Blog

<p>Your online presence is bigger than you think. It's not just your social media profiles, it's old forum posts, business directory listings, forgotten accounts, and scraps of personal information sitting on data broker sites you've never heard of. Most people have never actually looked at what's out there under their name, and once you do, it's usually more than expected. I help people get a proper handle on it, not by disappearing off the internet entirely, but by taking back control of what's visible and locking down what needs to be private. It's rarely anything dramatic, just years of digital clutter that quietly add up to more than you'd expect.</p><h2>Start By Googling Yourself</h2><p>The simplest first step costs nothing and takes five minutes. Search your own name, your email address, and your phone number, and see what turns up. You might find an old MySpace-era profile, a business listing with your home address on it, or a comment you left on a forum a decade ago that you completely forgot existed. This is exactly the kind of scattered <a href="https://kellssecurity.com/blog/how-i-protect-my-personal-information-online" data-mce-href="https://kellssecurity.com/blog/how-i-protect-my-personal-information-online">personal information </a>that scammers piece together to make phishing attempts feel personal and convincing, so it's worth knowing what's actually out there before you decide what to do about it. It's worth doing a quick image search on your name and main profile photo too, since that often surfaces old accounts and tagged photos a plain text search misses entirely.</p><h2>The Kind of Things That Turn Up</h2><p>Alongside the obvious social profiles, you'll often find old employer bios, community group listings, marketplace ads you posted years ago, and review site profiles with your full name attached. None of it is dramatic on its own, but pieced together it builds a surprisingly detailed picture of who you are, where you've worked, and what you're interested in, which is exactly the kind of detail that makes a scam message feel personal rather than generic.</p><h2>Lock Down Your Social Media Privacy Settings</h2><p>Facebook, Instagram, and TikTok all default to sharing more than most people realise. Go through your privacy settings properly rather than trusting whatever was set when you signed up years ago. Check who can see your posts, whether your friends list is public, if your location is being tagged automatically, and who can find your profile through a phone number or email search. None of this stops you using the platforms normally, it just means a stranger scrolling through can't build a picture of your daily routine, your family, or your address from a few minutes of clicking around. It's worth doing this on every platform you actually use, not just the one you check most often, since the ones you've half-abandoned are usually left on their loosest default settings.</p><figure id="figure-ju1zxia379mtaecg0x"><img id="ju1zxia379mtaecg0x" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Laptop on a desk being kept up to date, Getting Your Online Presence Under Control" src="https://cdn.durable.co/covers/1eIcH0PYPPse9y9EvviBdOBAWMXawnR1P7ap30fM6N8xpR3gsZOa6lpCYxOXYe7d.jpg" alt="Laptop on a desk being kept up to date, Getting Your Online Presence Under Control" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/1eIcH0PYPPse9y9EvviBdOBAWMXawnR1P7ap30fM6N8xpR3gsZOa6lpCYxOXYe7d.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>Old Accounts Are a Bigger Risk Than You Think</h2><p>The accounts you've forgotten about are often the ones causing the most damage. An old shopping site with saved card details, a forum you joined once and never returned to, a fitness app you tried for a month three years ago, they're all sitting there holding your personal information with security standards you have no way of checking. I'd recommend running your email through <a href="https://haveibeenpwned.com" target="_blank" rel="noopener" data-mce-href="https://haveibeenpwned.com">Have I Been Pwned </a>to see which accounts have already been caught up in a data breach, then either delete what you don't use or properly secure what you're keeping with a <a href="https://kellssecurity.com/blog/how-id-choose-a-password-manager-if-i-were-starting-today" data-mce-href="https://kellssecurity.com/blog/how-id-choose-a-password-manager-if-i-were-starting-today">password manager </a>and <a href="https://kellssecurity.com/blog/why-i-treat-two-factor-authentication-as-non-negotiable" data-mce-href="https://kellssecurity.com/blog/why-i-treat-two-factor-authentication-as-non-negotiable">two factor authentication</a>. <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass </a>is what I use myself, and it makes tidying up old accounts far less painful than doing it from memory. Even accounts you're sure you closed years ago are worth double checking, since some services keep your data on file long after the account itself stops being active.</p><h2>Getting Old Listings Actually Taken Down</h2><p>Finding something is only half the job, getting it removed is the other half. Most sites have a contact or webmaster email buried in the footer, and a polite request asking them to take your listing down usually works, though it can take a few weeks. For search results specifically, Google has a "Results about you" tool that lets you request certain personal information be removed from search even when the underlying page stays up. Data broker sites tend to be the slowest to respond, so don't expect an instant result, just keep a note of what you've requested and follow up if nothing's changed after a month.</p><h2>Building the Habit of Staying On Top of It</h2><p>This isn't a one-off job you tick off and forget about. New accounts get created, old ones get abandoned, and your online presence keeps quietly growing whether you're paying attention or not. I'd suggest setting a reminder every few months to search your own name again and glance through your privacy settings, the same way you'd check your bank statement. If you want a proper starting point, my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">Safety Toolkit </a>page has the tools I actually recommend for this, and if you're not sure where your own online presence stands, <a href="https://kellssecurity.com/contact" data-mce-href="https://kellssecurity.com/contact">get in touch </a>and I'll help you figure out what needs sorting first. It sounds tedious written down, but in practice it's a five minute check every few months, not an ongoing project.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

Getting Your Online Presence Under Control

<p>Your home network is the front door to everything you do online, yet most people set up their router once and never think about it again. If you've got a house full of laptops, phones, smart speakers and a doorbell camera all leaning on the same wifi signal, it's worth spending twenty minutes getting the basics right. None of this needs technical wizardry. I'll walk you through exactly what I check on my own network, step by step. Twenty minutes now saves a lot of hassle later, and none of it requires calling anyone out.</p><h2>Change the Router's Default Login</h2><p>Every router ships with a default username and password, usually printed on a sticker on the underside. The trouble is those defaults are public information, published in manuals and forums for anyone to find. If you've never changed yours, that's the first job. Log into your router's admin panel (the address is usually on that same sticker), find the login settings and set something unique. This is exactly the kind of credential worth storing in a <a href="https://kellssecurity.com/blog/how-id-choose-a-password-manager-if-i-were-starting-today" data-mce-href="https://kellssecurity.com/blog/how-id-choose-a-password-manager-if-i-were-starting-today">password manager </a>rather than trying to remember. Worth doing this even on a router your provider set up for you, since plenty of ISP-supplied routers ship with the same default credentials for every customer.</p><h2>Use a Strong, Separate Wifi Password</h2><p>Your wifi password and your router login are two different things, and both need attention. Skip anything based on your address, your name or a keyboard pattern; those are the first guesses in any list of common passwords. Aim for a long phrase rather than a short jumble of characters, something like four random words strung together. It's easier to remember and harder to crack than any single word with a number stuck on the end. If your router supports it, a password manager can generate and store this one too, so you're not stuck trying to remember a random four-word phrase yourself.</p><figure id="figure-ewac5gq859mtafioj9"><img id="ewac5gq859mtafioj9" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Security specialist at a desk watching monitors, Securing Your Home Network Step by Step" src="https://cdn.durable.co/covers/36HC6bcG98STsH7U6tzpXw7Lo2Xo7krHuCRWiu1mBJ7PPP0ZaRmDxEBR2606FW7D.jpg" alt="Security specialist at a desk watching monitors, Securing Your Home Network Step by Step" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/36HC6bcG98STsH7U6tzpXw7Lo2Xo7krHuCRWiu1mBJ7PPP0ZaRmDxEBR2606FW7D.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>Set Up a Guest Network for Visitors and Smart Devices</h2><p>Most routers let you create a second, separate wifi network for guests, and I'd go further: use it for your smart devices too. Smart plugs, doorbells and speakers are notorious for weak security, and if one gets compromised, a guest network keeps it away from the laptop where you do your banking. It also means you're not handing out your main password every time someone pops round. It's also the easiest way to hand internet access to visiting family without reading out your real password every time they come round.</p><h2>Turn Off WPS and Confirm You're Using WPA2 or WPA3</h2><p>While you're in the router settings, check two more things. WPS, the button that lets a device join your network without typing the password, is convenient but has a well-documented vulnerability that makes it easier to crack, so turn it off if you can find the option. While you're there, confirm your network is using WPA2 or WPA3 encryption rather than the older WEP standard, which modern tools can break in minutes rather than years.</p><h2>Keep Your Router's Firmware Updated</h2><p>Routers get security patches just like your phone or laptop, but nobody reminds you to install them. Check your router's admin panel every few months for firmware updates, and turn on automatic updates if your router supports it. It's a similar habit to switching on <a href="https://kellssecurity.com/blog/why-i-treat-two-factor-authentication-as-non-negotiable" data-mce-href="https://kellssecurity.com/blog/why-i-treat-two-factor-authentication-as-non-negotiable">two factor authentication </a>for your important accounts; small maintenance tasks that make a real dent in your overall risk. Older routers sometimes stop receiving updates entirely, and if yours hasn't had one in a couple of years, it might be worth replacing rather than trusting it to keep up.</p><h2>Securing the Smart Devices Themselves, Not Just the Network</h2><p>A locked-down router doesn't help much if the devices connecting to it are wide open. Change the default password on every smart plug, camera, or speaker the same way you changed your router's, since many ship with the same password across an entire product line. Keep their companion apps updated too, and switch off any remote-access feature you're not actually using, since that's often the easiest way in if the manufacturer's own servers are ever compromised.</p><h2>A Few Extra Habits Worth Building</h2><p>Beyond the router itself, a few habits go a long way: turn off remote management if you don't need to access your router while you're out, and check occasionally which devices are actually connected to your network. If your provider's router doesn't give you enough control, the <a href="https://www.ncsc.gov.uk/cyberaware/home" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/cyberaware/home">National Cyber Security Centre </a>has clear guidance on locking down your setup. And if you want an extra layer of privacy on top of a secure network, a service like <a href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" target="_blank" rel="noopener" data-mce-href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902">NordVPN </a>encrypts your traffic on the way out, which matters most on networks you don't control.</p><p>None of this needs to happen in one sitting. Work through it a step at a time, and if you get stuck or just fancy a second pair of eyes on your setup, <a href="https://kellssecurity.com/contact" data-mce-href="https://kellssecurity.com/contact">get in touch </a>and I'll help you sort it. You'll find more free guidance like this in my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">Safety Toolkit</a>, including checklists you can work through at your own pace. Protecting your <a href="https://kellssecurity.com/blog/how-i-protect-my-personal-information-online" data-mce-href="https://kellssecurity.com/blog/how-i-protect-my-personal-information-online">personal information </a>starts at home, quite literally, with the network everything else connects through. It's the kind of task that's easy to keep putting off precisely because nothing's gone wrong yet, which is exactly the point of doing it now rather than after it has.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

Securing Your Home Network Step by Step

<h2>Where I See Cybercriminals Getting In</h2><p>Cybercrime doesn't discriminate by postcode, and it hasn't slowed down. I hear from people every week who assumed they were too careful, too switched on, or too small to be a target. None of that matters to a scammer running the same script against thousands of people at once. Cybercriminals aren't picking locks anymore, they're walking through doors people left open without realising it. It's rarely one dramatic breach that catches people out, more often it's a handful of small oversights quietly stacking up.</p><p><br></p><p>The threats I see most often aren't complicated. They're phishing emails dressed up as delivery notices, fake invoices sent to small business owners, and password reuse that turns one leaked account into five. Understanding where the real risk sits is the first step, and it's usually much closer to home than people expect. None of this requires special expertise to fix, just a bit of attention paid where it usually isn't.</p><figure id="figure-4fqmutu868mtal5k0z"><img id="4fqmutu868mtal5k0z" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: undefined undefined;" title="Woman reading online safety advice on her laptop, How I Stay Ahead of Cybercriminals" src="https://cdn.durable.co/covers/1b6yok9RJBZAfVJCU68TtCAefcOkWASoEAg2dAh9pXKihM78nnfL0P7qcT5IAgmm.jpg" alt="Woman reading online safety advice on her laptop, How I Stay Ahead of Cybercriminals" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/1b6yok9RJBZAfVJCU68TtCAefcOkWASoEAg2dAh9pXKihM78nnfL0P7qcT5IAgmm.jpg" data-mce-style="aspect-ratio: 16/9; object-position: undefined undefined;"></figure><p><br></p><h2>Strong, Unique Passwords Are My Starting Point</h2><p><br></p><p>Every proper conversation about online safety starts here, because a weak or reused password is still the easiest way in. I've written before about the debate between using a <a href="https://kellssecurity.com/blog/how-id-choose-a-password-manager-if-i-were-starting-today" data-mce-href="https://kellssecurity.com/blog/how-id-choose-a-password-manager-if-i-were-starting-today">password manager </a>and just memorising a few passwords, and my answer hasn't changed: use a password manager. I rely on <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass </a>to generate and store mine, so I never have to reuse a password I can't quite remember across three different accounts. It also flags any password that's been caught up in a known breach, which is worth acting on the moment it happens rather than waiting to find out the hard way.</p><p><br></p><h2>Two-Factor Authentication Isn't Optional Anymore</h2><p><br></p><p>A strong password is a good lock, but<a href="https://kellssecurity.com/blog/why-i-treat-two-factor-authentication-as-non-negotiable" data-mce-href="https://kellssecurity.com/blog/why-i-treat-two-factor-authentication-as-non-negotiable"> two factor authentication</a> is the deadbolt behind it. I turn it on for every account that offers it, especially email and banking, because it's the one habit that stops a stolen password from actually being useful to whoever's holding it. It adds ten seconds to my login. That's a fair trade for not having my accounts drained while I'm asleep. I use an authenticator app rather than text-message codes wherever it's offered, since a code sent by SMS can be intercepted in ways an app-generated one can't.</p><p><br></p><h2>Checking Whether My Data's Already Been Exposed</h2><p>Passwords and two factor authentication only help with accounts you know about. Every few months I run my own email address through a breach-checking site to see whether it's turned up in a leak I hadn't heard about, and I'd recommend anyone do the same. If something does show up, it's usually an old account you'd forgotten existed, and it's worth changing that password and checking whether you reused it anywhere else before moving on.</p><h2>Watching Out for Phishing Scams</h2><p><br></p><p>I've covered the <a href="https://kellssecurity.com/blog/the-layers-of-protection-i-rely-on-before-a-phishing-email-ever-reaches-me" data-mce-href="https://kellssecurity.com/blog/the-layers-of-protection-i-rely-on-before-a-phishing-email-ever-reaches-me">phishing defences I actually rely on </a>in detail elsewhere, but the short version is this: I check the sender address before I click anything, I never trust urgency, and I go directly to a company's website rather than clicking a link in an email claiming to be from them. If something ever does slip through, <a href="https://www.actionfraud.police.uk/" target="_blank" rel="noopener" data-mce-href="https://www.actionfraud.police.uk/">Action Fraud</a> is where I'd report it. Voice calls and texts get the same treatment, since the pressure tactics are identical even when there's no email involved.</p><p><br></p><h2>Keeping Software Updated Without Thinking About It</h2><p><br></p><p>Software updates feel like an interruption, which is exactly why so many people put them off. Most of them exist to patch a security hole that's already being exploited somewhere. I keep automatic updates switched on across my phone, laptop and router, so I'm not the one deciding whether today's a good day to leave a known vulnerability open. Browser extensions are the thing most people forget are software too, and an old, unmaintained one is as good an entry point as an outdated operating system.</p><p><br></p><h2>Locking Down My Home Network</h2><p><br></p><p>I've written a full walkthrough on<a href="https://kellssecurity.com/blog/securing-your-home-network-step-by-step" data-mce-href="https://kellssecurity.com/blog/securing-your-home-network-step-by-step"> securing a home network step by step</a>, but the essentials are worth repeating here: change the router's default login, use a strong separate wifi password, and set up a guest network for visitors and smart devices. When I'm working from a cafe or anywhere with public wifi, I run <a href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" target="_blank" rel="noopener" data-mce-href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902">NordVPN </a>so my traffic isn't sat there in plain sight for anyone else on the same network. Routers get firmware updates too, and I check mine every so often rather than assuming it updates itself the way my phone does.</p><p><br></p><h2>Educating Myself and Everyone Around Me</h2><p><br></p><p>The tools only get you so far. The habits are what actually keep you safe, and habits spread faster when you talk about them. I make a point of walking family, friends and clients through the basics rather than assuming they'll pick it up on their own, and I keep my own <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">Safety Toolkit </a>updated with the tools and checklists I actually use. It doesn't take a lecture to make it land, most people are receptive once they realise it's about protecting them rather than catching them out.</p><p><br></p><h2>Final Thoughts</h2><p><br></p><p>Staying ahead of cybercriminals isn't about becoming paranoid or living without technology. It's a handful of habits, repeated consistently: a password manager, two factor authentication, a healthy suspicion of anything urgent in your inbox, and updates you don't put off. If you'd like a hand putting any of this in place, <a href="https://kellssecurity.com/contact" data-mce-href="https://kellssecurity.com/contact">get in touch </a>and I'll talk you through it. None of this is about becoming an expert, it's simply about not being the easiest target in the room.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

How I Stay Ahead of Cybercriminals

<h2>Why These Scams Still Catch People Out</h2><p>I get messages most weeks from people who've been caught out shopping online, and the pattern is always the same. It's not that they were careless. It's that the scam was built to look exactly like the real thing, right up until the money had already left their account. The volume climbs every year, and it's not because people are getting careless, it's because the fakes are getting harder to tell apart from the real thing.</p><p><br></p><h2>The Too Good To Be True Deal</h2><p><br></p><p>If a designer coat is eighty percent off on a site you've never heard of, that's not a bargain, that's bait. Scammers know a steep discount short circuits the part of your brain that would normally stop and check. My rule is simple: if the price makes me do a double take, I slow right down and look the seller up properly before I go anywhere near my card details. A genuine retailer doesn't need to panic you into buying in the next ten minutes, so a countdown timer on the checkout page is usually a red flag on its own.</p><p><br></p><h2>Fake And Cloned Shopping Websites</h2><p><br></p><p>Some of the fake shops I've seen are genuinely convincing, right down to a copied logo and a stolen product description. What gives them away is usually in the details: no proper contact address, reviews that all appeared in the same week, or a checkout that redirects somewhere unexpected. I've written before about <a href="https://kellssecurity.com/blog/how-i-actually-shop-online-without-getting-scammed" data-mce-href="https://kellssecurity.com/blog/how-i-actually-shop-online-without-getting-scammed">the payment habits that give me an extra layer of protection</a>, and they matter just as much here as anywhere else. I also always check whether the padlock and https are actually there before I type in any card number, since a cloned site can copy the visual design but not always the security certificate.</p><p><br></p><h2>Counterfeit Goods Dressed Up as the Real Thing</h2><p>It's not just cloned websites, plenty of counterfeit goods get sold as genuine on completely legitimate-looking marketplaces too. Trainers, electronics accessories, and skincare are the categories I see it most with, because they're easy to package convincingly and hard to spot as fake from a photo. If a listing has no return address, ships from overseas when the site claims to be based locally, or the price undercuts every other seller by a huge margin, I treat it as counterfeit until proven otherwise. Genuine retailers rarely need to compete that hard on price for the exact same item.</p><h2>Marketplace And Social Media Scams</h2><p><br></p><p>Facebook Marketplace and Gumtree are brilliant for picking up a bargain locally, but they're also where I see some of the messiest scams. Someone lists an item that doesn't exist, takes a deposit through a bank transfer, then disappears. If a seller pushes you to pay outside the platform's own system, or won't meet in a public place for something local, that's your answer. I also treat a seller who's suddenly selling ten different unrelated categories from one profile with the same suspicion, that's often a sign the account itself has been hijacked rather than a genuine person clearing out their garage.</p><p><br></p><h2>Why I Always Pay by Card, Never by Bank Transfer</h2><p>A card gives me a way to get my money back if something goes wrong, a bank transfer to a stranger gives away nothing except a route to disappear. It might feel a bit less trusting than sending money straight to someone who's asked nicely, but that small bit of friction is exactly the protection I want. If a seller only accepts bank transfer, gift cards, or cryptocurrency, and won't budge on it, I walk away regardless of how good the listing looks, because a legitimate seller has no reason to avoid a payment method that protects the buyer too.</p><h2>My Quick Checklist Before I Buy</h2><p><br></p><p>Before I hand over any card details on a site I don't already trust, I check the URL is spelled correctly, I look for a returns policy that actually makes sense, and I search the shop's name plus the word reviews. I also try to shop on a secured connection rather than open public wifi, which is one of the reasons I use <a href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" target="_blank" rel="noopener" data-mce-href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902">NordVPN </a>when I'm out and about. The same tricks ramp up <a href="https://kellssecurity.com/blog/the-online-shopping-rules-i-never-break-at-christmas" data-mce-href="https://kellssecurity.com/blog/the-online-shopping-rules-i-never-break-at-christmas">every Christmas</a>, and<a href="https://kellssecurity.com/blog/the-delivery-scams-i-see-every-december" data-mce-href="https://kellssecurity.com/blog/the-delivery-scams-i-see-every-december"> fake delivery texts </a>are their own special headache once your parcel is actually on its way. I keep a running mental shortlist of retailers I've already vetted, so buying from them again doesn't mean starting the checks from scratch.</p><p><br></p><p>None of this takes long once it's a habit. If you do get caught out, report it to <a href="https://www.actionfraud.police.uk" target="_blank" rel="noopener" data-mce-href="https://www.actionfraud.police.uk">Action Fraud </a>and contact your bank straight away, the faster you move the better your chances. You'll find more of my practical advice on the <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">Safety Toolkit </a>page, and if you want to talk through something that's happened to you, <a href="https://kellssecurity.com/contact" data-mce-href="https://kellssecurity.com/contact">get in touch </a>and I'll help however I can.&nbsp; None of it takes the fun out of shopping online, it just means I'm doing it with my eyes open.</p><figure id="figure-8c7wk3kr7amtaz8y3q"><img id="8c7wk3kr7amtaz8y3q" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Man smiling as he uses his phone safely, The Online Shopping Scams I Warn Shoppers About" src="https://cdn.durable.co/covers/22JGHvhqAR5zn3MLuxQlQkBE0erI5OO5GkH1wdZLu1DaA6xHoKImht9cHhDDTgyq.jpg" alt="Man smiling as he uses his phone safely, The Online Shopping Scams I Warn Shoppers About" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/22JGHvhqAR5zn3MLuxQlQkBE0erI5OO5GkH1wdZLu1DaA6xHoKImht9cHhDDTgyq.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The Online Shopping Scams I Warn Shoppers About

<h2>Why I Keep Coming Back to the Basics</h2><p>People ask me for the clever tricks and shortcuts, but the basics do most of the work. Every scam I've helped someone untangle traces back to one of a handful of gaps: a reused password, a text clicked too quickly, a phone left unlocked, a software update ignored for months. None of it is complicated. It just needs doing, and doing consistently, by everyone in the house, not just whoever's most "into computers". I'd rather a family nail these four habits than chase every new threat I read about, because the basics are what actually stop the scams that reach real people.</p><p><br></p><h2>Passwords and Two-Factor Authentication Come First</h2><p><br></p><p>If I could only fix one thing for a family, it would be passwords. Reusing the same one across every account is still the single biggest risk I see, because one leaked password unlocks everything else. I use a <a href="https://kellssecurity.com/blog/how-id-choose-a-password-manager-if-i-were-starting-today" data-mce-href="https://kellssecurity.com/blog/how-id-choose-a-password-manager-if-i-were-starting-today">password manager </a>to generate and store a different one for every account, which sounds like effort but takes about thirty seconds once it's set up. <a href="https://kellssecurity.com/blog/why-i-treat-two-factor-authentication-as-non-negotiable" data-mce-href="https://kellssecurity.com/blog/why-i-treat-two-factor-authentication-as-non-negotiable">Two factor authentication </a>is the second half of that, and I've written before about why I treat it as non-negotiable. Between the two, most of the accounts that get broken into simply wouldn't have been. If a<a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356"> password manager </a>feels like a hassle to set up, I tell people to start with just their email account, since that's usually the one everything else can be reset through.</p><p><br></p><h2>Teaching Kids (and Grown-Ups) to Spot a Scam</h2><p><br></p><p>I don't sit anyone down for a lecture. What works better is talking through real examples as they come up: the "delivery" text that wants your card details, the email pretending to be your bank, the message from a "friend" asking for money out of the blue. I've put together a proper guide on <a href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything" data-mce-href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything">how I spot a phishing email before I click anything</a>, and I'll happily walk any family through it. The goal isn't paranoia, it's a habit of pausing for two seconds before you tap. Kids pick this up fast once they see it framed as a puzzle to solve rather than a lecture, and they'll often spot the next one before I do.</p><p><br></p><h2>Locking Down Social Media and Privacy Settings</h2><p>Social media accounts leak more than people realise, from location tags on photos to birthdays and pet names that double as security question answers. I walk families through locking their profiles to friends only, turning off public tagging, and checking what third-party apps still have access from years ago. It only takes a few minutes, and it closes off a lot of the personal detail a scammer would otherwise use to make a fake message sound convincing.</p><h2>Keeping Devices and Software Up to Date</h2><p><br></p><p>Update notifications are annoying, I get it, but they're often patching a security hole that's already being used against people. I set devices to update automatically wherever I can, so nobody has to remember. On public wifi, especially anywhere in town, I'll use <a href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" target="_blank" rel="noopener" data-mce-href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902">NordVPN </a>to keep the connection private rather than trusting an open network I don't control. It's a small habit that closes a door a lot of people leave wide open. The same goes for old routers and smart devices that never get patched, since they're often the weakest link precisely because nobody thinks to check them.</p><p><br></p><h2>Backing Up What Actually Matters</h2><p>Photos and documents that only exist on one phone are one lost or stolen device away from being gone for good. I set every family up with automatic cloud backup for photos, and I make sure at least one other copy of anything genuinely important, like scanned ID documents or insurance paperwork, lives somewhere separate from the device it was created on. It's the kind of thing nobody thinks about until the phone falls in a puddle or gets stolen on a night out.</p><h2>The One Habit That Ties It All Together</h2><p><br></p><p>If there's one thing I'd want every family to take from this, it's that online safety isn't a single fix, it's a handful of small habits repeated until they're automatic. Start with passwords and two factor authentication, add the pause-before-you-click habit, and keep software updating itself in the background. For more of exactly this kind of practical advice, my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">Safety Toolkit </a>has everything in one place, and if you'd rather just talk it through, <a href="https://kellssecurity.com/contact" data-mce-href="https://kellssecurity.com/contact">get in touch </a>and I'll help however I can. For anything trickier, the <a href="https://www.ncsc.gov.uk/" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/">National Cyber Security Centre </a>is a solid place to check too. None of this is about being paranoid, it's just about making the easy things automatic so I can save my attention for whatever's genuinely unusual.</p><figure id="figure-7tm78x8cfmtaztf0p" class=""><img id="7tm78x8cfmtaztf0p" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Mum showing her children how to stay safe online on a laptop, The Online Safety Basics I Make Sure Every Family Knows" src="https://cdn.durable.co/covers/17KfQCYYdw4jsmu8go1XugXnqvcXfAVpTswPyhvZz7KO69SBcrIeUb2BonZ1aI0c.jpg" alt="Mum showing her children how to stay safe online on a laptop, The Online Safety Basics I Make Sure Every Family Knows" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/17KfQCYYdw4jsmu8go1XugXnqvcXfAVpTswPyhvZz7KO69SBcrIeUb2BonZ1aI0c.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The Online Safety Basics I Make Sure Every Family Knows

<h2>What I'm Actually Seeing Change</h2><p>Ask anyone whether cybercrime feels closer to home than it did five years ago, and I'd put money on the answer being yes. I don't say that to alarm you, I say it because it's true and because the shape of the problem has shifted. It isn't just banks and government departments in the firing line anymore. It's the hairdresser taking bookings through an app, the family running a market stall from their phone, and the ordinary person doing the weekly shop online from the sofa.</p><p><br></p><p>Small businesses everywhere have grown into genuine tech and digital operations over the last decade, and that's brilliant news for local economies. More businesses online means more jobs and more opportunity. It also means more doors for criminals to try, which is the part nobody puts on the tourist board. What's changed most in the years I've been doing this isn't the sophistication of the scams themselves, it's how ordinary the targets have become. That shift matters because it changes who needs to be paying attention. Cybersecurity used to feel like something for IT departments and big corporations to worry about, and now it's genuinely something every business owner and every household needs a basic handle on, whether or not technology is their thing.</p><p><br></p><h2>The Scams I'm Seeing Hit Local Businesses Hardest</h2><p><br></p><p>The pattern I see most often with small businesses is invoice fraud. A criminal gets into an email account, watches quietly for weeks, then sends a fake invoice or a change of bank details message at exactly the moment a payment is due. It looks completely normal because it's sitting inside a real email thread. I've had clients nearly lose four figures to this exact trick, and the only thing that saved them was picking up the phone to double check before paying. If you want to know what these emails actually look like in the wild, I've broken it down properly in my guide to <a href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything" data-mce-href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything">spotting a phishing email before you click anything</a>.</p><p><br></p><p>Right behind invoice fraud is the fake courier text, the your parcel couldn't be delivered message that leads to a cloned payment page. I wrote a whole piece on the <a href="https://kellssecurity.com/blog/the-online-shopping-scams-i-warn-shoppers-about" data-mce-href="https://kellssecurity.com/blog/the-online-shopping-scams-i-warn-shoppers-about">online shopping scams I warn shoppers about</a>, and the delivery scam is still the one catching the most people out. What makes both of these so effective is timing, they land right when you're already expecting an invoice or a delivery, so your guard is down before you've even opened the message.</p><p><br></p><h2>Why Small Businesses Are Still the Soft Target</h2><p><br></p><p>Here's the uncomfortable truth. Bigger companies have IT teams, security budgets, and someone whose entire job is worrying about this stuff. A hairdresser, a plumber, or a small online shop usually has none of that. They've got a laptop, a phone, and a to-do list a mile long. Criminals know this, and they treat small businesses as the easy option rather than the interesting one.</p><figure id="figure-77ikd8ul1emtb1goep"><img id="77ikd8ul1emtb1goep" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Man smiling as he uses his phone safely, What Cybersecurity Actually Looks Like Right Now" src="https://cdn.durable.co/covers/22JGHvhqAR5zn3MLuxQlQkBE0erI5OO5GkH1wdZLu1DaA6xHoKImht9cHhDDTgyq.jpg" alt="Man smiling as he uses his phone safely, What Cybersecurity Actually Looks Like Right Now" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/22JGHvhqAR5zn3MLuxQlQkBE0erI5OO5GkH1wdZLu1DaA6xHoKImht9cHhDDTgyq.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><p><br></p><p>I put together a longer piece on <a href="https://kellssecurity.com/blog/how-i-stay-ahead-of-cybercriminals" data-mce-href="https://kellssecurity.com/blog/how-i-stay-ahead-of-cybercriminals">how I stay ahead of cybercriminals </a>if you want the fuller picture, but the short version is that you don't need a security team to be well protected. You need a handful of habits done consistently, which is exactly what the next bit covers. Most of the small businesses I've worked with weren't hit because they did something reckless, they just never got round to the basics, and that's the gap I want to close in the rest of this piece.</p><p><br></p><h2>The Basics I Keep Coming Back To</h2><p><br></p><p>Whatever changes in the wider landscape, the fundamentals barely move, which is honestly good news because it means you don't need to relearn your entire approach every few months. A proper <a href="https://kellssecurity.com/blog/how-id-choose-a-password-manager-if-i-were-starting-today" data-mce-href="https://kellssecurity.com/blog/how-id-choose-a-password-manager-if-i-were-starting-today">password manager</a>, not sticky notes or the same password everywhere, closes off the single biggest door criminals walk through. <a href="https://kellssecurity.com/blog/why-i-treat-two-factor-authentication-as-non-negotiable" data-mce-href="https://kellssecurity.com/blog/why-i-treat-two-factor-authentication-as-non-negotiable">Two factor authentication </a>closes off most of what's left. If you're working from cafes, co-working spaces, or public wifi , a VPN like <a href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" target="_blank" rel="noopener" data-mce-href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902">NordVPN </a>keeps that traffic private on networks you don't control.</p><p><br></p><p>None of this is complicated once it's set up, and I go through all of it, along with securing a home network, step by step over in the <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">Safety Toolkit</a>. None of it takes long to set up, and once it's done you can mostly stop thinking about it, which is the whole point.</p><p><br></p><h2>Where I Think This Is Heading</h2><p><br></p><p>AI is going to make scam messages harder to spot, not easier, because the spelling mistakes and clunky phrasing that used to give the game away are quietly disappearing. That's the honest, slightly uncomfortable truth about where things are heading. The flip side is that the basics I've just covered still work regardless of how convincing the scam looks, because they don't rely on you spotting a fake, they rely on a criminal not being able to get in even if you do click the wrong thing.</p><p><br></p><p>If you want a proper national view alongside my mine, <a href="https://www.getsafeonline.org/" target="_blank" rel="noopener" data-mce-href="https://www.getsafeonline.org/">Get Safe Online </a>is a solid, independent resource worth bookmarking. And if you'd rather just talk it through with an actual person instead of reading another article, <a href="https://kellssecurity.com/contact" data-mce-href="https://kellssecurity.com/contact">get in touch </a>and I'll point you in the right direction. Either way, the goal is the same: fewer people caught out, and a bit more confidence every time something lands in your inbox that doesn't quite sit right.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

What Cybersecurity Actually Looks Like Right Now

Kells Security Solutions

I teach people around the world how to spot online scams and stay safe on the internet, explained in plain English with no jargon. I cover phishing emails, two-factor authentication, password managers, VPNs and antivirus software, written for people who are not tech experts and want to protect themselves and their families.