Blog

<h2>Why Small Businesses Are a Target</h2><p>I talk to a lot of small business owners who assume cybercriminals only go after the big names. In reality it's the opposite, small businesses are often the easier target because the security is thinner and the payoff, customer data, payment details, supplier accounts, is still worth stealing. A local shop or a two person consultancy can lose a week of trading, or worse, over one convincing phishing email. That's not there to scare you, it's just the reality I see from working with businesses across every size and sector. Most of this isn't even personal, the majority of attacks against small businesses come from automated tools scanning thousands of addresses for the same handful of weaknesses, an outdated plugin, a reused password, an open port. You don't need to be targeted specifically to end up a victim, you just need to be the easiest one the scan happens to find that day.</p><figure id="figure-eo0qc1gl63mt9y699q"><img id="eo0qc1gl63mt9y699q" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Security expert watching camera screens, Cybersecurity Strategies I Recommend to Small Businesses" src="https://cdn.durable.co/covers/32ZiCusidY0ykvPBrJ4UPUBZtKKF1NpK6sqPsH65m5SjeFiLVCjj9Zpn66nBtfLY.jpg" alt="Security expert watching camera screens, Cybersecurity Strategies I Recommend to Small Businesses" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/32ZiCusidY0ykvPBrJ4UPUBZtKKF1NpK6sqPsH65m5SjeFiLVCjj9Zpn66nBtfLY.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>The Basics I'd Get Right First</h2><p>Before anything fancy, I'd get the basics locked down. Every account needs a strong, unique password stored somewhere other than your head, which is exactly why I recommend a password manager like <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass</a> to every business I work with. Software updates should never sit there waiting, since most breaches exploit a gap that was patched months earlier. And back up anything you couldn't afford to lose, tested, not just switched on and forgotten. I'd also check your email setup has proper authentication in place, SPF, DKIM and DMARC records, since without them it's trivially easy for someone to send an email that looks like it came from your own domain. Most business email providers can switch these on with a few settings changes, and it's one of those things that takes an afternoon once and then quietly protects you indefinitely.</p><h2>Whether Cyber Insurance Is Worth It</h2><p>This comes up in almost every conversation I have with a small business owner, and my honest answer is that it depends on what you're protecting and how much a bad week would cost you. Cyber insurance won't stop an attack happening, but it can cover the cost of recovery, legal advice, and notifying customers if data's been exposed, expenses that catch most businesses completely off guard. What I'd flag is that most policies require you to already have basic protections in place, two factor authentication, regular backups, before they'll pay out, so it's worth treating insurance as a backstop rather than a replacement for the basics above.</p><h2>Training Your Team Without Boring Them to Death</h2><p>The biggest risk in most small businesses isn't the technology, it's a rushed member of staff clicking the wrong link on a Monday morning. I don't believe in hour long lectures nobody remembers. A five minute conversation about what a phishing email looks like, repeated every few months, does more good than one big session people forget by lunchtime. I'd also send a test phishing email to your own team once or twice a year, not to catch anyone out, but to see honestly where the gaps are before a real one does the damage instead. If you want a fuller walkthrough for choosing outside help, I've covered that in my <a href="https://kellssecurity.com/blog/the-cybersecurity-buying-guide-i-give-every-small-business" data-mce-href="https://kellssecurity.com/blog/the-cybersecurity-buying-guide-i-give-every-small-business">buyer's guide to choosing a cybersecurity company.</a></p><h2>Protecting Customer Data and Your Reputation</h2><p>Customer trust is the thing that actually gets damaged in a breach, not just the data itself. <a href="https://kellssecurity.com/blog/why-i-treat-two-factor-authentication-as-non-negotiable" data-mce-href="https://kellssecurity.com/blog/why-i-treat-two-factor-authentication-as-non-negotiable">Two factor authentication</a> on anything that touches customer information is non negotiable in my book, it's a small bit of friction that stops most opportunistic attacks cold. If your team ever works from a cafe or shared space, a VPN like <a href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" target="_blank" rel="noopener" data-mce-href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902">NordVPN</a> keeps that connection private rather than broadcasting it to anyone else on the network. I'd also only collect the customer data you actually need and get rid of what you don't, since data you never held in the first place can't be part of a breach. It's a simple principle that a lot of businesses overlook while they're focused on defending everything they've already got.</p><h2>What I'd Do in the First 24 Hours After a Breach</h2><p>If the worst happens, the first hour matters more than people expect. Disconnect the affected device from the network before doing anything else, that alone can stop an attack spreading to everything else you're connected to. Change passwords on anything that might be compromised, starting with anything tied to customer data or payments, and turn on two factor authentication anywhere it wasn't already active. Then work out what data was actually affected, since that determines whether you're legally required to notify customers or a regulator, and getting that wrong by guessing is worse than taking an extra hour to check properly. I'd rather businesses have this written down somewhere calm in advance than try to work it out for the first time while it's actually happening.</p><h2>When It's Time to Bring in Help</h2><p>Some things are worth doing yourself, and some aren't. If you're handling sensitive data at scale, or you've had a scare already, that's usually the point where bringing in proper support pays for itself. My <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">Safety Toolkit</a> has the password manager and VPN I recommend to every business I speak to, and if you want a second pair of eyes on your setup, <a href="https://kellssecurity.com/contact" data-mce-href="https://kellssecurity.com/contact">get in touch </a>and I'll take an honest look. None of this needs to be expensive or complicated to start, it just needs to actually happen rather than staying on a list of things you'll get to eventually.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

Cybersecurity Strategies I Recommend to Small Businesses

<p><strong>The short answer:</strong> when you compare VPN services, check four things in this order: an independently audited no-logs policy, where the company is based, real-world speed, and a kill switch that actually works. Then look at how many devices it covers and how long the money-back guarantee is. Steer clear of free VPNs, because if you're not paying for the service, your data often is.</p><h2>A Provider Based Somewhere With Sensible Data Laws</h2><p>Where a VPN company is legally headquartered actually matters, because it determines what data-retention laws it operates under and what a government could theoretically compel it to hand over, no matter what its own policy says. I look for providers based outside data-retention-heavy jurisdictions, somewhere a no-logs policy isn't just a promise but genuinely has nothing to hand over even if legally pressured to. It's a detail that's easy to skip past on a features comparison page, but it's the one that actually determines whether "no logs" holds up under real pressure rather than just sounding reassuring on a website.</p><p>Picking a VPN properly took longer than just grabbing whatever ranked first in a "best VPN" listicle, but it meant I ended up with something I actually trust running on every device I own, not just something I hoped was doing its job. If you want the specific everyday moments that convinced me a VPN was worth having in the first place, <a href="https://kellssecurity.com/blog/what-a-vpn-actually-protects-you-from" data-mce-href="https://kellssecurity.com/blog/what-a-vpn-actually-protects-you-from">I've written about that separately</a>, and my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">free Safety Toolkit </a>covers the wider setup I'd recommend having in place alongside it.</p><h2>Why I Get Asked About This So Often</h2><p>People ask me almost every week which VPN they should get, and I understand why the choice feels overwhelming. Search "best VPN" and you'll get fifty near identical review sites, most of them chasing affiliate commissions rather than telling you what actually matters. I've already written about <a href="https://kellssecurity.com/blog/what-a-vpn-actually-protects-you-from" data-mce-href="https://kellssecurity.com/blog/what-a-vpn-actually-protects-you-from">what a VPN does and when you'd actually want one</a>, so this post skips that bit and gets straight into how I'd choose one myself if I was starting from scratch today. Most of those review sites are also ranking whichever provider pays the best affiliate commission, not whichever one actually protects you best, so the fact a service tops a "best VPN" list tells you almost nothing about whether it's trustworthy.</p><h2>The One Thing I Check Before Anything Else</h2><p>Before speed, before price, before any of the flashy extra features, I check the no-logs policy and where the company is based. A VPN that keeps no record of what you do online is the entire point of using one, and if the company sits somewhere with weak privacy laws or a habit of handing data to governments, none of the rest matters much. I look for independently audited no-logs claims rather than just a promise on a website, because plenty of providers have been caught out saying one thing and doing another. I'd also flag that "no-logs" can mean different things depending on what a provider actually counts as a log, some still record connection timestamps or the amount of bandwidth you've used while genuinely not tracking which sites you visit, so I read the actual privacy policy rather than trusting a badge on the homepage.</p><figure id="figure-z3n61yekfpmt9yquyc"><img id="z3n61yekfpmt9yquyc" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Traveller holding a passport while using a laptop, How to Choose a VPN Service: What I Actually Look For" src="https://cdn.durable.co/covers/26pWI1BYq2abIgKilwLFST9rggowYSKy2U8ly48kMSerNAvkt3zHBYtItKQKI0b2.jpg" alt="Traveller holding a passport while using a laptop, How to Choose a VPN Service: What I Actually Look For" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/26pWI1BYq2abIgKilwLFST9rggowYSKy2U8ly48kMSerNAvkt3zHBYtItKQKI0b2.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>Why I'd Steer Clear of Free VPNs</h2><p>Free VPNs come up constantly, and I understand the appeal, but running VPN servers costs real money, so when nobody's paying for the service, something else usually is. That's often your browsing data, sold to advertisers in a form that undoes the entire point of using a VPN in the first place. I've also seen free apps cap how much data you can use each month, throttle your speed until it's unusable, or run on weaker encryption than their paid alternatives. A cheap paid subscription, often a few pounds a month if you commit to a longer term, buys you a provider whose entire business model is keeping you as a customer rather than monetising you as a product.</p><h2>Speed, Devices, and the Stuff That Actually Affects Daily Use</h2><p>Once I trust a provider with my data, the next thing I care about is whether it'll slow me down. A VPN that grinds your connection to a crawl gets uninstalled within a week, no matter how good its privacy policy looks on paper. I also check how many devices one subscription covers, since most households have a laptop, a couple of phones, and often a tablet or smart TV wanting protection too. I went through <a href="https://kellssecurity.com/blog/what-a-vpn-actually-protects-you-from" data-mce-href="https://kellssecurity.com/blog/what-a-vpn-actually-protects-you-from">a proper feature by feature comparison</a> in an earlier post if you want the full breakdown. Server count matters less than people assume, what I actually check is whether there's a server close enough to give a genuinely fast connection, and whether switching locations takes one tap rather than being buried three menus deep.</p><h2>The Kill Switch and Other Features I Won't Compromise On</h2><p>A kill switch, the feature that cuts your internet entirely if the VPN connection drops, is non-negotiable for me, since without one a momentary drop can leave you browsing completely unprotected without any warning. I also check which protocol a provider uses by default, WireGuard tends to be faster and just as secure as the older OpenVPN standard, and a provider still relying only on outdated protocols is usually behind on other things too. Split tunnelling, the option to route only some apps through the VPN rather than everything, is one I use often, my banking app stays on the normal connection while everything else gets tunnelled, and it's worth checking for before you commit to a provider that doesn't offer it.</p><h2>What I Look For in Customer Support and Price</h2><p>Price matters, but I've learned not to chase the cheapest option purely because it's cheap. A VPN that costs a pound or two more a month but comes with responsive support and a kill switch that actually works is worth it the first time something goes wrong. I also check the length of the money-back guarantee, since a provider confident in its own product will happily give you thirty days to change your mind. I also test the live chat before I commit to anything, sending a genuine question and timing how long a real answer takes, since a support team that's slow to respond during a sales enquiry is unlikely to get faster once you're already a paying customer with an actual problem.</p><h2>How I Compare Two VPN Services Side by Side</h2><p>When someone sends me two VPNs and asks which one is better, I don't start with the price. I put the same five questions to both. Has the no-logs policy been checked by an independent auditor, and when? Where is the company legally based? Does it offer WireGuard and a kill switch on every device, not just the desktop app? How many devices does one plan cover? And how long is the money-back guarantee? Whichever one gives clear answers on its own website, without me having to dig through a forum, usually wins. If both pass, I install each one during the refund window and use it for a normal week. Speed tests on a review site tell you far less than how a VPN feels on your own broadband and your own phone.</p><h2>VPN Questions I Get Asked</h2><h3>Are free VPNs safe to use?</h3><p>Mostly, no. Running a VPN costs real money, so free services often make it back by collecting and selling your data, limiting your speed, or showing ads. A paid VPN costs a few pounds a month and is a much safer bet.</p><h3>Is it legal to use a VPN in the UK?</h3><p>Yes. Using a VPN is completely legal in the UK. What's illegal offline is still illegal online, of course, but using a VPN to protect your privacy is perfectly normal.</p><h3>Will a VPN slow down my internet?</h3><p>A little, but with a good provider you usually won't notice. Picking a server close to you and using the WireGuard protocol keeps things fast.</p><h3>Do I need a VPN at home?</h3><p>It's most important on public Wi-Fi, in cafes, hotels and airports. At home it still hides your browsing from your internet provider, but it's less essential. I've written about <a href="https://kellssecurity.com/blog/what-a-vpn-actually-protects-you-from" data-mce-href="https://kellssecurity.com/blog/what-a-vpn-actually-protects-you-from">what a VPN actually protects you from</a> if you want to decide for yourself.</p><h3>How many devices can I use one VPN on?</h3><p>It depends on the provider, but most paid plans cover several devices at once. Count up the phones, laptops and tablets in your house before you buy, so you don't end up paying for a second plan.</p><h2>My Recommendation If You Just Want This Decided For You</h2><p>If you'd rather skip the research and just want a straight answer, I use and recommend <a href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" target="_blank" rel="noopener" data-mce-href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902">NordVPN </a>for exactly the reasons above, an independently audited no-logs policy, strong speeds, and support that's genuinely useful when you need it. Pair that with a password manager like <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass </a>and you've covered two of the biggest gaps in most people's setup in one afternoon. If you want a second opinion on your specific setup, my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">Safety Toolkit </a>has both, or <a href="https://kellssecurity.com/contact" data-mce-href="https://kellssecurity.com/contact">get in touch </a>and I'll talk you through it. Either way, don't let the number of options out there talk you into doing nothing, a mid-range paid VPN from a properly audited provider covers you far better than no VPN at all while you wait for the perfect one to reveal itself.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

How to Choose a VPN Service: What I Actually Look For

<h2>Why I Still Get Nervous Typing In My Card Details</h2><p>I've been doing this a long time and I still feel a small flicker of doubt every time I type my card number into a new website. That flicker is doing you a favour, if you're honest with yourself about it. Online shopping scams cost shoppers hundreds of millions of pounds a year, and the numbers spike hard around big sale periods, when everyone's guard drops because they're rushing to grab a bargain before it disappears. I've written before about the <a href="https://kellssecurity.com/blog/the-online-shopping-rules-i-never-break-at-christmas" data-mce-href="https://kellssecurity.com/blog/the-online-shopping-rules-i-never-break-at-christmas">seasonal spike in scams around Christmas</a>, and the same instincts apply whenever you're buying from somewhere unfamiliar, not just in December.</p><figure id="figure-v0p7pe16lmt9znnxf"><img id="v0p7pe16lmt9znnxf" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Woman checking her phone at home, How I Actually Shop Online Without Getting Scammed" src="https://cdn.durable.co/covers/2DLj7xKFDiOptcvFJMNkt0lNwyA4nwZJW6kLw9dOurAj5Narss34RChvGD7LyedU.jpg" alt="Woman checking her phone at home, How I Actually Shop Online Without Getting Scammed" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/2DLj7xKFDiOptcvFJMNkt0lNwyA4nwZJW6kLw9dOurAj5Narss34RChvGD7LyedU.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>The Checks I Run Before I Buy From a New Site</h2><p>Before I hand over any card details to a shop I haven't used before, I run through a short checklist. I look for a proper company name, a UK address, and a contact page that isn't just a form disappearing into the void. I check the web address starts with https and has the little padlock, though I don't treat that as proof of anything on its own anymore, since scammers can get padlocks too. What I really trust is a quick search of the company name plus the word "reviews" or "scam", because genuine problems tend to show up fast in other people's experiences. If a site's only reviews are five stars and suspiciously generic, that's usually the real red flag, not the padlock. I also check whether a returns policy actually exists and whether it's specific rather than vague, since a shop with no real returns process in place is often not planning on being around long enough to honour one anyway.</p><h2>How I Pay When I Want an Extra Layer of Protection</h2><p>The payment method matters almost as much as the site itself. I always use a credit card rather than a debit card for anything over about £100, because Section 75 protection means the card company is jointly liable if something goes wrong, which is a real legal backstop that a debit card just doesn't give you. I never pay by bank transfer to an individual seller I don't know, no matter how convincing the story is, because once that money's gone, it's gone. I also use a password manager like <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass </a>for every shopping account I create, so a breach at one retailer doesn't hand someone the keys to my email or my banking too. I also glance through my card statement every few weeks rather than waiting for the monthly summary, since catching an unfamiliar charge within days makes a dispute far easier to resolve than spotting it a month later.</p><h2>The Marketplace and Reseller Sites I'm Extra Careful With</h2><p>Marketplaces and reseller sites get a different level of caution from me than an established retailer's own website, since anyone can list anything and there's rarely a company standing behind the transaction the way there would be with a normal shop. I stick to the platform's own payment system rather than being talked into paying directly, use its dispute process, and message the seller through the platform itself so there's a record if something goes wrong. Anyone who wants to move the conversation to text messages or a different payment app the moment you show interest is one of the clearest warning signs I know, since it takes you out of the reach of the protections you'd otherwise have.</p><h2>The Deals That Are Almost Always a Trap</h2><p>If a deal looks too good, it usually is, and I say that as someone who still gets tempted by a "70% off, today only" banner more than I'd like to admit. Fake ads for big-brand trainers, electronics, and garden furniture are everywhere on social media at the moment, often running from accounts that were created a few weeks ago and have almost no followers. I check how long a page has existed and whether it has genuine engagement before I trust an ad, and if I'm shopping on public wifi in a café, I make sure I'm connected through a VPN like <a href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" target="_blank" rel="noopener" data-mce-href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902">NordVPN </a>first, since public networks are exactly the kind of place card details get intercepted. The same goes for fake shopping apps that mimic a well known retailer's branding closely enough to fool a quick glance, I only download shopping apps through the official app store and I check the developer name matches the real company before I trust it with any card details.</p><h2>Why I Double Check Delivery and Tracking Details</h2><p>A scam doesn't always happen at the checkout, sometimes it shows up afterwards, in a text or email claiming there's a problem with delivery and asking for a small fee to release the parcel. Legitimate couriers don't usually ask for payment by text link, so I go to the courier's own website or app directly rather than tapping anything in the message. I also keep an eye on the tracking number a retailer actually gives me, since a purchase that never generates a proper tracking number at all is one of the quieter signs something wasn't right from the start.</p><h2>What I Do If a Purchase Goes Wrong</h2><p>If something does go wrong, speed matters. I contact my card provider straight away to flag the transaction and start a dispute, keep every email, screenshot, and order confirmation as evidence, and report the scam to <a href="https://www.actionfraud.police.uk" target="_blank" rel="noopener" data-mce-href="https://www.actionfraud.police.uk">Action Fraud </a>so it's on record and can be linked to other reports about the same seller. <a href="https://kellssecurity.com/blog/why-i-treat-two-factor-authentication-as-non-negotiable" data-mce-href="https://kellssecurity.com/blog/why-i-treat-two-factor-authentication-as-non-negotiable">Two factor authentication </a>on my accounts means that even if my shopping details end up in a breach somewhere, it's much harder for anyone to actually get into my accounts and cause more damage. If you want help going through your own setup before your next big shop, my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">Safety Toolkit </a>is a good starting point, or you can <a href="https://kellssecurity.com/contact" data-mce-href="https://kellssecurity.com/contact">get in touch </a>and I'll talk you through it. I also make a note of exactly when I reported it and to whom, since a scam that gets reported quickly is far easier for a bank or Action Fraud to act on than one reported weeks after the fact.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

How I Actually Shop Online Without Getting Scammed

<h2>The Text That Starts It All</h2><p>It's December, the doorbell hasn't rung in two days, and then a text lands: "Your parcel could not be delivered. Please rearrange delivery here." There's a link. It looks legitimate enough, styled like <a href="https://www.royalmail.com/help-and-support/scams-and-fraud" target="_blank" rel="noopener" data-mce-href="https://www.royalmail.com/help-and-support/scams-and-fraud">Royal Mail </a>or a well known courier, and because you're actually expecting three or four parcels this time of year, your brain doesn't pause the way it might in June. That's exactly what makes this the busiest scam text of the year, and I get sent screenshots of it from people in all over the place almost every week between November and Christmas.</p><h2>Why December Is Prime Time for This</h2><p>Scammers don't need to guess whether you're expecting a delivery in December, because almost everyone is. The volume of real courier texts goes up at the same time, so a fake one slips in among genuine ones without standing out. This is smishing, the text message version of phishing, and it works on the same principles<a href="https://kellssecurity.com/blog/the-layers-of-protection-i-rely-on-before-a-phishing-email-ever-reaches-me" data-mce-href="https://kellssecurity.com/blog/the-layers-of-protection-i-rely-on-before-a-phishing-email-ever-reaches-me"> I've covered before</a>. The link usually leads to a page asking for a small "redelivery fee" and your card details, or it prompts you to download something under the guise of tracking your parcel. Either way, the goal is the same: get your card number, or get access to your device. The couriers themselves change depending on where you are, it might be Royal Mail, USPS, DHL, or a local delivery firm nobody outside your own country would recognise, but the format of the scam text barely varies at all, which tells you it's a template being reused globally rather than anything targeted specifically at you.</p><h2>How I Tell a Real Delivery Update From a Fake One</h2><p>I never click a link in a text about a delivery, no matter how convincing it looks. If I'm expecting something, I go straight to the retailer's own order tracking page or the courier's official app, which I've downloaded directly from the app store rather than through any link. Genuine couriers in the UK don't usually ask for a card payment to redeliver a parcel that's already been paid for, so any message asking for money to "release" a delivery is a strong sign something's wrong. If I'm not expecting anything at all, the text goes straight in the bin, or gets reported. I also don't save my card details in my browser's autofill for exactly this reason, since a fake redelivery page can only take what's actually sitting there to be taken. I use <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass </a>to fill payment details only on sites I've actually chosen to visit myself, never on a page I landed on through a text link.</p><figure id="figure-qvedyew5r9mta5l99m"><img id="qvedyew5r9mta5l99m" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Man smiling as he uses his phone safely, The Delivery Scams I See Every December" src="https://cdn.durable.co/covers/22JGHvhqAR5zn3MLuxQlQkBE0erI5OO5GkH1wdZLu1DaA6xHoKImht9cHhDDTgyq.jpg" alt="Man smiling as he uses his phone safely, The Delivery Scams I See Every December" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/22JGHvhqAR5zn3MLuxQlQkBE0erI5OO5GkH1wdZLu1DaA6xHoKImht9cHhDDTgyq.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>The Fake Customs and Import Fee Message</h2><p>A close cousin of the delivery text is the one claiming your parcel is stuck at customs, held up by an unpaid import duty, or waiting on a small clearance fee before it can be released. These land more often around the holidays too, since genuine customs charges on international orders are common enough this time of year that the fake version doesn't stand out. The tell is usually in how it asks you to pay, a legitimate customs bill from a courier or tax authority doesn't normally get settled by tapping a link in a text message and entering your card there and then. If I'm ever unsure whether a customs charge is real, I go to the courier's official app or website directly and check my parcel's status from there, the same rule I use for any delivery text.</p><h2>The Other December Scam I Watch For: Gift Cards</h2><p>The second one I see a lot in December involves gift cards, not deliveries. It usually starts as a message claiming to be from a friend, a boss, or even a family member, asking you to urgently buy gift cards and send over the codes. It plays on the rush of the season, when people are already buying gift cards as presents anyway, so the request doesn't feel as odd as it should. No legitimate request, personal or professional, will ever ask you to pay in gift cards. If you get one, call the person directly on a number you already have, not one from the message, before you do anything else. The messages are usually specific about the brand too, Apple, Amazon, and Google Play gift cards come up constantly, since the codes on those are instantly usable and effectively untraceable once they've been sent. If a "boss" is asking you to buy several hundred pounds worth of gift cards over text with no prior conversation about it, that alone is worth treating as the red flag it is.</p><h2>The Porch Piracy Problem, and What Actually Helps</h2><p>Not every December delivery problem is a scam text, sometimes a parcel really does get taken off a doorstep before anyone notices. It's a different kind of risk, but it spikes at the same time of year for the same reason, more parcels sitting outside for longer. The fixes that actually help are fairly boring: choosing a delivery slot when you know someone will be home, adding delivery instructions that specify a less visible spot than directly in front of the door, or switching to a collection point or locker for anything you're not expecting to be home for. A cheap video doorbell has also become one of the more effective everyday deterrents I've seen, not because footage gets someone's parcel back, but because visible cameras put a lot of opportunistic thieves off before they even try.</p><h2>What I Do When a Parcel Actually Goes Missing</h2><p>Real missing parcels do happen, and the process for that looks nothing like the scam texts. I contact the retailer I bought from directly, since they're responsible for getting my order to me, not the courier. I check the tracking through the retailer's own account page, and if a delivery photo shows a parcel left somewhere I don't recognise, I report it to the retailer with a screenshot. For scam texts, I forward the suspicious message to 7726 for free, which flags it to my mobile provider, and if money or details have actually been taken I report it to <a href="https://www.actionfraud.police.uk" target="_blank" rel="noopener" data-mce-href="https://www.actionfraud.police.uk">Action Fraud</a>. I've written before about<a href="https://kellssecurity.com/blog/the-online-shopping-rules-i-never-break-at-christmas" data-mce-href="https://kellssecurity.com/blog/the-online-shopping-rules-i-never-break-at-christmas"> the wider run of Christmas shopping scams</a> and <a href="https://kellssecurity.com/blog/how-i-actually-shop-online-without-getting-scammed" data-mce-href="https://kellssecurity.com/blog/how-i-actually-shop-online-without-getting-scammed">the secure payment habits </a>that back all of this up, and together they cover most of what catches people out this time of year. If a message doesn't sit right with you, my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">Safety Toolkit </a>has more on spotting these, or you can <a href="https://kellssecurity.com/contact" data-mce-href="https://kellssecurity.com/contact">get in touch</a> and I'll take a look with you. None of these habits take more than a few seconds once they're second nature, and that's really the whole point, the scam relies on you reacting fast, so reacting slow is usually all it takes to beat it.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The Delivery Scams I See Every December

<h2>Why Personal Information Is Worth More Than People Think</h2><p>Your personal information is worth more than you'd think, and not just to you. Your name, date of birth, address, and a few answers to "security questions" are often all a scammer needs to open credit in your name or talk their way past a call centre pretending to be you. Companies want it too, sometimes for good reasons and sometimes just to sell you things. I don't think you need to become paranoid about this, but I do think most people hand over far more than they realise, far more often than they need to. It's not always a single leak that causes the damage either. Scammers and data brokers piece together fragments from different places, a date of birth here, a pet's name there, a mother's maiden name from an old quiz, until they've got enough to answer your bank's security questions without ever having spoken to you.</p><p><br></p><h2>The Information I Never Give Out Without a Reason</h2><p>There's a short list of details I treat as genuinely sensitive: my date of birth, my home address, my mother's maiden name, and anything that looks like a security question answer. If a website, a caller, or a text message asks for one of these out of nowhere, I stop and ask myself why they actually need it. A genuine bank will never ask you to confirm your full password or PIN over the phone. A genuine competition doesn't need your date of birth to enter you into a prize draw. When in doubt, I give the minimum required and nothing more. I also treat my phone number the same way now, since it's become one of the easiest ways to reset a password or receive a one-time code meant for someone else. If a form doesn't explain why it needs it, I either skip that field or use a secondary number I don't mind being found.</p><p><br></p><h2>The Data Broker Sites Nobody Warns You About</h2><p>Even if you're careful about what you post, there's a whole industry built around collecting and reselling your personal details anyway. Data broker and people-search sites scrape public records, electoral rolls, and old data breaches, then package it into a profile anyone can buy for a few pounds, your address history, phone number, relatives, even a rough idea of your income. Most people have never heard of these sites until they find themselves listed on one. I check mine every few months and send removal requests where they're offered, since a five-minute form is a small price for getting your details off a site designed to be searched by strangers.</p><h2>Where Most People Leak Data Without Realising</h2><p>Most of the damage isn't done by a dramatic hack. It's done a little at a time, through things that feel harmless. A "which Harry Potter character are you" quiz that asks for your birthday. A loyalty card sign-up that wants your full address and phone number. An app that asks for access to your contacts, location, and photos just to let you crop an image. Social media profiles set to public, with a birthday, hometown, and school all sitting there for anyone to piece together. None of these feel dangerous on their own, which is exactly why they work. Browser extensions are another one I'd add to that list, a free tool that wants access to every page you visit is effectively reading your email and banking sessions too, whether or not it ever misuses that access.</p><p><br></p><h2>The Habits That Actually Protect It</h2><p>The habits that make the biggest difference are boring, and that's fine by me. I use a <a href="https://kellssecurity.com/blog/how-id-choose-a-password-manager-if-i-were-starting-today" data-mce-href="https://kellssecurity.com/blog/how-id-choose-a-password-manager-if-i-were-starting-today">password manager </a>so every account has a different, properly random password instead of a variation on the same one. I turn on two factor authentication everywhere it's offered, so a leaked password alone isn't enough to get in. I go through my social media privacy settings every so often and lock down anything that doesn't need to be public. And I've got into the habit of pausing before I fill in a form, just long enough to ask whether this particular website genuinely needs my date of birth to sell me a phone case. I've also started using a separate email address for sign-ups and competitions I don't fully trust, so anything that leaks stays contained to an inbox I barely check rather than the one my bank and family actually use.</p><figure id="figure-kcjyb58ydsmta6hb88"><img id="kcjyb58ydsmta6hb88" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Woman reading online safety advice on her laptop, How I Protect My Personal Information Online" src="https://cdn.durable.co/covers/1b6yok9RJBZAfVJCU68TtCAefcOkWASoEAg2dAh9pXKihM78nnfL0P7qcT5IAgmm.jpg" alt="Woman reading online safety advice on her laptop, How I Protect My Personal Information Online" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/1b6yok9RJBZAfVJCU68TtCAefcOkWASoEAg2dAh9pXKihM78nnfL0P7qcT5IAgmm.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><p><br></p><h2>What I Think Twice About Before Posting Publicly</h2><p>Social media is where a lot of this information ends up handed over voluntarily, not stolen. A holiday countdown post tells the world your house is empty on a specific date. A "first day back at school" photo with the uniform badge visible can tell a stranger which school your child attends. Even a birthday post from friends in the comments can confirm a date of birth you've otherwise kept private. None of this means staying off social media, it just means asking whether a post needs to go out in real time, or whether it can wait until after the fact.</p><h2>What I Do If My Information Has Already Been Exposed</h2><p>If you think your details have already been caught up in a data breach, you can check services like <a href="https://haveibeenpwned.com" target="_blank" rel="noopener" data-mce-href="https://haveibeenpwned.com">Have I Been Pwned</a> to see whether your email address has turned up in a known leak. If it has, change the password on that account and anywhere else you've reused it, and turn on<a href="https://kellssecurity.com/blog/why-i-treat-two-factor-authentication-as-non-negotiable" data-mce-href="https://kellssecurity.com/blog/why-i-treat-two-factor-authentication-as-non-negotiable"> two factor authentication</a> if you haven't already. Keep an eye on your bank statements for anything you don't recognise, and report anything that looks like fraud to <a href="https://www.actionfraud.police.uk" target="_blank" rel="noopener" data-mce-href="https://www.actionfraud.police.uk">Action Fraud</a>. My <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">Safety Toolkit </a>has more on locking things down properly, or you can<a href="https://kellssecurity.com/contact" data-mce-href="https://kellssecurity.com/contact"> get in touch</a> and I'll help you work through it. It's worth doing this check periodically even if nothing feels wrong, since some breaches surface publicly months or years after they actually happened, and the first you'll hear of it is a service like this flagging your details rather than the company involved telling you directly.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

How I Protect My Personal Information Online

<h2>Why Antivirus Still Confuses So Many People</h2><p>Antivirus software has been around since before most of us had home computers, yet it's still one of the most misunderstood tools in anyone's digital toolkit. Clients tell me they've either given up on it entirely because "it slows everything down" or they think one program installed years ago is quietly protecting them forever. Neither is true. Antivirus software is a genuinely useful layer of protection, but only if you understand what it actually does and, just as importantly, what it doesn't.&nbsp; The confusion isn't really the software's fault, it's that most of us were never told what it's actually supposed to cover and what it was never designed to. If you're comparing options, I've set out how I choose <a href="https://kellssecurity.com/blog/how-i-actually-compare-antivirus-software" data-mce-href="https://kellssecurity.com/blog/how-i-actually-compare-antivirus-software">the best antivirus software in the UK</a> in a separate guide.</p><h2>Myth: Antivirus Alone Keeps You Completely Safe</h2><p>This is the myth that worries me most because it breeds a false sense of security. Antivirus software is brilliant at catching known malware and suspicious file behaviour, but it can't stop you from typing your password into a convincing fake login page, and it won't warn you that the urgent email from your bank is actually a <a href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything" data-mce-href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything">phishing attempt</a>. Think of it as one guard on the door, not the whole security system. You still need good habits alongside it, including strong unique passwords stored in a <a href="https://kellssecurity.com/blog/how-id-choose-a-password-manager-if-i-were-starting-today" data-mce-href="https://kellssecurity.com/blog/how-id-choose-a-password-manager-if-i-were-starting-today">password manager </a>and <a href="https://kellssecurity.com/blog/why-i-treat-two-factor-authentication-as-non-negotiable" data-mce-href="https://kellssecurity.com/blog/why-i-treat-two-factor-authentication-as-non-negotiable">two factor authentication </a>on anything that matters. The two work together, the antivirus catches what slips past your judgement and your judgement catches what the antivirus was never built to recognise in the first place.</p><h2>Myth: One Scan a Week Is Enough to Stay Protected</h2><p>A lot of people only think about their antivirus when they remember to run a manual scan, treating it like a chore rather than something that's meant to be working constantly. Real time protection is the part that actually matters, it's watching files as they're downloaded and programs as they run, catching a threat the moment it lands rather than however many days later your next scheduled scan happens to be. A weekly scan is a reasonable extra check, not a substitute for the always-on protection your antivirus is supposed to be providing in the background.</p><h2>Myth: Free Antivirus Is Just as Good as Paid</h2><p>Free antivirus tools aren't useless, and something is usually better than nothing. But most free versions strip out real time protection or regular updates in favour of the paid tier, and some fund themselves by collecting and selling your browsing data, which rather defeats the point of using security software in the first place. If you're relying on a free tool, at least know what it's leaving out so you're not caught assuming you're covered when you're not. If a free tool is genuinely all you can manage right now, pair it with extra caution on email links and unfamiliar downloads to cover some of the gap it's leaving open.</p><h2>Myth: Antivirus Slows Your Computer Down Too Much to Bother</h2><p>This one was true a decade ago and it's the reason so many people switched theirs off and never turned it back on. Modern antivirus software runs quietly in the background and barely touches performance on anything built in the last few years. If yours is genuinely grinding your machine to a halt, it's usually a sign the software is outdated, poorly configured, or fighting with another security tool you've also got installed, not that antivirus itself is the problem. If switching it back on still feels like a performance hit, it's worth checking you're not running two antivirus programs at once, since that conflict alone can drag a machine down far more than either product would on its own.</p><h2>Myth: If My Antivirus Isn't Alerting Me, Nothing's Wrong</h2><p>Silence isn't always a good sign. I've seen antivirus subscriptions quietly expire, updates fail to download, or a program get disabled by an install that conflicted with it, all without a single obvious warning on screen. It's worth actually opening the app every so often to check it's still active, still updating, and still set to scan automatically, rather than assuming a lack of pop-ups means everything's fine. A few seconds of checking beats finding out it stopped working months ago.</p><h2>Myth: Macs Don't Get Viruses</h2><p>I still hear this from people who've never had a problem and assume that means they're protected rather than lucky, or simply less targeted than they used to be. Apple's operating system does have a solid security architecture, and for a long time Macs represented too small a slice of the market for most attackers to bother with. Neither of those things makes a Mac immune, and as Apple's user base has grown, so has the attention from people writing malware aimed specifically at macOS. I've seen this catch out Mac-owning friends who believed the myth, clicking through things on their Mac they'd never have touched on a Windows machine because they didn't think it applied to them.</p><h2>Myth: Windows Defender Is All I Need</h2><p>Windows Defender has improved over the years and it's no longer the afterthought it used to be, built in and switched on by default rather than something you have to think about installing. For a lot of casual, careful users it does an adequate baseline job. Where it tends to fall short in independent testing is against the newest threats and more targeted attacks, the ones that haven't been seen widely enough yet to be caught by broader detection. If you're someone who banks online, shops online, and clicks the odd link you're not fully sure about, which describes most people I know, a dedicated antivirus product with a stronger track record against zero-day threats is worth having layered on top rather than relying on the built-in option alone.</p><h2>Myth: I Don't Click on Anything Dodgy, So I Don't Need It</h2><p>I understand the logic here, and being careful about what you click matters, it's one of the biggest factors in staying safe online. But it assumes every infection starts with a mistake you'd notice making. Malware can arrive through a compromised website that looks completely legitimate, through an infected file a colleague or family member sends you without knowing it's infected, or through an ad on an otherwise trustworthy site. Being careful reduces your risk considerably, it doesn't eliminate it, and antivirus software is there to catch the cases your own judgement was never going to catch in the first place, because there was nothing obviously wrong to notice. I think of it the same way I think about a smoke alarm: being careful with candles and the cooker matters, but I still want something running in the background that catches the situation I never saw coming.</p><h2>What I Actually Look For in Antivirus Software</h2><p>I want real time scanning, automatic updates, decent <a href="https://www.ncsc.gov.uk/collection/essentials-for-small-businesses/what-is-ransomware" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/collection/essentials-for-small-businesses/what-is-ransomware">ransomware protection</a>, and a company with a solid track record rather than the cheapest name I've never heard of. <a href="https://www.bitdefender.com/en-us/consumer/?irclickid=WxSzmdWRXxyZWsOzKNx6sWZFUkrxGHQpm0ekVY0&amp;im_rewards=&amp;irgwc=1&amp;afsrc=1&amp;MPid=6273270&amp;cid=aff|c|IR|Cyber%20Jay" target="_blank" rel="noopener" data-mce-href="https://www.bitdefender.com/en-us/consumer/?irclickid=WxSzmdWRXxyZWsOzKNx6sWZFUkrxGHQpm0ekVY0&amp;im_rewards=&amp;irgwc=1&amp;afsrc=1&amp;MPid=6273270&amp;cid=aff|c|IR|Cyber%20Jay">Bitdefender </a>is the one I actually run myself, it ticks every box on that list without slowing anything down. I also want it working alongside the rest of my setup, a <a href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" target="_blank" rel="noopener" data-mce-href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902">VPN </a>when I'm on public wifi and two factor authentication everywhere it's offered. None of these tools do the whole job alone. If you want a look at exactly what I use and recommend, my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">Safety Toolkit </a>page has the lot laid out in one place. And if you're not sure whether your current setup is doing enough, <a href="https://kellssecurity.com/contact" data-mce-href="https://kellssecurity.com/contact">get in touch </a>and I'll take a look. None of it needs to be complicated, it just needs to actually be running and actually be checked, which is more than most setups can honestly claim.</p><figure id="figure-8k0cpc9hfwmtad9h80"><img id="8k0cpc9hfwmtad9h80" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Man working at a desk with online safety in mind, Common Antivirus Software Myths, and What's Actually True" src="https://cdn.durable.co/covers/4IoZLwzEazYn5vx7hOa2BVriIWr70ma5OwxhttLbWrDsOynBuSFRKZ3fDy3HrhLt.jpg" alt="Man working at a desk with online safety in mind, Common Antivirus Software Myths, and What's Actually True" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/4IoZLwzEazYn5vx7hOa2BVriIWr70ma5OwxhttLbWrDsOynBuSFRKZ3fDy3HrhLt.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

Common Antivirus Software Myths, and What's Actually True

Kells Security Solutions

I teach people around the world how to spot online scams and stay safe on the internet, explained in plain English with no jargon. I cover phishing emails, two-factor authentication, password managers, VPNs and antivirus software, written for people who are not tech experts and want to protect themselves and their families.