly fee. I'd ask for a plain-English explanation of what they'd do in the first hour of a ransomware attack, and I'd be wary of anyone who can't answer that without reaching for jargon. I'd also ask how they measure whether their own work is actually reducing risk, rather than just billing for hours, and I'd ask to speak to an existing client if that's on offer, since how a company handles a reference request tells you almost as much as the reference itself.</p><h2>Watch How They Talk About Risk, Not Just Tools</h2><p>The companies I'd trust talk about risk in terms of your business, not just firewalls and endpoint protection. They should be able to explain what happens to your specific data if a laptop gets stolen or an employee clicks the wrong link, in language that doesn't need translating. If every answer comes back as a product name rather than an outcome, that's usually a sign they're selling software rather than actually managing your risk.</p><h2>Credentials That Actually Mean Something</h2><p>Certifications aren't everything, but they're not nothing either. Cyber Essentials, and the more rigorous Cyber Essentials Plus, are the baseline I'd look for in the UK, since they're independently assessed rather than self-declared, and the NCSC's own <a href="https://www.ncsc.gov.uk/cyberessentials/overview" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/cyberessentials/overview">Cyber Essentials scheme</a> is worth reading through even if you never hire anyone, just to understand what "good" actually looks like. I've written more about the tools and habits I'd personally put in place either way in <a href="https://kellssecurity.com/blog/the-cybersecurity-buying-guide-i-give-every-small-business" data-mce-href="https://kellssecurity.com/blog/the-cybersecurity-buying-guide-i-give-every-small-business">my cybersecurity buying guide for small businesses</a>, since a good provider should be reinforcing those basics, not replacing the need for them entirely. A provider who's never heard of the scheme, or dismisses it as unnecessary paperwork, is a provider I'd want to ask a lot more questions of before signing anything.</p><h2>The Contract Details Everyone Skips Reading</h2><p>This is the part people rush past, and it's usually where the regret shows up later. I'd want to know exactly what's included in the monthly fee versus what gets billed as an "incident," because a shockingly common trap is a cheap retainer that turns into a huge bill the one time you actually need help. I'd also check the notice period for cancelling and whether your data and configurations are genuinely portable if you ever decide to leave, since being locked in with a provider you've lost confidence in is its own kind of risk.</p><h2>Red Flags That Would Make Me Walk Away</h2><p>Fear-based sales pitches are the biggest one for me. Anyone leading with worst-case horror stories designed to panic you into signing immediately, rather than a calm assessment of your actual exposure, is telling you how they'll behave later too. I'd also be cautious of a provider who can't clearly explain what they don't cover, since the gaps in a contract matter just as much as what's included, and I'd walk away from anyone who gets defensive rather than curious when I ask a genuinely basic question. A password manager like <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass</a> is worth using internally regardless of who you hire, since it closes off one of the most common ways a business actually gets breached in the first place, no external provider required.</p><h2>Ongoing Support or One-Off Help: Which Do You Need?</h2><p>Not every business needs a monthly contract. If you're a sole trader or a small team with a handful of laptops, a one-off setup to get the basics right, plus a clear plan for what to do if something goes wrong, might be all you need for now. If you hold a lot of customer data, take card payments online, or have staff working from several places, an ongoing managed service starts to make more sense, because someone is watching for problems while you get on with running the business. A good provider will tell you honestly which one you are, even if it means a smaller invoice for them.</p><h2>Choosing a Cybersecurity Company: Questions I Get Asked</h2><h3>Do small businesses really need a cybersecurity company?</h3><p>Not always straight away. Getting the basics right, like two-factor authentication, updates, backups and a password manager, covers a huge amount of risk on its own. A provider becomes worth it once you hold sensitive data or can't afford a day of downtime.</p><h3>What is Cyber Essentials?</h3><p>It's a UK government-backed scheme that checks your business has five basic protections in place: firewalls, secure settings, controlled user access, malware protection and keeping software updated. It's a sensible baseline for any business, and some contracts now ask for it.</p><h3>What's the difference between Cyber Essentials and Cyber Essentials Plus?</h3><p>Cyber Essentials is a self-assessment that's independently reviewed. Cyber Essentials Plus adds a hands-on technical check by an assessor, so it carries more weight.</p><h3>What questions should I ask before hiring a provider?</h3><p>Start with what happens out of hours, what's included in the monthly fee, and how you'd leave if it didn't work out. I've put together <a href="https://kellssecurity.com/blog/the-questions-i-d-ask-before-hiring-any-cybersecurity-company" data-mce-href="https://kellssecurity.com/blog/the-questions-i-d-ask-before-hiring-any-cybersecurity-company">the questions I'd ask before hiring any cybersecurity company</a> as a separate checklist.</p><h2>What a Good Fit Actually Looks Like</h2><p>The best working relationship I've seen between a small business and a cybersecurity company looks less like a vendor and more like a colleague who happens to specialise in something you don't have time to learn yourself. They explain things without condescension, they're upfront when something isn't their area, and they'd rather prevent an incident than bill you for cleaning one up. If a provider passes that test alongside the practical checks above, I'd feel genuinely comfortable recommending them.</p><p>My <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">Safety Toolkit</a> has the tools and settings I'd put in place myself regardless of who you end up hiring, and if you want a second opinion on a contract or a provider you're considering, feel free to <a href="https://kellssecurity.com/contact" data-mce-href="https://kellssecurity.com/contact">get in touch</a>. I'm always happy to look over the details before you sign anything.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

How I'd Choose a Cybersecurity Company

Kells Security Solutions

I teach people around the world how to spot online scams and stay safe on the internet, explained in plain English with no jargon. I cover phishing emails, two-factor authentication, password managers, VPNs and antivirus software, written for people who are not tech experts and want to protect themselves and their families.