Blog

<h2>The First Thing I Ask Every New Client</h2><p>When someone gets in touch with me for the first time, before we talk about anything fancy, I ask one simple question: what would happen if your phone got stolen right now. Most people go quiet for a second, and that pause tells me everything I need to know. It's not because people are careless, it's because nobody ever sits them down and walks through the basics properly. That's what this piece is for, the exact habits I ask every new client to put in place first, in the order I ask them to do it. None of it is complicated on its own, the problem is that nobody ever explains it in order, so people end up doing three unrelated things and missing the two that actually matter most.</p><p><br></p><h2>Passwords and Two Factor Authentication, Sorted Once</h2><p><br></p><p>The single biggest change I see in someone's security, and it usually takes under an hour, is moving to a proper <a href="https://kellssecurity.com/blog/how-id-choose-a-password-manager-if-i-were-starting-today" data-mce-href="https://kellssecurity.com/blog/how-id-choose-a-password-manager-if-i-were-starting-today">password manager </a>like <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass</a>. If you're reusing the same three passwords across your email, your bank, and your Tesco Clubcard account, one leaked password is all it takes for a criminal to try it everywhere else. A password manager fixes that in one go, and once it's set up you genuinely stop thinking about it. Right behind that comes <a href="https://kellssecurity.com/blog/why-i-treat-two-factor-authentication-as-non-negotiable" data-mce-href="https://kellssecurity.com/blog/why-i-treat-two-factor-authentication-as-non-negotiable">two factor authentication </a>on your email account specifically, because your email is the recovery route into almost everything else you own online. If a criminal gets into your inbox, they can reset the rest. I always ask which email address a client's other logins are tied to, because that one account is usually worth more to a criminal than the bank login itself.</p><p><br></p><h2>Slowing Down Before You Click</h2><p><br></p><p>Most scams rely on speed. A text that says your parcel couldn't be delivered, an email that says your account's been suspended, a WhatsApp message from a family member needing money fast. They all want you to act before you think. The habit I try to build in every new client is a five second pause before clicking anything that creates urgency. That pause is where most scams fall apart, because the moment you actually look at the sender's address or the link underneath the button, the cracks show. I've written more on <a href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything" data-mce-href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything">spotting this properly </a>if you want to go deeper. The five second pause costs nothing, and I've never once had a client tell me it made them miss something that turned out to be genuine.</p><p><br></p><h2>Checking Whether Anything Has Already Been Exposed</h2><p>The first thing I do with a new client is check whether their email address has already turned up in a data breach, because that tells me a lot about how urgent the rest of the conversation needs to be. I use Have I Been Pwned for this, it's free and it takes about ten seconds to search an email address against thousands of known breaches. If something comes back, it doesn't mean panic, it means we go through exactly which passwords need changing first and whether that old, breached password is still being reused anywhere else.</p><h2>Locking Down the Home Network</h2><p><br></p><p>Your router is the front door to everything else in your house that connects to the internet, and most people have never once changed its default settings. Renaming it, setting a proper password, and turning on the built in firewall takes about fifteen minutes and closes off a route into your home network that most people don't even know exists. I've put together a <a href="https://kellssecurity.com/blog/securing-your-home-network-step-by-step" data-mce-href="https://kellssecurity.com/blog/securing-your-home-network-step-by-step">full walkthrough of the process </a>if you want to follow along step by step, and more habits like it are sitting in my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">Safety Toolkit</a>. It's one of the few security jobs you genuinely only have to do once, which makes it a strange thing for so many people to still be putting off.</p><p><br></p><h2>Keeping Your Software and Backups Actually Up to Date</h2><p>The second thing I check is whether automatic updates are actually switched on, not just installed once and forgotten. Phones, laptops, and routers all patch known security holes through updates, and most of the serious break-ins I hear about started with a device that was months behind on patches everyone else had already applied. The other habit that goes with this is a proper backup, something offsite or cloud based that keeps working even if a laptop gets lost, stolen, or hit with ransomware. I'd rather a client spend twenty minutes setting up automatic backups once than lose years of photos and documents because a hard drive failed on an ordinary Tuesday.</p><h2>What I Tell People to Do This Week</h2><p><br></p><p>If you take nothing else from this, do these three things this week: get a password manager sorted, turn on two factor authentication on your email, and check your router's default settings haven't been left switched on since the day it arrived. None of it is complicated, and none of it needs a technical background, it just needs doing. If a company you've used ever has a data breach, the <a href="https://ico.org.uk/action-weve-taken/enforcement/" target="_blank" rel="noopener" data-mce-href="https://ico.org.uk/action-weve-taken/enforcement/">Information Commissioner's Office </a>keeps a public register of enforcement action, which is worth a look if you're ever unsure whether a company handled your data properly. And if you'd rather I just walk you through your own setup directly, <a href="https://kellssecurity.com/contact" data-mce-href="https://kellssecurity.com/contact">get in touch </a>and we'll sort it together. Most of the clients I see six months later aren't the ones who did everything perfectly on day one, they're the ones who actually kept these habits going instead of letting them slide the moment life got busy.</p><figure id="figure-6tclnnjvx9mtb1y5d2" class=""><img id="6tclnnjvx9mtb1y5d2" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Woman reading online safety advice on her laptop, The Safety Habits I Tell Every New Client to Start With" src="https://cdn.durable.co/covers/1b6yok9RJBZAfVJCU68TtCAefcOkWASoEAg2dAh9pXKihM78nnfL0P7qcT5IAgmm.jpg" alt="Woman reading online safety advice on her laptop, The Safety Habits I Tell Every New Client to Start With" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/1b6yok9RJBZAfVJCU68TtCAefcOkWASoEAg2dAh9pXKihM78nnfL0P7qcT5IAgmm.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The Safety Habits I Tell Every New Client to Start With

<h2>Why These Five Come First</h2><p>If you sat down with me for a coffee and asked where to even start with all this online safety stuff, I wouldn't hand you a fifty point checklist. I'd give you five things. In fifteen-odd years of watching people get caught out (and getting caught out myself once, years before I knew any better), it's always the same five gaps that let the scammers and the hackers in. Sort these five and you've shut the door on most of what's out there. Leave them and you're propping that door open with a brick.</p><p><br></p><p>I've worked with people from every kind of background, and the story is nearly always the same. Nobody thinks it'll happen to them until it does. So let's get ahead of it, properly, starting today. If you want the full story of how I ended up doing this work, you'll find it on my <a href="../about" data-mce-href="../about">About page</a>.</p><p><br></p><h2>Fix One: Get a Password Manager Sorted</h2><p><br></p><p>This is the one people roll their eyes at most, and it's the one that stops the most damage. If you're using the same two or three passwords for everything, your email, your bank, your Tesco Clubcard, one leaked password from some website you've long forgotten about becomes a master key to your entire life.</p><p><br></p><p>A password manager does the remembering for you. You set one strong master password, and it generates and stores a completely different, properly complicated password for every account you own. I use <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass </a>myself and I point nearly every client toward it, mainly because it's simple enough that even my least tech-confident clients actually stick with it once it's set up. There's a free trial if you want to see whether it suits you before you commit to anything.</p><p><br></p><p>Ten minutes of setup. Then you never have to remember a password again, and neither does a scammer.</p><p><br></p><h2>Fix Two: Switch On Two-Factor Authentication</h2><p><br></p><p>Two-factor authentication is the second lock on your front door. Even if someone gets hold of your password, they still can't get in without the code that lands on your phone at the same moment they try. It's the single biggest thing I tell every client to switch on, no exceptions, and I'd start with your email and your banking app before anything else.</p><p><br></p><p>Most banks and email providers have this built in already and just need you to turn it on in your account settings. It adds about four seconds to your morning login routine. Compare that to the months of hassle a compromised bank account causes, and it's not really a decision.</p><p><br></p><p>If you want a full walkthrough on spotting the phishing messages that try to trick you into handing over these codes in the first place, I've written a separate piece on <a href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything" data-mce-href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything">the phishing scams I see catching people out </a>that's worth a read alongside this one.</p><figure id="figure-e11o7yrx1cmtb3bosl" class=""><img id="e11o7yrx1cmtb3bosl" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Man working at a desk with online safety in mind, The Five Security Fixes I'd Make First in Your Position" src="https://cdn.durable.co/covers/4IoZLwzEazYn5vx7hOa2BVriIWr70ma5OwxhttLbWrDsOynBuSFRKZ3fDy3HrhLt.jpg" alt="Man working at a desk with online safety in mind, The Five Security Fixes I'd Make First in Your Position" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/4IoZLwzEazYn5vx7hOa2BVriIWr70ma5OwxhttLbWrDsOynBuSFRKZ3fDy3HrhLt.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><p><br></p><h2>Fix Three: Stop Ignoring Your Updates</h2><p><br></p><p>That little red notification badge on your phone or laptop telling you an update is available isn't nagging you for no reason. Most updates exist specifically to patch security holes that hackers already know about and are actively using. Every time you tap remind me tomorrow, you're leaving that hole open for one more day.</p><p><br></p><p>I know updates feel like they always arrive at the worst possible moment, usually right as you're trying to leave the house. Set your phone and computer to update overnight instead, and you'll barely notice it happening. It's one of the quietest, easiest fixes on this whole list, and one of the most skipped.</p><p><br></p><h2>Fix Four: Tighten Up Your Social Media Privacy</h2><p><br></p><p>Scammers don't need to hack you if you've already told them everything on Facebook. Your pet's name, your mum's maiden name, your kids' school, your holiday dates, all of it sits there in plain view for anyone doing their homework before a targeted scam or a bit of old-fashioned burglary planning.</p><p><br></p><p>Go into your privacy settings on whichever platforms you use and lock your profile down to friends only. Turn off public location tagging. And have a proper think about whether that quiz asking for your first pet's name is really just for fun, because that's a classic security question in disguise.</p><p><br></p><h2>Fix Five: Secure Your Wi-Fi and Any Public Connections You Use</h2><p><br></p><p>Your home Wi-Fi should have a strong password and the default router login changed from admin. If you've never touched your router settings since your provider installed it, that's worth an afternoon sorting. Which? has a solid<a href="https://www.which.co.uk/reviews/wireless-routers/article/how-to-set-up-a-router-a2Yow4v0Bthy" target="_blank" rel="noopener" data-mce-href="https://www.which.co.uk/reviews/wireless-routers/article/how-to-set-up-a-router-a2Yow4v0Bthy"> step-by-step guide</a> if you're not sure how.</p><p><br></p><p>Public Wi-Fi in a coffee shop, an airport, or on the train is a different matter entirely. Anyone on that same network can, with the right tools, see what you're doing. A VPN encrypts your connection so what you're browsing stays private even on networks you don't control. I use <a href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" target="_blank" rel="noopener" data-mce-href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902">NordVPN </a>when I'm out and about and recommend it to clients who travel a lot or work from cafés regularly.</p><p><br></p><h2>None of This Has to Happen Overnight</h2><p><br></p><p>Pick one fix this week. Then another next week. Within five weeks you'll have closed every major gap I see catching people out, and you'll sleep a lot easier for it.</p><p><br></p><p>If you'd rather not do it alone, that's exactly what I'm here for. Have a browse through my <a href="../safety-toolkit" data-mce-href="../safety-toolkit">Safety Toolkit </a>for the tools I recommend, or <a href="../contact" data-mce-href="../contact">get in touch </a>and I'll walk through your specific situation with you, no jargon, no judgement, just straight answers from someone who's seen it all before.</p><p><br></p><p>And if you ever do get caught out despite everything, report it to <a href="https://www.actionfraud.police.uk/" target="_blank" rel="noopener" data-mce-href="https://www.actionfraud.police.uk/">Action Fraud </a>straight away. The sooner it's reported, the better the chance of stopping it happening to someone else too.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The Five Security Fixes I'd Make First in Your Position

<p>Every December I watch the same pattern play out. People who are perfectly careful online for eleven months of the year suddenly relax their guard in the run up to Christmas, and the scammers know it better than anyone. They know you're tired, you're rushing, you've got a dozen people to buy for and only three weeks to do it in, and a "50% off, ends tonight" pop-up looks a lot more tempting when you're stood in the queue at Tesco trying to remember if your nephew already has that Lego set.</p><p>I'm not writing this to make you paranoid about your Christmas shopping. I'm writing it because a few small habits make the difference between a stress-free December and one spent on the phone to your bank on Boxing Day. I've covered <a href="https://kellssecurity.com/blog/the-online-shopping-scams-i-warn-shoppers-about" data-mce-href="https://kellssecurity.com/blog/the-online-shopping-scams-i-warn-shoppers-about">the broader range of shopping scams I see year-round </a>separately, this one's specifically about the ways December trips people up.</p><p><br></p><h2>The Deals That Are Too Good to Be True</h2><p><br></p><p>If you see a big-name gadget or the trainers everyone wants this year going for a third of the normal price on a website you've never heard of, that's not luck, that's bait. Genuine retailers rarely discount their most in-demand stock that heavily, especially close to Christmas when demand is at its peak.</p><p><br></p><p>Before you buy from any site you don't already know, check the web address carefully, look for reviews outside the site itself since its own five-star reviews prove nothing, and search the company name alongside the word scam before you hand over your card details. Thirty seconds of checking has saved more than one of my clients a very unhappy Christmas morning.</p><p><br></p><h2>Watch Out for Copycat Websites</h2><p><br></p><p>Scammers build near-perfect copies of well-known shops, right down to the logo and the layout, and buy a web address that's one letter off the real thing. You place your order, get a confirmation email that looks legitimate, and then nothing arrives, because there was never any stock to send in the first place.</p><p><br></p><p>The safest habit is to type the retailer's address in yourself rather than clicking through from an ad or a social media post. Citizens Advice has a good <a href="https://www.citizensadvice.org.uk/consumer/scams/scams/spot-a-scam-website/" target="_blank" rel="noopener" data-mce-href="https://www.citizensadvice.org.uk/consumer/scams/scams/spot-a-scam-website/">guide on spotting a fake online shop </a>if you want a second opinion before you buy.</p><p><br></p><h2>Gift Cards Are the Scammer's Favourite Trick</h2><p><br></p><p>If anyone, and I mean anyone, ever asks you to pay for something in gift cards, whether it's a shop, a delivery fee, a family member in trouble over text, or a prize you've supposedly won, stop immediately. No legitimate company or organisation asks to be paid in Amazon or iTunes vouchers. It's one of the clearest scam signals there is, and it works because gift card payments are almost impossible to trace or reverse once they're spent.</p><p><br></p><h2>Keep Your Payments Safe While You're Out and About</h2><figure id="figure-715myoqvzmtb74hax" class=""><img id="715myoqvzmtb74hax" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Woman checking her phone at home, The Christmas Shopping Scams I See Every December" src="https://cdn.durable.co/covers/2DLj7xKFDiOptcvFJMNkt0lNwyA4nwZJW6kLw9dOurAj5Narss34RChvGD7LyedU.jpg" alt="Woman checking her phone at home, The Christmas Shopping Scams I See Every December" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/2DLj7xKFDiOptcvFJMNkt0lNwyA4nwZJW6kLw9dOurAj5Narss34RChvGD7LyedU.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><p>Christmas market stalls, the last-minute dash round the shops, using the free wifi in a café while you finish an order on your lunch break, all of it adds up to more of your card details and browsing being exposed to networks you don't control than at any other time of year. A VPN encrypts your connection wherever you're shopping from, which matters more in December than any other month. I use <a href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" target="_blank" rel="noopener" data-mce-href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902">NordVPN </a>myself when I'm out shopping and recommend it to clients doing the same.</p><p><br></p><p>It's also worth using a password manager for any new shopping accounts you set up this time of year rather than reusing an old password, since a breach at one retailer can otherwise open the door to everything else you own. I use <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass </a>and it takes the thinking out of it completely.</p><p><br></p><h2>My Own December Shopping Routine</h2><p><br></p><p>I keep it simple. I shop from retailers I already know and trust wherever I can. I pay by card rather than bank transfer so I've got some protection if something goes wrong. I don't click links in unexpected delivery texts, not even the convincing ones, because that's a <a href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything" data-mce-href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything">scam I've written about separately </a>and it catches more people than almost anything else this time of year. And I check my bank statement more often in December than any other month, simply because there's more going through it.</p><h2>Helping Older Relatives Shop Safely Too</h2><p>Christmas is one of the few times of year I get to sit down properly with older relatives and clients, and it's usually when I hear about the near-misses from the rest of the year. Scammers know that older shoppers are often less familiar with how a legitimate online checkout should look, and they target that uncertainty deliberately around the holidays with fake charity requests, too-good-to-be-true delivery fees, and phone calls claiming to be from the bank.</p><p><br></p><p>If you've got older relatives visiting over Christmas, it's worth taking ten minutes to sit with them and check their phone or computer together: has anything unusual appeared in their inbox, are there any apps or extensions they don't remember installing, is their antivirus actually running. It's a far more useful gift than anything wrapped under the tree, and it's the one conversation I have every single December without fail.</p><p><br></p><h2>If Something Does Go Wrong</h2><p><br></p><p>If you've handed over card details to a fake site or paid for something that never arrived, contact your bank immediately. They can often stop or reverse a payment if you're quick. Report it to <a href="https://www.actionfraud.police.uk/" target="_blank" rel="noopener" data-mce-href="https://www.actionfraud.police.uk/">Action Fraud </a>too, so what happened to you doesn't happen to the next person.</p><p><br></p><p>If you'd like a hand getting your accounts properly locked down before the Christmas rush starts, have a look at my <a href="../safety-toolkit" data-mce-href="../safety-toolkit">Safety Toolkit</a>, or <a href="../contact" data-mce-href="../contact">get in touch </a>and I'll talk you through it.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The Christmas Shopping Scams I See Every December

<h2>Why I Wanted to Tell These Stories</h2><p>I get asked a lot whether any of this cybersecurity advice actually works in the real world, or whether it just sounds good on a website. So instead of another list of tips, I want to tell you about a few small businesses I've worked with who put the basics into practice and it genuinely saved them. Names and a few details are changed for privacy, but the situations are real, and the lessons are exactly what happened.</p><p><br></p><h2>The Café That Caught a Scam Before It Cost Them a Penny</h2><p>A small café owner in the city centre got an email that looked like it came from her regular coffee supplier, asking her to update the bank details for the next invoice payment. It was well written, it used the supplier's actual logo, and it landed at a busy time on a Friday afternoon when she had every reason to just click through and get it done. She'd been through a short session with me a few months earlier where we talked about exactly this kind of scam, so instead of paying, she rang the supplier directly using the number on a previous paper invoice. The supplier had no idea what she was talking about. That thirty second phone call saved her over two thousand pounds. It wasn't clever software that caught it. It was one habit, done at the right moment.</p><p><br></p><h2>The Small Agency That Backed Up Everything (And Meant It)</h2><p>A small marketing agency I know got hit with ransomware through a compromised email attachment. Their screens locked up, a ransom note appeared, and for about ten minutes the owner told me his stomach dropped through the floor. But because they'd set up an automatic daily backup to a separate cloud account months earlier, and actually tested it (which most people skip), they didn't pay a penny. They wiped the affected machines, restored from that morning's backup, and were back working by the next day. The attackers had nothing to hold over them, because the thing they were threatening to destroy was already safely copied somewhere else.</p><figure id="figure-o4nhiniz1mtbbcwhx" class=""><img id="o4nhiniz1mtbbcwhx" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: undefined undefined;" title="Security expert watching camera screens, The Small Businesses I've Seen Beat a Cyber Attack" src="https://cdn.durable.co/covers/32ZiCusidY0ykvPBrJ4UPUBZtKKF1NpK6sqPsH65m5SjeFiLVCjj9Zpn66nBtfLY.jpg" alt="Security expert watching camera screens, The Small Businesses I've Seen Beat a Cyber Attack" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/32ZiCusidY0ykvPBrJ4UPUBZtKKF1NpK6sqPsH65m5SjeFiLVCjj9Zpn66nBtfLY.jpg" data-mce-style="aspect-ratio: 16/9; object-position: undefined undefined;"></figure><p><br></p><h2>The Shop That Trained Its Whole Team, Not Just the Owner</h2><p>A small retail shop I worked with had three part-time staff who all had access to the till system and the online ordering account. The owner assumed that as long as she understood the basics, the business was covered. It wasn't. One afternoon a staff member on shift got a text claiming to be from a courier, saying a delivery couldn't be completed without a small payment to release it. She almost paid it on her own card before remembering a five-minute chat we'd had about exactly this kind of scam a few weeks earlier. She flagged it to the owner instead, and it turned out several other local shops had been targeted with the identical text that same week. The lesson wasn't about the owner's own habits. It was that everyone with access to a business needs the same basic awareness, not just the person whose name is above the door.</p><h2>What These Businesses Actually Have in Common</h2><p>None of these three businesses had a dedicated IT department or a huge security budget. What they had was a habit they'd actually built into how they work, not just a policy sitting in a folder nobody reads. The café owner had practised the "verify before you pay" habit until it was automatic. The agency had tested their backups, not just switched them on and forgotten about them. The shop had made sure every member of staff, not just the owner, knew what a scam attempt looked like. In every case, the thing that saved them wasn't expensive. It was consistent.</p><p><br></p><h2>What You Can Borrow From Their Playbook</h2><p>You don't need their exact setup to get the same protection. Start with a password manager like <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass </a>so you're not reusing the same login across every account your business relies on, and pair it with two factor authentication wherever you can turn it on. If your team ever works from cafés, hotels, or shared offices, a VPN like <a href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" target="_blank" rel="noopener" data-mce-href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902">NordVPN </a>is worth having on every device that connects to public wifi. And if you want a fuller walkthrough of where to start, I've written a proper <a href="https://kellssecurity.com/blog/the-cybersecurity-buying-guide-i-give-every-small-business" data-mce-href="https://kellssecurity.com/blog/the-cybersecurity-buying-guide-i-give-every-small-business">buyer's guide to cybersecurity for small businesses </a>that goes through this step by step, alongside a separate piece on <a href="../blog/small-business-cybersecurity" data-mce-href="../blog/small-business-cybersecurity">protecting small businesses </a>that covers training your team without boring them senseless. If you'd rather talk it through than read another article, my <a href="../safety-toolkit" data-mce-href="../safety-toolkit">Safety Toolkit </a>has the tools I actually recommend, and you're always welcome to <a href="../contact" data-mce-href="../contact">get in touch </a>if you want a second pair of eyes on your setup.</p><h2>What I'd Ask You to Do This Week</h2><p>You don't need to read every case study I've ever written to get the benefit of any of this. Pick one habit from these three stories and put it into practice this week: agree a simple callback rule for any request to change payment details, test that your backups actually restore rather than just assuming they run, or spend ten minutes making sure everyone on your team, not just you, knows what a scam attempt looks like. Small, consistent habits like these are what actually stopped these businesses losing money and time, not expensive software or a security department they didn't have.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The Small Businesses I've Seen Beat a Cyber Attack

<p><strong>The short answer:</strong> the online safety myths that catch people out most are that scams are easy to spot by bad spelling, that your bank will always refund you, that iPhones can't be scammed, that a strong password is enough on its own, that public Wi-Fi is fine for "unimportant" browsing, and that you're not worth targeting. Each one used to be at least half true. None of them hold up any more.</p><h2>Why These Myths Refuse to Die</h2><p>I hear the same handful of myths again and again, from people who are switched on about most things and still repeat advice that stopped being true years ago, if it ever was. I've written before about the classic myths around antivirus and passwords, but this time I want to tackle a different batch, the ones that catch out otherwise careful people. None of these myths came from nowhere. They usually started as something reasonable, then got stretched past the point of being useful. The trouble is they make people feel safer than they actually are, and that gap is exactly where scammers do their best work.</p><p><br></p><h2>Myth: Scammers Are Easy to Spot by Their Bad English</h2><p><br></p><p>This one used to hold up. A lot of it doesn't any more. AI tools have sorted out the spelling mistakes and dodgy grammar that used to give a scam email away in the first line, so a badly written message is only one clue among many now, not proof either way on its own. I've seen phishing emails that read better than some of my own drafts, if I'm honest. What still gives them away is more subtle, an odd sense of urgency, a request that doesn't quite match how the organisation normally contacts you, a link that goes somewhere slightly off when you hover over it. I've written before about the <a href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything" data-mce-href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything">exact red flags I check </a>on every message that lands in my inbox.</p><p><br></p><h2>Myth: My Bank Will Always Refund Me If I'm Scammed</h2><p><br></p><p>Banks do refund a lot of fraud cases now under the newer reimbursement rules, and that's genuinely good news for anyone who gets caught out. But "always" is doing a lot of heavy lifting in that sentence. If you authorised the payment yourself, even because you were tricked into it, the bank can still investigate whether you took reasonable care before deciding to refund you, and that's a judgement call that doesn't always go your way. The <a href="https://www.financial-ombudsman.org.uk/" target="_blank" rel="noopener" data-mce-href="https://www.financial-ombudsman.org.uk/">Financial Ombudsman Service </a>publishes decisions on exactly this kind of dispute, and reading a few of them was enough to convince me I'd rather not find out the hard way where that line sits. I still treat every payment like it's final the second I send it.</p><figure id="figure-gh10she8nkmtbcfoar"><img id="gh10she8nkmtbcfoar" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Woman reading online safety advice on her laptop, The Online Safety Myths I Wish Would Finally Disappear" src="https://cdn.durable.co/covers/1b6yok9RJBZAfVJCU68TtCAefcOkWASoEAg2dAh9pXKihM78nnfL0P7qcT5IAgmm.jpg" alt="Woman reading online safety advice on her laptop, The Online Safety Myths I Wish Would Finally Disappear" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/1b6yok9RJBZAfVJCU68TtCAefcOkWASoEAg2dAh9pXKihM78nnfL0P7qcT5IAgmm.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><p><br></p><h2>Myth: iPhones and Macs Don't Get Hit by Scams</h2><p><br></p><p>Apple devices are genuinely good at blocking traditional viruses, and that's where this myth comes from. But most of what catches people out now isn't a virus at all, it's a scam text, a fake login page, a phishing email asking you to verify your Apple ID. None of that cares what phone you're holding. I know several people on iPhones who've had their Apple ID phished in the last year alone, which is its own kind of expensive problem given how much banking and photo history usually lives behind it. <a href="https://kellssecurity.com/blog/why-i-treat-two-factor-authentication-as-non-negotiable" data-mce-href="https://kellssecurity.com/blog/why-i-treat-two-factor-authentication-as-non-negotiable">Two factor authentication </a>and a proper password manager close most of that gap regardless of which phone is in your pocket.</p><p><br></p><h2>Myth: A Strong Password Alone Is Enough to Keep You Safe</h2><p>A strong, unique password genuinely matters, but on its own it isn't the finish line people treat it as. Passwords get exposed all the time through data breaches that have nothing to do with how strong yours was, a company you trusted gets hacked and your details end up in a leak regardless of how many symbols you used. That's exactly why two factor authentication matters so much, it means a leaked password alone still isn't enough to get into your account. I check my own email address against known breaches every so often, and I've been caught up in a few over the years despite never reusing passwords. The password is one layer, not the whole wall.</p><h2>Myth: Public Wi-Fi Is Fine As Long As You're Not Doing Anything Important</h2><p>"Not doing anything important" is doing a lot of work in that sentence, and most people don't realise how much actually counts. Checking your email, logging into a shopping account, even just staying signed into apps in the background can all leak more than you'd think on a network you don't control. The risk isn't usually someone watching you type your banking password, it's the quieter stuff, an unencrypted app quietly sending your login details in the clear, or a fake hotspot set up to look exactly like the real one. I use <a href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" target="_blank" rel="noopener" data-mce-href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902">NordVPN </a>whenever I'm on a network I don't control, coffee shops, hotels, airports, it's an easy habit that closes the gap without me having to think about which sites are "important" enough to bother protecting.</p><h2>Myth: I'm Not Important Enough to Be Targeted</h2><p>I hear this one more than any other, usually from people who'd never think of themselves as a target. The truth is most scams aren't personal at all. They're sent to thousands or millions of people at once by automated tools, and the scammer has no idea who you are until you reply or click. Your email login, your WhatsApp account and your savings are worth something to a criminal whoever you are. Being ordinary doesn't make you invisible, it just means you're one of the many people the net is thrown over.</p><h2>Myth: Private or Incognito Browsing Keeps Me Anonymous</h2><p>Incognito mode does one thing well. It stops your own browser saving your history, cookies and searches on that device. That's useful on a shared computer. But the websites you visit can still see you, your internet provider can still see where you go, and if you log into an account, that account knows it's you. It's privacy from the next person who uses your laptop, not privacy from the internet.</p><h2>Myth: You'd Know Immediately If You'd Been Hacked</h2><p>Most compromises I hear about weren't dramatic, there was no locked screen or ransom note, just a slow trickle of odd signs that got explained away individually: an email in the sent folder you don't remember sending, a login notification from a country you've never visited, a friend mentioning a strange message from your account. Checking your accounts' recent activity logs occasionally, even when nothing feels wrong, catches this far earlier than waiting for something obvious to happen.</p><h2>Myth: Scams Only Target Older People</h2><p>I hear this one from people in their twenties and thirties just as often as anyone else, usually right before they tell me about a scam that nearly caught them out. Younger people are actually targeted differently, not less, think fake concert tickets, rental scams on properties that don't exist, or a "recruiter" offering a remote job that asks for banking details before you've even had an interview. Comfort with technology doesn't translate into immunity from social engineering, since the trick isn't technical, it's psychological.</p><h2>Myth: Deleting an App or Closing an Account Gets Rid of My Data</h2><p>Deleting an app from your phone removes the icon, not necessarily what it collected while it was there. Closing an account doesn't always trigger a full deletion of your information either, and even when it does, a copy may already sit in a backup or with a data broker who bought it months earlier. I'm not saying this to make you paranoid about every app you've ever installed, just to explain why the safest move is being careful about what you hand over in the first place, rather than assuming you can tidy it up later. If I've genuinely shared something I regret, the more useful step is a formal data deletion request to the company itself, most are legally required to act on it, rather than assuming an uninstall did the job.</p><h2>The Padlock Icon Doesn't Mean What Most People Think</h2><p>For years the advice was simple: look for the little padlock in the address bar before you trust a site. That padlock only tells you the connection between your browser and the site is encrypted, nothing about who actually runs the site or whether they're being honest with you. Free encryption certificates are trivial to get, and most phishing sites now use them as a matter of course precisely because people still associate the padlock with safety. A fake banking page with a padlock is no safer than one without it, it just looks more convincing to someone who was taught the wrong lesson. I still check for it, but it's the last thing I check, not the first. What actually matters is the domain itself, spelled out carefully, checked for the extra letter or the swapped word that a genuine site would never have, not the icon sitting next to it.</p><h2>Online Safety Myth Questions I Get Asked</h2><h3>What is the biggest online safety myth?</h3><p>That you'd definitely spot a scam. Almost everyone who's been caught out thought the same, and modern scams are built to feel completely normal until the moment they ask for money or a password.</p><h3>Do I still need antivirus software?</h3><p>For most computers, yes, even if it's the free one built into Windows. I've set out <a href="https://kellssecurity.com/blog/how-i-actually-compare-antivirus-software" data-mce-href="https://kellssecurity.com/blog/how-i-actually-compare-antivirus-software">how I choose the best antivirus software</a> if you're weighing up whether to pay for one.</p><h3>Does a VPN make me anonymous online?</h3><p>No. A VPN hides your traffic from the network you're on and from your internet provider, but the sites and accounts you log into still know it's you. It's a privacy tool, not an invisibility cloak.</p><h3>How can I check if my details have been in a data breach?</h3><p>Have I Been Pwned is a free, well-respected site where you can check whether your email address has turned up in a known breach. If it has, change that password and any others that match it.</p><h2>What Actually Keeps You Safer Than Any Myth</h2><p><br></p><p>None of these myths are stupid, they're just out of date, and the fix isn't panic, it's a handful of boring habits done consistently. A password manager so you're not reusing the same password everywhere, I use <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass </a>myself and recommend it to almost everyone I talk to. Two factor authentication switched on for anything that matters. And a healthy pause before you click, type, or pay anything you weren't expecting five minutes ago. If you want the fuller list I actually use myself, I've put it together on my <a href="../toolkit" data-mce-href="../toolkit">Safety Toolkit </a>page, and if something doesn't sit right, <a href="../contact" data-mce-href="../contact">get in touch </a>and I'll have a look with you.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The Online Safety Myths I Wish Would Finally Disappear

<p><strong>The short answer:</strong> to set up two-factor authentication, open the account's settings, go to Security (sometimes called Login and Security), and turn on 2-Step Verification or Two-Factor Authentication. Choose an authenticator app if it's offered, save the backup codes somewhere safe, and start with your email account, because it's the key to resetting everything else. It takes about three minutes per account.</p><p>I get asked "how do I actually turn this on?" almost every week, so here's the honest walkthrough I'd give you if we were sat at your kitchen table with your phone in hand.</p><h2>Why I'm Writing This as an Actual Tutorial</h2><p><br></p><p>I've written before about <a href="https://kellssecurity.com/blog/why-i-treat-two-factor-authentication-as-non-negotiable" data-mce-href="https://kellssecurity.com/blog/why-i-treat-two-factor-authentication-as-non-negotiable">why I treat two factor authentication as non-negotiable</a>, and I still stand by every word of that one. But knowing you should do something and knowing how to actually do it are two very different things, and I don't think enough people bridge that gap for their clients. This post skips the persuading and gets straight to the clicking. Grab your phone, get comfortable, and let's go through it properly, one account at a time.</p><p><br></p><h2>Setting Up 2FA on Your Email Account</h2><p><br></p><p>Your email is the master key to almost everything else you own online, so it's the first account I secure for every client I work with. In Gmail, go to your Google Account, select Security, then look for 2-Step Verification and follow the prompts. It'll ask for your phone number first, then offer you the option to switch to an authenticator app, which I always recommend over text messages since texts can be intercepted. Outlook works almost the same way: Account, Security, Advanced security options, then Two-step verification. The whole thing takes about three minutes and you only have to do it once.</p><p><br></p><h2>Setting Up 2FA on Your Banking App</h2><p><br></p><p>Most UK banking apps have this built in already and switch it on automatically the moment you install them, which is one of the few times I'll happily say the bank knows best. If yours doesn't, open the app, head to Settings or Security, and look for anything called two factor, two step, or biometric login. Turn on Face ID or fingerprint login too if it's offered, it's another layer that costs you nothing and takes half a second each time you log in.</p><p><br></p><h2>Setting Up 2FA on Social Media</h2><p><br></p><p>Facebook, Instagram, and X all bury this setting in slightly different places, but the route is roughly the same: Settings, then Security and Login (or Privacy and Security), then Two-Factor Authentication. Pick the authenticator app option where you can, it's more reliable than SMS and doesn't rely on you having signal. I switched every one of my own accounts over years ago and honestly forgot it was even switched on until a login attempt from somewhere I'd never been got blocked without me lifting a finger.</p><h2>Setting Up 2FA on Your Shopping and Payment Accounts</h2><p>Amazon, PayPal, and eBay all hold enough of your card details and order history to be worth locking down properly, and this is the section people skip because it feels like a shop, not a bank. It really shouldn't be treated differently. In PayPal, go to Settings, then Security, and turn on Two-Factor Authentication, an authenticator app if it's offered, otherwise a text code will do. Amazon hides its version under Login &amp; Security as Two-Step Verification, and eBay calls it much the same thing under Account Security. I've had a client's PayPal targeted twice in the last two years, both times the attacker got the password right and got stopped dead by the second step. That's the whole point of doing this everywhere, not just the accounts that feel obviously important.</p><h2>Setting Up 2FA on Your Cloud Storage</h2><p>Google Drive, iCloud, and Dropbox often get overlooked because they don't feel like a login you use every day, but they're quietly holding years of photos, documents, and sometimes scanned copies of passports or bank statements. For a Google Account, head to myaccount.google.com, Security, then 2-Step Verification, and follow the prompts, it'll walk you through adding an authenticator app or a physical key if you have one. Apple users do this through Settings, your name at the top, then Sign-In &amp; Security, where Two-Factor Authentication is usually already on for newer accounts but worth double checking. Dropbox keeps it under Settings, then Security, with the same Two-Step Verification wording as everywhere else. Five minutes in each one, and it closes off one of the quieter ways people lose things they never meant to share.</p><figure id="figure-3ir9hrnou5mtbgero0"><img id="3ir9hrnou5mtbgero0" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Hands typing a password on a laptop keyboard, How to Set Up Two-Factor Authentication (The Way I Do It)" src="https://cdn.durable.co/covers/11PCbQdJ5YR0KkHpq6N0pKU5PQzrsp1PeimAK6HRNuvSxOJepuJaApoNN98jCFam.jpg" alt="Hands typing a password on a laptop keyboard, How to Set Up Two-Factor Authentication (The Way I Do It)" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/11PCbQdJ5YR0KkHpq6N0pKU5PQzrsp1PeimAK6HRNuvSxOJepuJaApoNN98jCFam.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><p><br></p><h2>Setting Up 2FA on WhatsApp</h2><p>WhatsApp is one of the accounts scammers go after most, usually by messaging you pretending to be a friend and asking you to forward a six-digit code that was "sent to you by mistake". That code is the key to your account. WhatsApp's own version of two-factor is called two-step verification. Open Settings, tap Account, then Two-step verification, and turn it on. It asks you to choose a six-digit PIN and add an email address in case you ever forget it. Once it's on, anyone who gets hold of that text code still can't take over your account without the PIN. And if a friend ever asks you to send them a code, ring them on a number you already have before you do anything.</p><h2>What to Do If You Lose Your Phone</h2><p><br></p><p>This is the bit people worry about most, and fair enough. Before you switch anything on, write down or print the backup codes every service gives you during setup and keep them somewhere safe, not in your phone's notes app. I keep mine in <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass</a>, the password manager I use and recommend to every client, since it works even if my phone ends up at the bottom of a lake. If you do lose your phone, most services let you verify a new device through your email or by answering a security question, so having that email account locked down properly matters more here than anywhere else.</p><p><br></p><h2>Two-Factor Authentication Set-Up Questions</h2><h3>How long does it take to set up two-factor authentication?</h3><p>About three to five minutes per account. If you do your email, bank, social media and shopping accounts in one sitting, you're looking at half an hour, and you only ever do it once.</p><h3>Which authenticator app should I use?</h3><p>Google Authenticator and Microsoft Authenticator are both free and do the job well, and many password managers can store the codes too. Picking one and actually using it matters far more than which logo is on it.</p><h3>Do I still need two-factor if I have a strong password?</h3><p>Yes. A strong password can still be stolen through a data breach or a fake login page. Two-factor means a stolen password on its own isn't enough, which is exactly the situation it's there for. I've explained <a href="https://kellssecurity.com/blog/why-i-treat-two-factor-authentication-as-non-negotiable" data-mce-href="https://kellssecurity.com/blog/why-i-treat-two-factor-authentication-as-non-negotiable">why two-factor authentication is so important</a> in more detail separately.</p><h3>What if a website doesn't offer two-factor authentication?</h3><p>Use a long, unique password for that site that you don't use anywhere else, ideally one generated by a password manager. That way, if the site is ever breached, the damage stops there.</p><h3>Will two-factor stop me logging in on a new phone?</h3><p>Not if you've kept your backup codes. Most services also let you confirm a new device through your email, which is why I always tell people to secure their email account first.</p><p>If any of this feels fiddly the first time, that's completely normal, and I'd rather you found it fiddly for five minutes than found out the hard way why it matters. The <a href="https://www.ncsc.gov.uk/" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/">National Cyber Security Centre</a> backs up everything I've said here too, if you fancy the official version alongside mine. For a proper hand held walkthrough of everything on your accounts,<a href="https://kellssecurity.com/blog/the-digital-safety-check-up-i-do-every-year" data-mce-href="https://kellssecurity.com/blog/the-digital-safety-check-up-i-do-every-year"> my digital safety check-up </a>is a good place to start, and I've put together a full <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">safety toolkit</a> with the password manager and VPN I actually use myself. If you'd rather just ask me directly, <a href="https://kellssecurity.com/contact" data-mce-href="https://kellssecurity.com/contact">get in touch</a> and I'll talk you through it.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

How to Set Up Two-Factor Authentication (The Way I Do It)

Kells Security Solutions

I teach people around the world how to spot online scams and stay safe on the internet, explained in plain English with no jargon. I cover phishing emails, two-factor authentication, password managers, VPNs and antivirus software, written for people who are not tech experts and want to protect themselves and their families.