Blog

<p>People ask me constantly whether phishing is getting better or worse, and the honest answer is both at once. The volume of obviously bad attempts hasn't dropped, but the quality of the convincing ones has jumped in a way I genuinely didn't expect this quickly. Here's what I'm actually seeing change, and what I think is coming next. My full guide on <a href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything" data-mce-href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything">how to recognise a phishing email</a> walks through every check I make, in the order I make them.</p><p>None of this is guesswork pulled from a headline. It's patterns I notice in the messages people forward me to check, week after week, and where those patterns seem to be heading. I'd rather flag what's actually changing than repeat the same tired warnings about dodgy spelling and suspicious attachments, since the people reading this have usually heard those already.</p><h2>The Sender Games Are Getting Better</h2><p>AI tools mean phishing emails read more fluently now, sound more local, and reference real details scraped from LinkedIn or a company website. The bad spelling giveaway is fading fast, so I lean more on checking the actual sender address and less on typos as a red flag. I've written about <a href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything" data-mce-href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything">the red flags I always check first</a>, and that habit matters more now than ever, not less. What used to take a scammer real effort, writing convincingly, researching a target, matching a company's tone, now takes a few minutes with the right prompt, which means the volume of genuinely convincing attempts is only going to climb.</p><h2>Voice and Video Are Joining the Email</h2><p>It's not just email anymore. I'm seeing phishing attempts paired with voice notes or video clips generated to sound like someone you know, following up on an email to make it feel more convincing. If someone claiming to be a colleague or family member pushes you toward an urgent request by email and then by voicemail, that combination alone is worth treating as a red flag. A few seconds of someone's voice from a video call, a podcast appearance, or a social media clip is genuinely enough to clone a passable imitation now, and I expect this to become a standard part of the more targeted attempts within the next year or two, not a rare exception.</p><h2>QR Codes Are Becoming the New Weak Spot</h2><p>Quishing, phishing delivered through a QR code instead of a link, is one I'm getting asked about more often, and I think it's only going to grow. A QR code hides its destination until you've already scanned it, which sidesteps the hover-and-check habit that catches so many suspicious links. I'm seeing them turn up on fake parking fine notices, printed flyers stuck over genuine ones, and even emails asking you to "scan to verify" your account rather than click through directly, since a QR code image is also a neat way to slip past filters that would normally flag a suspicious link in plain text. My advice is simple: treat a QR code with exactly the same suspicion as a link you can't see the destination of, because that's precisely what it is. If your phone shows a preview of the destination before it opens the page, always read it, and if there's no preview at all, that's a reason to be more cautious, not less.</p><h2>Fewer Mass Blasts, More Targeted Attempts</h2><p>Spray and pray phishing hasn't gone away, but I'm seeing more attempts that clearly did some homework first, mentioning your actual employer, a recent order, or a real event you'd genuinely have reason to be following. That personalisation is designed to lower your guard, and it works, because it exploits the same instinct that makes us trust a message that seems to already know us. Slow down precisely when an email feels like it knows you, that familiarity is the manipulation, not a reason to relax.</p><h2>What Actually Still Works Against It</h2><p>None of this changes the basics much, which is honestly the most reassuring part of all this. Verify through a second channel, don't click links in unexpected emails, and turn on <a href="https://kellssecurity.com/blog/why-i-treat-two-factor-authentication-as-non-negotiable" data-mce-href="https://kellssecurity.com/blog/why-i-treat-two-factor-authentication-as-non-negotiable">two factor authentication</a> so a convincing email alone isn't enough to get into your accounts. A password manager like <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass </a>also means you're not reusing the same password across every account a scammer might target, and it won't autofill your details on a lookalike page even when everything else about the message looks completely genuine. If you do fall for a convincing one, report it through <a href="https://www.actionfraud.police.uk/" target="_blank" rel="noopener" data-mce-href="https://www.actionfraud.police.uk/">Action Fraud</a> so it's on record, since that's part of what helps the next version of the scam get caught earlier.</p><h2>The One Prediction I'm Fairly Confident About</h2><p>I think the gap between "obviously fake" and "genuinely convincing" phishing is going to keep narrowing until it mostly disappears, which means the old advice of spotting scams by their mistakes has an expiry date. What replaces it is a shift in mindset rather than a new checklist: treating urgency and unexpected requests for money, login details, or personal information as the actual red flag, regardless of how polished, personal, or familiar the message sounds. The tell moves from how a message looks to what it's asking you to do.</p><h2>Staying Ahead Without Becoming Paranoid</h2><p>I don't think the answer is to distrust every email that lands in your inbox, that's exhausting and not sustainable, and it isn't how I live either. It's to build a habit of pausing on anything asking for money, login details, or urgent action, regardless of how convincing it looks, and to keep that habit running quietly in the background rather than treating every message as a fresh investigation. My <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">Safety Toolkit</a> has more on building that habit properly, and if you want a second opinion on something that's landed in your inbox, feel free to <a href="https://kellssecurity.com/contact" data-mce-href="https://kellssecurity.com/contact">get in touch</a>. I'd genuinely rather you ask than guess.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

Where I Think Phishing Emails Are Headed Next

<h2>Why Most Advice About Email Security Misses the Point</h2><p>Most email security guides tell you to look for bad spelling and dodgy logos, but that advice is years out of date. The scams landing in my inbox now are polished, personalised, and often use real company branding lifted straight from the source, copied pixel for pixel from a genuine email. If you're still scanning for typos, you're checking the wrong thing entirely, and you'll miss the ones actually worth worrying about. I've written before about<a href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything" data-mce-href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything"> how I identify email phishing</a> day to day, and the short version is that the sender's actual address matters more than anything else in the message. Everything else, the logo, the tone, the formatting, can be faked in minutes with tools freely available online.</p><figure id="figure-2v3djhadb9mt9okm6r"><img id="2v3djhadb9mt9okm6r" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Worried woman looking at a suspicious message on her phone, The Email Security Habits That Keep Scams Out of My Inbox" src="https://cdn.durable.co/covers/bNpxqcqZZ9SB0cSWvBxgcLktufx9Ij9Qasg0VLu60b7XVOjKOCoR6PagqBlcmfzD.jpg" alt="Worried woman looking at a suspicious message on her phone, The Email Security Habits That Keep Scams Out of My Inbox" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/bNpxqcqZZ9SB0cSWvBxgcLktufx9Ij9Qasg0VLu60b7XVOjKOCoR6PagqBlcmfzD.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>The Habits I Actually Rely On Every Day</h2><p>I don't have a complicated system, just a few habits I run through without thinking, the same way you'd check your mirrors before pulling out of a driveway. I never click a link in an unexpected email, I go to the website directly instead, typing the address myself rather than trusting anything in the message. I hover over links before I trust them, even ones that look like they're from people I know, since a compromised contact's account is one of the most convincing ways a scam email can arrive. And I treat any email that pushes me to act immediately as suspicious by default, because urgency is the oldest trick in the book and the one thing every genuine sender rarely needs from you.</p><h2>Spotting the Emails That Don't Add Up</h2><p>The clearest sign something's wrong is usually a mismatch. The sender says they're your bank but the reply address is a string of random letters. The email claims to be urgent but you weren't expecting anything from that company. A request for personal details arrives out of nowhere, dressed up as a routine verification step. None of these need technical skill to spot, they just need you to pause for a second before you respond, which is exactly the one thing a well-crafted scam is designed to stop you doing.</p><h2>Attachments Get the Same Suspicion as Links</h2><p>An attachment I wasn't expecting gets treated with exactly the same caution as a link I don't trust. Invoices for orders I didn't place, delivery notices for parcels I'm not expecting, documents that ask me to "enable content" before they'll display properly, these are some of the most common ways malware actually ends up on a device. If I'm not expecting it, I contact the supposed sender through a separate channel to check it's genuinely from them before I open anything, even when the email itself looks completely convincing.</p><h2>Tools That Do the Heavy Lifting for Me</h2><p>Vigilance only gets you so far, which is why I lean on a few tools to cover the gaps for the moments I inevitably let my guard down. A password manager like <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass </a>means even if one account gets compromised through a phishing email, the damage doesn't spread to everywhere else I use the same login, and it won't autofill my details on a lookalike page even when everything else about the message looks genuine. I also keep <a href="https://kellssecurity.com/blog/why-i-treat-two-factor-authentication-as-non-negotiable" data-mce-href="https://kellssecurity.com/blog/why-i-treat-two-factor-authentication-as-non-negotiable">two factor authentication</a> switched on for anything that matters, so a stolen password alone isn't enough to get in. When I'm on public wifi I'll use <a href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" target="_blank" rel="noopener" data-mce-href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902">NordVPN </a>too, since email login pages are exactly the kind of thing you don't want intercepted on an open network.</p><h2>The Inbox Rules I Set Up Once and Forgot About</h2><p>A few small settings do a surprising amount of quiet work in the background. I've got my email client set to display full sender addresses rather than just the display name, so I'm not relying on remembering to check manually every time. I unsubscribe from anything I don't actually read rather than leaving it to pile up, since a bloated inbox makes it easier for one genuine-looking scam to blend in with the noise. And I mark anything suspicious as phishing rather than just deleting it, since that helps train the filter for the next one, both for me and for whoever else uses the same provider.</p><h2>What I'd Tell Someone Starting From Scratch</h2><p>Start small. Pick one habit, checking the sender's actual address before you do anything else, and make it automatic before you add another. My <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">Safety Toolkit </a>has the tools I use if you want a starting point, and if something does land in your inbox that worries you, report it through <a href="https://www.actionfraud.police.uk/" target="_blank" rel="noopener" data-mce-href="https://www.actionfraud.police.uk/">Action Fraud </a>so it's on record, since that's part of what helps the next version of the scam get caught earlier. If you're ever unsure about something that's turned up, feel free to <a href="https://kellssecurity.com/contact" data-mce-href="https://kellssecurity.com/contact">get in touch</a> and I'll take a look.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The Email Security Habits That Keep Scams Out of My Inbox

<h2>Where I Actually Focus My Energy</h2><p>Digital life safety sounds bigger than it needs to be, and most of the advice out there makes it sound like you need a dozen new habits before you're covered. I don't try to defend against everything at once, I focus on the handful of things that actually cause most of the damage: weak passwords, missed software updates, and clicking the wrong link at the wrong moment. Get those right and you've closed off most of the routes a scammer would actually use against you. Everything else is a smaller improvement on top of that foundation, not a replacement for it.</p><figure id="figure-ehjcex2fmcmt9tgjx5"><img id="ehjcex2fmcmt9tgjx5" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Woman reading online safety advice on her laptop, Practical Ways I Safeguard My Digital Life" src="https://cdn.durable.co/covers/1b6yok9RJBZAfVJCU68TtCAefcOkWASoEAg2dAh9pXKihM78nnfL0P7qcT5IAgmm.jpg" alt="Woman reading online safety advice on her laptop, Practical Ways I Safeguard My Digital Life" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/1b6yok9RJBZAfVJCU68TtCAefcOkWASoEAg2dAh9pXKihM78nnfL0P7qcT5IAgmm.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>The Accounts That Get My Full Attention</h2><p>Not every account needs the same level of care, but the ones tied to money, email, or your identity do. I keep <a href="https://kellssecurity.com/blog/why-i-treat-two-factor-authentication-as-non-negotiable" data-mce-href="https://kellssecurity.com/blog/why-i-treat-two-factor-authentication-as-non-negotiable">two factor authentication</a> switched on for anything in that category, so a leaked password on its own isn't enough to get in. I've also written before about <a href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything" data-mce-href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything">how I spot phishing attempts</a>, since a stolen login usually starts with one convincing email. Email gets the most attention of all, since it's usually the account a scammer can use to reset everything else once they're in.</p><h2>Keeping My Devices in Good Shape</h2><p>Software updates aren't exciting, but they patch the exact holes attackers rely on. I let my phone and laptop update automatically rather than putting it off, and I use a password manager like <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass </a>so I'm never tempted to reuse the same password across different accounts. It's a small habit that removes one of the easiest ways in. Updates are also where the gap between a patch being released and someone getting around to installing it is exactly where a lot of real damage happens, so I'd rather it just happen in the background than sit on my to-do list.</p><h2>Being Careful on Public Networks</h2><p>Public wifi in cafes and train stations is convenient, but it's also somewhere your data can be intercepted if you're not careful. I avoid logging into anything sensitive, like banking, while connected to open networks, and I use <a href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" target="_blank" rel="noopener" data-mce-href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902">NordVPN </a>when I do need to get things done on the move so the connection itself is encrypted. An open network doesn't require anyone to prove who they are before joining it, which is exactly what makes it easy for someone else on the same connection to snoop on unencrypted traffic.</p><h2>The Backups I Don't Think About Anymore</h2><p>Ransomware and simple device failure both end the same way if you're not prepared: everything gone in an instant. I keep an automatic backup running in the background for anything I'd actually be gutted to lose, photos, documents, the lot, and I don't rely on a single copy living in only one place. It's not a habit I have to remember to do, which is exactly why it works. The best backup system is the one that runs whether you think about it or not.</p><h2>The One Habit That Covers the Gaps</h2><p>Even with all of this in place, I still treat urgency as a red flag on its own. Any message pushing me to act immediately, whether it's an email, a text, or a call, gets a pause before I respond, and I verify through a separate channel if anything feels even slightly off. None of the tools above matter much if that one habit slips, since it's the thing that catches whatever gets past everything else.</p><h2>When I Bring In Extra Help</h2><p>Most of digital safety is habits, not tools, but sometimes it's worth getting a second opinion. My <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">Safety Toolkit </a>lists what I actually use day to day if you want a starting point, and if you're ever unsure about something that's landed in your inbox or on your screen, feel free to <a href="https://kellssecurity.com/contact" data-mce-href="https://kellssecurity.com/contact">get in touch </a>and I'll take a look. None of this needs to be complicated, and it doesn't need to happen all at once either. Pick one thing from this list you haven't done yet and start there.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

Practical Ways I Safeguard My Digital Life

<p><strong>The short answer:</strong> two-factor authentication matters because it means a stolen password on its own isn't enough to get into your account. Whoever has your password still needs a second thing, usually a code from your phone, and that's what stops most of the account takeovers I see. It's free, it takes a few minutes per account, and the <a href="https://www.ncsc.gov.uk/cyberaware/home" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/cyberaware/home">National Cyber Security Centre</a> recommends turning it on for your email and social media first.</p><h2>Why I Stopped Trusting Passwords Alone</h2><p>A password on its own is just one lock on one door, and passwords leak more often than people realise, through data breaches, phishing pages, and reused logins on sites that get hacked somewhere else. Two-factor authentication adds a second check, so a stolen password by itself isn't enough for someone to get into your account. It's the single change I recommend most often, because it closes off the easiest way in. I've lost count of how many times I've seen someone's password turn up in a breach they'd never even heard of, sold on somewhere they'll never see, and the thing that saved the account wasn't a stronger password, it was the second step a stolen password alone couldn't get past.</p><figure id="figure-t7smydvm5emt9tv3n3"><img id="t7smydvm5emt9tv3n3" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Hands typing a password on a laptop keyboard, Why I Treat Two-Factor Authentication as Non-Negotiable" src="https://cdn.durable.co/covers/11PCbQdJ5YR0KkHpq6N0pKU5PQzrsp1PeimAK6HRNuvSxOJepuJaApoNN98jCFam.jpg" alt="Hands typing a password on a laptop keyboard, Why I Treat Two-Factor Authentication as Non-Negotiable" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/11PCbQdJ5YR0KkHpq6N0pKU5PQzrsp1PeimAK6HRNuvSxOJepuJaApoNN98jCFam.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>What Two-Factor Actually Buys You</h2><p>Turning it on means a leaked password becomes far less dangerous, since whoever has it still needs the second piece, usually a code on your phone or an app-based approval. Setting it up properly takes a few minutes per account, and most services walk you through it the moment you turn it on in your account settings, so there's no separate guide you need to track down first.&nbsp; If I'm setting things up while I'm out and about, I'll usually have <a href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" target="_blank" rel="noopener" data-mce-href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902">NordVPN </a>running too, just so the connection itself isn't the weak link.</p><h2>The Different Ways 2FA Actually Works</h2><p>Not every version of two-factor is equally strong, and it's worth knowing the difference. A text message code is better than nothing, but it's also the weakest option, since a number can be hijacked through a SIM swap if someone convinces your provider to move it to a new device. An authenticator app that generates a rotating code is a solid step up, since the code never travels over the phone network at all. The strongest option is a physical security key, a small device you plug in or tap, though that's usually more than most people need for everyday accounts. My rule of thumb is simple: use an app-based code where it's offered, fall back to text messages where it isn't, and don't let the search for the perfect option stop you turning on the one that's actually available.</p><h2>The Accounts I Never Leave Without It</h2><p>Email comes first, because it's usually the account a scammer can use to reset everything else. After that I'd prioritise banking, anything storing payment details, and social media, since a hijacked account there gets used to target people who trust you. If you only have time to protect a handful of accounts, start with those. I'd also add anything tied to your wider identity, like a cloud storage account holding photos or documents, since that's often the one people forget about until it's the one that gets used against them.</p><h2>Where a Password Manager Fits In</h2><p>Two-factor works best alongside strong, unique passwords, and that's where a password manager like <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass </a>earns its place, generating and storing a different password for every account so you're never reusing one that's already been exposed somewhere else. It also makes the second step less of a hassle, since you're not juggling passwords from memory. Most password managers can store your backup codes too, which saves you hunting through old emails the one time you actually need them.</p><h2>What I'd Do If I Lost My Phone</h2><p>This is the question I get asked most once someone's actually turned two-factor on, and it's a fair one. Most services give you backup codes the moment you set it up, a short list of one-time codes you can use to get back in if your phone's lost, broken, or just out of battery. I'd screenshot them, print them, or save them somewhere that isn't the phone they're backing up, since a backup code stored only on the device you've lost isn't much use to you. If you skipped that step when you set an account up, it's worth going back and generating a fresh set now, before you actually need them rather than after.</p><h2>The Real Benefits of Two-Factor Authentication</h2><p>People usually ask me what they actually get for the extra step, so here's the honest version. The big one is that a leaked or reused password stops being a disaster. If a shop you used years ago gets breached and your old password ends up for sale, it's useless on any account that also asks for a code.</p><p>The second benefit is one people don't expect. Two-factor works as an early warning. If a login code lands on your phone and you didn't ask for it, that's someone trying your password right now. Without two-factor you'd never know until the damage was done. With it, you get a heads-up and time to change the password before anything happens.</p><p>Third, it protects the people who trust you. A hijacked Facebook or WhatsApp account gets used to message your friends and family asking for money, and they believe it because it looks like it's coming from you. Locking your own account down protects them as much as it protects you.</p><p>And finally, it makes you a harder target than the next person. Most account takeovers aren't personal. Criminals run stolen passwords through huge numbers of accounts at once and take whatever opens easily. An account that asks for a second step usually just gets skipped.</p><h2>Shared Logins Are a Bigger Risk Than People Expect</h2><p>This is the part that surprised me most once I actually looked into it properly. Any account that more than one person logs into, whether that's a shared inbox, a joint social media login, or a tool a contractor also has access to, is inherently riskier than an account only I use, because the number of ways it can be compromised multiplies with every person who has the password. Two-factor becomes even more important here, not less, because it means a leaked or reused password from any one of those people isn't enough on its own to get someone in. I've moved away from truly shared logins wherever the tool allows it, using individual accounts with proper permissions instead, but where a shared login is genuinely unavoidable, two-factor on it is non-negotiable rather than a nice-to-have.</p><h2>It Takes Too Long</h2><p>My biggest excuse was time. I told myself that unlocking an app to grab a six-digit code every time I logged into an account was going to be more hassle than it was worth, especially for accounts I use daily without thinking. What actually happened once I turned it on was completely different from what I'd pictured. Most services only ask for that second step occasionally, not on every single login, and remember the device you're using for weeks at a time. Even when it does ask, it adds maybe five seconds to the process. I'd genuinely spent more time arguing with myself about whether to turn it on than I've spent entering codes in the months since I actually did it.</p><h2>Two-Factor Authentication Questions I Get Asked</h2><h3>Is two-factor authentication really necessary?</h3><p>For your email, bank and social media, yes. Those are the accounts that can be used to reset everything else or to scam the people you know. For a forum you logged into once, it's nice to have but not urgent.</p><h3>Is two-factor authentication the same as two-step verification?</h3><p>For everyday purposes, yes. Google calls it 2-Step Verification, some banks call it strong authentication, and others say 2FA or multi-factor authentication. The names change but the idea is the same: your password plus a second check.</p><h3>Can two-factor authentication be hacked?</h3><p>It can be got round, but it takes far more effort, which is the whole point. The usual trick is a scammer phoning or texting to ask you to read out the code you've just been sent. No genuine company will ever ask you for that code, so if anyone does, that's your answer.</p><h3>What should I do if I get a code I didn't ask for?</h3><p>Don't share it, and don't approve any login prompt you didn't start yourself. Then change the password for that account straight away, because someone has it. If you used the same password anywhere else, change it there too.</p><h3>How do I actually set it up?</h3><p>It lives in the security or login settings of each account, and it only takes a few minutes. I've written a <a href="https://kellssecurity.com/blog/the-step-by-step-way-i-set-up-two-factor-authentication-for-clients" data-mce-href="https://kellssecurity.com/blog/the-step-by-step-way-i-set-up-two-factor-authentication-for-clients">step-by-step guide to setting up two-factor authentication</a> that walks through it, including the backup codes most people forget.</p><h2>My Honest Advice If You're Still on the Fence</h2><p>It feels like an extra step until the day it saves you, and by then you'll wonder why you waited. If you want a wider look at what I use day to day, my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">Safety Toolkit </a>lists the tools I actually rely on, and I've also written about <a href="https://kellssecurity.com/blog/where-i-think-phishing-emails-are-headed-next" data-mce-href="https://kellssecurity.com/blog/where-i-think-phishing-emails-are-headed-next">the phishing tricks I keep seeing</a> that make stolen passwords so common in the first place. If anything about this feels confusing, feel free to <a href="https://kellssecurity.com/contact" data-mce-href="https://kellssecurity.com/contact">get in touch</a> and I'll walk you through it. None of it takes long, and once it's set up you barely notice it's there, right up until the day it quietly stops something worse from happening.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

Why I Treat Two-Factor Authentication as Non-Negotiable

<h2>Why the Christmas Rush Is a Scammer's Favourite Time of Year</h2><p>Every December I see the same pattern. Scam reports spike the moment the Christmas adverts start, because scammers know most of us are shopping faster than usual and paying less attention to the small details. A rushed shopper is exactly what they're counting on. If you're hunting for a bargain late at night after a long day, you're far more likely to skip the checks you'd normally make. That's not a criticism, it's just how tiredness and urgency work together against us. The scammers behind this know the calendar as well as any retailer does, which is exactly why the volume of fake ads and cloned stores spikes hardest in the two weeks either side of Black Friday and again right before Christmas itself.</p><figure id="figure-cnknugvo87cmt9wuwws"><img id="cnknugvo87cmt9wuwws" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Woman checking her phone at home, The Online Shopping Rules I Never Break at Christmas" src="https://cdn.durable.co/covers/2DLj7xKFDiOptcvFJMNkt0lNwyA4nwZJW6kLw9dOurAj5Narss34RChvGD7LyedU.jpg" alt="Woman checking her phone at home, The Online Shopping Rules I Never Break at Christmas" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/2DLj7xKFDiOptcvFJMNkt0lNwyA4nwZJW6kLw9dOurAj5Narss34RChvGD7LyedU.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>The Payment Rule I Never Bend</h2><p>I have one rule I never break when I'm buying anything online: I never pay by bank transfer to a private seller or a shop I don't recognise. A card payment or PayPal gives you a way to get your money back if something goes wrong. A bank transfer doesn't, and once it's gone, it's gone. If a seller only accepts a direct transfer, that's usually the moment I close the tab. I'd extend the same rule to anyone who only wants payment through a QR code at a market stall or a link sent over social media, since both routes skip the same buyer protections a proper card payment gives you.</p><h2>Spotting a Fake Shop Before You Type Your Card Details</h2><p>A fake shopping site can look identical to a real one these days, so I don't judge a site purely on how it looks. I check the web address for anything odd, look for a padlock next to the URL, and search the company name plus the word "reviews" in a separate tab rather than trusting the testimonials on their own homepage. It's the same instinct I use for spotting a <a href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything" data-mce-href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything">phishing email</a>, you're looking for the gap between what a business claims to be and what it actually is. A site that's only existed for a few weeks is another giveaway, checking when a domain was registered takes seconds, and a shop that popped up right before Christmas selling in-demand gifts at suspiciously low prices is worth a second look before you trust it with your card details.</p><h2>The Delivery Text Scams That Ramp Up in December</h2><p>December is peak season for a text or email claiming a parcel couldn't be delivered and asking for a small fee to release it. It plays on the fact that most of us genuinely are expecting several deliveries at once, which makes the message land as plausible rather than suspicious. I never tap the link in these messages, I go straight to the courier's own app or website and check my tracking there instead. A genuine delivery issue will always show up on the tracking page itself, it doesn't need a text message with a link to fix it.</p><h2>Deals That Are Too Good to Be True</h2><p>If a well known brand is suddenly selling something at 80% off with no explanation, I treat that as a red flag rather than a lucky find. Genuine sales happen, but they rarely wipe that much off the price with no catch. I also avoid finishing a purchase over public WiFi in a cafe or shopping centre unless I'm running <a href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" target="_blank" rel="noopener" data-mce-href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902">NordVPN</a>, since an open network is an easy place for someone to intercept what you're typing. I'd also be wary of a deal that only shows up through a social media ad you've never seen the brand run before, since cloned ad accounts impersonating well known retailers are a recurring trick this time of year, particularly on platforms with lighter ad verification.</p><h2>Gift Cards Are a Scammer's Favourite Trick</h2><p>Anyone who asks to be paid in gift cards is not a legitimate seller, full stop. It's become such a reliable red flag that I treat it as an instant end to the conversation rather than something worth questioning further. Gift cards work for scammers because the money moves instantly and can't be reversed once the codes are handed over, which is exactly the same appeal a bank transfer has for them. If a "seller," a "courier," or anyone else asks for payment this way, whatever story comes with it, the answer is no.</p><h2>My Christmas Shopping Checklist</h2><p>My actual Christmas shopping checklist is short. Pay by card or PayPal, check the website is who it says it is, use a strong unique password stored in <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass</a> rather than reusing an old one, and turn on <a href="https://kellssecurity.com/blog/why-i-treat-two-factor-authentication-as-non-negotiable" data-mce-href="https://kellssecurity.com/blog/why-i-treat-two-factor-authentication-as-non-negotiable">two factor authentication </a>anywhere that holds your payment details. None of this takes long once it's a habit, and it's a lot less stressful than sorting out a fraudulent transaction in January. My<a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit"> Safety Toolkit</a> has the password manager and VPN I use myself, and if you're ever unsure about a site or a deal, <a href="https://kellssecurity.com/contact" data-mce-href="https://kellssecurity.com/contact">get in touch</a> and I'll take a look before you hand over your card details. None of these checks add more than a minute or two to an order, and that's a fair trade for not spending January on the phone to your bank.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The Online Shopping Rules I Never Break at Christmas

<h2>Why I Do This Every January</h2><p>Every January I sit down and go through my entire digital life like an MOT for my accounts. It sounds excessive until you remember most of us set up our passwords, privacy settings and old accounts years ago and never look at them again. A yearly check-up catches the stuff that quietly builds up: forgotten logins, apps you don't use anymore that still hold your data, and settings that changed without you noticing. It takes an afternoon and it's saved me more than once. The threats change year to year too, so this isn't just tidying up old mess, it's making sure the habits I'm relying on actually match this year's risks rather than the ones that mattered five years ago.</p><figure id="figure-3xa5vpjeomt9xgvkf" class=""><img id="3xa5vpjeomt9xgvkf" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Man smiling as he uses his phone safely, The Digital Safety Check-Up I Do Every Year" src="https://cdn.durable.co/covers/22JGHvhqAR5zn3MLuxQlQkBE0erI5OO5GkH1wdZLu1DaA6xHoKImht9cHhDDTgyq.jpg" alt="Man smiling as he uses his phone safely, The Digital Safety Check-Up I Do Every Year" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/22JGHvhqAR5zn3MLuxQlQkBE0erI5OO5GkH1wdZLu1DaA6xHoKImht9cHhDDTgyq.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>Passwords and Logins Get Checked First</h2><p>I start with passwords because they're the weakest link in most people's setup. I go through my <a href="https://kellssecurity.com/blog/how-id-choose-a-password-manager-if-i-were-starting-today" data-mce-href="https://kellssecurity.com/blog/how-id-choose-a-password-manager-if-i-were-starting-today">password manager </a>and look for anything reused, anything short, and anything I haven't touched in years, those old accounts are exactly the kind of thing that shows up in a breach nobody tells you about. If you're still keeping passwords in your head or a notebook, I've written before about whether that actually holds up. I use <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass</a> myself because it flags weak and reused passwords automatically instead of me hunting for them one by one. I also close accounts I genuinely don't use anymore rather than leaving them sitting there, since a dormant account is still a target even if I never log into it again, and it's one less place my data can turn up in a future breach I never hear about.</p><h2>Reviewing App Permissions and Privacy Settings</h2><p>Next I go through the apps on my phone and check what they actually have access to, location, contacts, microphone, and I switch off anything that doesn't need to be on. Social media privacy settings get the same treatment, since platforms have a habit of quietly resetting things after an update. It only takes ten minutes but it closes off a surprising number of ways your information can leak out without you doing anything wrong. Browser extensions get the same review, since it's easy to install one for a single task and forget it's still running months later with access to everything you type or browse. If I can't remember installing something or explain why I still need it, it comes out.</p><h2>The Old Accounts and Subscriptions I Track Down</h2><p>This is the part people skip, but it's often where the most forgotten data is sitting. I go through old email accounts I've stopped using and either close them properly or at least update the password and turn on two factor authentication, since an abandoned inbox is still full of years of personal information and password reset links waiting to be found. I do the same with subscription services and old shopping accounts, checking which ones still have a card saved and cancelling anything I'm not actually using anymore. It's rarely one big discovery, just several small ones that add up to a much smaller footprint by the time I'm done.</p><h2>Checking My Devices and Backups</h2><p>I also check that every account with real value, email, banking, anything worth protecting, has <a href="https://kellssecurity.com/blog/why-i-treat-two-factor-authentication-as-non-negotiable" data-mce-href="https://kellssecurity.com/blog/why-i-treat-two-factor-authentication-as-non-negotiable">two factor authentication </a>properly switched on rather than just offered. Then I check my backups actually work, not just that they exist, and I make sure my devices are running the latest updates. If I'm working from a cafe or anywhere on public wifi, I always have <a href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" target="_blank" rel="noopener" data-mce-href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902">NordVPN</a> running before I do anything I wouldn't want a stranger on the same network reading. I check my account recovery details are current too, the backup email and phone number attached to my most important accounts, since a recovery option pointing at a number I don't use anymore is exactly the kind of gap that turns a simple password reset into a genuine problem.</p><h2>What I Do If the Check-Up Turns Up a Problem</h2><p>Some years this throws up something worth acting on straight away, a password manager flags a password that's already appeared in a breach, or I find an old account I don't recognise logging in from. When that happens I change the password immediately, check the account's recent activity or login history for anything else unfamiliar, and turn on two factor authentication if it wasn't already on. I'd rather find a problem during a calm afternoon check-up than have it find me at a worse moment, and dealing with it early is almost always simpler than untangling it after the fact.</p><h2>The Checklist I Actually Use</h2><p>My checklist is short: password manager reviewed, two factor authentication turned on everywhere it matters, app permissions trimmed back, backups tested, and devices updated. None of it takes long once it's a habit, and it's a lot less stressful than sorting things out after something's already gone wrong. My <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">Safety Toolkit</a> has the password manager and VPN I use for all of this, and if you'd rather I just walked you through it, <a href="https://kellssecurity.com/contact" data-mce-href="https://kellssecurity.com/contact">get in touch</a> and I'll help you set it up properly. An afternoon once a year is a small price for not having to think about any of this the rest of the time, and it's the kind of habit that gets easier, not harder, the more times you do it.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The Digital Safety Check-Up I Do Every Year

Kells Security Solutions

I teach people around the world how to spot online scams and stay safe on the internet, explained in plain English with no jargon. I cover phishing emails, two-factor authentication, password managers, VPNs and antivirus software, written for people who are not tech experts and want to protect themselves and their families.