Blog

<p><strong>The short answer:</strong> the best password manager for you is one that works on every device you use, encrypts your passwords on your own device (look for "zero knowledge"), lets you export your data, offers emergency or family access, and has been independently audited. For most families, a paid plan at a few pounds a month is worth it. NordPass is the one I use myself.</p><p>Every week someone tells me they know they should be using a password manager, and then asks me which one to get. It is a fair question, and it is usually where people stall. There are dozens of them, the marketing all sounds the same, and a lot of the "best password manager" lists online are written by people paid per click rather than people who have set these things up for real families. So rather than hand you a ranked list, I want to show you how I actually decide. Once you understand the criteria, you can choose the right one for your life and stop worrying that you have picked wrong.</p><h2>Start With How You Actually Live Online</h2><p>Before looking at a single product, I ask people three questions. How many devices do you use in a normal week? Does anyone else need access to some of your logins? And what happens to your accounts if something happens to you?</p><p>The answers change the recommendation completely. A retired gentleman who uses one iPad and nothing else needs something very different from a couple juggling two phones, a shared laptop, a work machine and a teenager who keeps borrowing the tablet. If you and your partner both need the electricity account login, sharing matters more than any feature on the box. If you are the only person who knows how to get into the family email, emergency access matters more than price.</p><p>Write your answers down before you start comparing. Most people end up with the wrong tool because they compared features before anyone asked them about their own situation.</p><h2>The Five Things I Check Before Anything Else</h2><p>When I look at a password manager, I check the same five things every time.</p><figure id="figure-xhxrzzgpvemtc1fpf6"><img id="xhxrzzgpvemtc1fpf6" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Man using a password manager on his phone to keep his logins safe" src="https://cdn.durable.co/covers/22JGHvhqAR5zn3MLuxQlQkBE0erI5OO5GkH1wdZLu1DaA6xHoKImht9cHhDDTgyq.jpg" alt="Man using a password manager on his phone to keep his logins safe" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/22JGHvhqAR5zn3MLuxQlQkBE0erI5OO5GkH1wdZLu1DaA6xHoKImht9cHhDDTgyq.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><p>First, does it work everywhere you are? If it does not have a proper app on your phone and an extension in the browser you actually use, you will stop using it within a fortnight. Convenience is not a luxury here, it is the whole point.</p><p>Second, is the encryption done on your device rather than on their servers? The phrase to look for is zero knowledge. It means the company cannot read your passwords even if they wanted to, and it means a breach of their systems does not hand a criminal your bank login.</p><p>Third, can you get your data back out? Any manager worth using lets you export everything to a plain file. If a company makes leaving difficult, that tells you something about how they see you.</p><p>Fourth, is there proper emergency or family access? This is the feature people never think about and always end up needing. Being able to nominate someone who can reach your accounts after a set delay has saved more than one family I have worked with a great deal of grief.</p><p>Fifth, has the company been independently audited, and did they say anything when they had a problem? Every large provider will eventually have an incident. What matters is whether they published it quickly and in plain English. I have looked closely at <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass </a>on this front and it holds up well, which is why it sits in my toolkit rather than a dozen alternatives.</p><h2>What I Ignore in the Marketing</h2><p>Plenty of what gets shouted about on pricing pages makes no practical difference to an ordinary household.</p><p>Military grade encryption is a phrase with no technical meaning. Almost everything reputable uses the same underlying standard, so it tells you nothing about which product is better.</p><p>Unlimited password storage sounds generous until you realise nobody has ever hit a sensible limit. The average person I sit down with has somewhere between eighty and two hundred logins.</p><p>Dark web monitoring is the one I get asked about most. It is a nice extra, not a reason to choose. Being told your email turned up in a breach is only useful if you then change the password, and a good manager helps you do that whether or not it sent you the alert.</p><p>Bundled VPNs thrown into a password subscription are usually the weakest version of that company's product. If you want a VPN, choose one on its own merits. That is why I point people to <a href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" target="_blank" rel="noopener" data-mce-href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902">NordVPN </a>separately rather than treating it as a freebie.</p><h2>Free, Paid, or the One Built Into Your Browser</h2><p>The managers built into Chrome, Safari and Edge have improved enormously, and if the honest choice is between using one of those and carrying on with the same password everywhere, use the browser one today. It is a genuine improvement over what most people are doing.</p><p>The catch is that they tie you to one ecosystem. Move from an iPhone to an Android handset, or use Chrome at home and Edge at work, and things get awkward fast. They also tend to have thin sharing and recovery options, which brings us back to those questions at the start.</p><p>Free standalone plans are a reasonable middle step, but read what is limited. Some cap the number of devices, which quietly defeats the purpose. Paid plans usually run somewhere between two and four pounds a month, and family plans covering five or six people often cost barely more than a single licence. If more than one person in the house needs this, the family plan is almost always the better value.</p><h2>Zero-Knowledge Encryption Isn't Optional</h2><p>This is the one I check first and the one I won't compromise on at all. A proper password manager encrypts your data on your own device before it ever reaches the company's servers, using a master password only you know, which means even the company running the service can't read your stored passwords if they wanted to. That's what "zero-knowledge" actually means in practice, not just a marketing phrase on a features page. If a provider can reset your master password for you, or their support team can technically view your vault contents, that's a structural weakness, not a convenience feature. I ask this question directly when I'm evaluating anything new, because everything else on this list matters a lot less if the underlying architecture doesn't hold up.</p><h2>Password Manager Questions I Get Asked</h2><h3>Are password managers safe?</h3><p>A reputable one is far safer than reusing passwords or keeping them in a notebook. With zero-knowledge encryption, a strong master password and two-factor authentication on the vault, your passwords are protected even if the company itself is attacked.</p><h3>What happens if my password manager gets hacked?</h3><p>With a zero-knowledge manager, what's stored on their servers is scrambled, and it can't be unlocked without your master password. That's exactly why your master password needs to be long and used nowhere else.</p><h3>What if I forget my master password?</h3><p>Most password managers can't recover it for you, because they never see it. Set up the recovery options and emergency access on day one, while you still remember everything.</p><h3>Is the password manager built into my phone or browser good enough?</h3><p>It's a big improvement on reusing passwords, so use it if that's the choice. The downside is that it ties you to one company's devices and usually has weaker sharing and recovery options.</p><h3>Can I share passwords safely with my family?</h3><p>Yes. Family plans let you share specific logins, like the electricity account or the streaming service, without handing over everything else. It's much safer than texting passwords to each other.</p><h2>How to Move In Without Losing a Weekend</h2><p>The biggest reason people abandon this is that they try to fix all two hundred logins in one sitting, get halfway, and give up.</p><p>Do it the slow way instead. Install the manager and set a long master password you can actually remember. A short phrase of three or four unrelated words beats a jumble of symbols, and the <a href="https://www.ncsc.gov.uk" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk">National Cyber Security Centre </a>has said as much for years. Turn on two factor authentication for the manager itself before you put anything in it, because that vault is now the most valuable thing you own online.</p><p>Then change nothing. Just let it save logins as you use them over the next month. Once it has captured your regular accounts, sit down for twenty minutes and update the important handful properly: email first, then banking, then anything holding a saved card. Email comes first because whoever controls your inbox can reset everything else.</p><p>That is the whole method. Answer the three questions, check the five things, ignore the noise, and move in gradually. If you would rather talk it through with someone before you commit to anything, <a href="https://kellssecurity.com/contact" data-mce-href="https://kellssecurity.com/contact">get in touch</a> and I will happily walk you through it.</p><p>If you want the full picture on spotting the scams that go after your accounts, grab my <a href="https://79516839.sibforms.com/serve/MUIFAAzCSl0YuEwRMq4a4xv696PrjPtci8pqRdpNUvPRnH9fF-gauC1E_eGFVnwYYGIz2Wdg8bfKiwSjYjxoukXt_Dz7JlzqD5-mpQiIXVKfIA0-0B2cjR54xgODntiOjGBJ2K4Pq2-T3AQqxmQ5ER1uv0WQSEUzNeTje1QXmDkFm_sADqNAYtxABtGZXkJfeM24GY5zcWVw8UV1" data-mce-href="https://79516839.sibforms.com/serve/MUIFAAzCSl0YuEwRMq4a4xv696PrjPtci8pqRdpNUvPRnH9fF-gauC1E_eGFVnwYYGIz2Wdg8bfKiwSjYjxoukXt_Dz7JlzqD5-mpQiIXVKfIA0-0B2cjR54xgODntiOjGBJ2K4Pq2-T3AQqxmQ5ER1uv0WQSEUzNeTje1QXmDkFm_sADqNAYtxABtGZXkJfeM24GY5zcWVw8UV1">free Safety Checklist</a> and I'll send you a short email series with the rest. If you'd rather have it all in one place, my book <a href="https://www.amazon.co.uk/dp/B0HJMF41G2" data-mce-href="https://www.amazon.co.uk/dp/B0HJMF41G2">Spot the Scam:</a> A Plain English Guide to the Ten Cons Trying to Catch You Out is on Amazon.</p><p>Affiliate disclosure: some links on this page, including NordPass and NordVPN, are affiliate links. If you buy through them I may earn a commission at no extra cost to you. I only recommend tools I'd use myself.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

How I'd Choose a Password Manager If I Were Starting Today

<p>People ask me what the cyber threat landscape looks like as if there is one answer. There is not. What lands in your inbox depends almost entirely on who the criminal thinks you are. A second year student in a shared house and a retired couple a few streets over get approached in completely different ways, by different people, with different bait. So instead of another list of scary statistics, here is what I actually see happening to four different groups of people, and what tends to stop it.</p><h2>Students and Young Renters</h2><p>The student population in any university town is enormous, and criminals know exactly when term starts.</p><figure id="figure-hvbzfwu9z6mtc20dpd"><img id="hvbzfwu9z6mtc20dpd" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Man smiling as he uses his phone safely, Who Actually Gets Targeted Online, and With What" src="https://cdn.durable.co/covers/22JGHvhqAR5zn3MLuxQlQkBE0erI5OO5GkH1wdZLu1DaA6xHoKImht9cHhDDTgyq.jpg" alt="Man smiling as he uses his phone safely, Who Actually Gets Targeted Online, and With What" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/22JGHvhqAR5zn3MLuxQlQkBE0erI5OO5GkH1wdZLu1DaA6xHoKImht9cHhDDTgyq.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><p>The two I see constantly are the accommodation deposit scam and the fake part time job. The accommodation one runs on urgency. A flat appears on a listings page or a housing group at a suspiciously good price, the landlord is away and cannot do viewings, and there are three other people interested, so send the deposit today. The money goes and the flat never existed.</p><p>The job version is quieter and more damaging. An easy remote role, a friendly interview over a messaging app, and then a request for bank details for payroll before any work happens. Sometimes the account is then used to move other people's stolen money, which turns a victim into a suspect.</p><p>The other thing that catches this group is public wifi. Cafes, libraries, the university buildings, the train. Most of it is fine now, but if you are logging into banking from a network you did not set up, a VPN is a sensible habit rather than paranoia. It is one of the reasons I keep <a href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" target="_blank" rel="noopener" data-mce-href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902">NordVPN </a>in my own kit.</p><h2>Parents Running a Household</h2><p>If you are the person who sorts the bills, the school payments, the online shop and the family phone contracts, you are handling more accounts than anyone else in the house, and that is exactly why you get hit.</p><p>The dominant one right now is the <a href="https://kellssecurity.com/blog/the-delivery-scams-i-see-every-december" data-mce-href="https://kellssecurity.com/blog/the-delivery-scams-i-see-every-december">delivery message</a>. You genuinely are expecting three parcels, so a text about a missed delivery and a small redelivery fee does not feel absurd. The fee is not the point. The card details are.</p><p>Close behind is the school or club payment message. Someone spoofs a name you recognise, mentions a trip or a kit order, and asks you to pay by bank transfer instead of the usual portal. The tell is always the same. A change to how you normally pay is the single most reliable warning sign in any scam, and it applies whether the message claims to be from a school, a builder, or your own bank.</p><p>The habit that fixes most of this is not a piece of software. It is a rule that you never pay anyone from a link in a message. You go to the app or the website you already use.</p><h2>Retired People, and Why the Stereotype Is Wrong</h2><p>I want to be careful here, because the assumption that older people are hopeless with technology does more harm than the scams do. Plenty of my sharpest clients are in their seventies. The difference is not skill. It is that criminals put far more effort into this group, because that is where the savings are.</p><p>The approaches are more personal. A phone call rather than a text. A conversation that builds over days. Someone claiming to be from the bank's fraud team, who already knows your name and the last four digits of your card, asking you to move money to a safe account. No bank will ever ask you to do that, and anyone who does is stealing from you.</p><p>The strongest protection I have found is social rather than technical. Agree with your family that any request involving money gets a second opinion before anything moves, and that nobody will ever be annoyed at being asked. Scammers rely on isolation and embarrassment. A household that talks openly about this is a genuinely hard target.</p><h2>Small Traders and Sole Directors</h2><p>Small local economies run on small operations. One van, one salon, one consultancy, one person doing everything including the invoicing.</p><p>The one that costs the most is invoice interception. Someone gets into an email account, watches quietly for a while, then sends a real customer a real invoice with changed bank details. The customer pays in good faith, the money is gone, and both sides think they have been robbed by the other. It is not exotic and it is not rare.</p><p>The fix is dull and it works. Two factor authentication on the business email account, and a stated policy that bank details are confirmed by phone on a number you already had. Two minutes on a call beats four thousand pounds down the drain.</p><p>The second one is the fake supplier or directory invoice. Official looking, modest amount, plausible reference number. Sole traders pay these because they are busy and it is easier than querying it. If you do not recognise it, do not pay it.</p><h2>What All Four Groups Have in Common</h2><p>Look at those four lists and the same shape appears every time.</p><p>There is always time pressure. There is always a reason you cannot check through your normal channel. There is always a payment method that is unusual for you. And there is always a story that explains why this time is different.</p><p>Which means the defence is the same for everyone regardless of age or job. Slow down, verify through a route you chose rather than one you were handed, and turn on <a href="https://kellssecurity.com/blog/the-step-by-step-way-i-set-up-two-factor-authentication-for-clients" data-mce-href="https://kellssecurity.com/blog/the-step-by-step-way-i-set-up-two-factor-authentication-for-clients">two factor authentication</a> for your email before anything else, because email is the master key to everything.</p><p>If you want the specific tools I actually recommend rather than a general list, they are all on my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">Safety Toolkit </a>page. And if something has already happened to you, report it to <a href="https://www.actionfraud.police.uk" target="_blank" rel="noopener" data-mce-href="https://www.actionfraud.police.uk">Action Fraud</a> rather than staying quiet about it. Reporting is what turns one person's bad afternoon into a pattern the police can actually act on.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

Who Actually Gets Targeted Online, and With What

<p>Almost every week now, someone tells me they are getting far more scam messages than they used to, and that the messages are much better than they used to be. They are not imagining it and they are not being singled out. Something genuinely changed in the last couple of years, and it is worth understanding why, because once you know what is driving it you stop taking it personally and start dealing with it properly. For the ones that come up again and again, I've written about <a href="https://kellssecurity.com/blog/the-scams-people-ask-me-about-most-often" data-mce-href="https://kellssecurity.com/blog/the-scams-people-ask-me-about-most-often">the scams people ask me about most often</a>.</p><figure id="figure-ekfnsahmqfmtc2oaei"><img id="ekfnsahmqfmtc2oaei" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Phone showing a fake text message beside a laptop, Why You Are Getting More Scams Than You Used To" src="https://cdn.durable.co/covers/8inEPs1ne1Ks8XrRvFgnfPrJTIoYpVFysQ3peVkoGOzFYNE3VZMLp5SH7If8XZ3g.jpg" alt="Phone showing a fake text message beside a laptop, Why You Are Getting More Scams Than You Used To" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/8inEPs1ne1Ks8XrRvFgnfPrJTIoYpVFysQ3peVkoGOzFYNE3VZMLp5SH7If8XZ3g.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>Scams Used to Be Expensive to Run</h2><p>For a long time, the thing that limited fraud was effort.</p><p>Someone had to write the message. Someone had to translate it, badly, into a language they did not speak. Someone had to sit on the phone for hours getting hung up on. Every single attempt cost the criminal time, and time is the one thing that stopped this being a bigger industry than it was.</p><p>That is why the old scams were so scattergun. The famous foreign prince email was sent to millions of people at once because the sender could not afford to write anything tailored. It was a wide net with big holes in it, and most of us learned to spot it.</p><h2>What Actually Changed</h2><p>The tools that write text and generate speech got good, and they got cheap.</p><p>A person who could once produce twenty crude emails an hour can now produce two thousand, each one different, each one in fluent English, each one written in whatever tone the target is likely to respond to. The cost per attempt collapsed. When the cost of trying drops to almost nothing, the rational thing for a criminal to do is try far more often.</p><p>That is the whole story of why your inbox got busier. It is not that you have been added to some list. It is that the economics tipped, and the volume went up for everybody.</p><p>Voice is the part that unsettles people most, and fairly so. A short clip of someone speaking, taken from a video anyone has posted publicly, is enough to produce a convincing imitation of that voice saying something they never said. I have sat with people who were certain they had spoken to their own son. That is not gullibility. It is a fair reaction to hearing a voice you have known for thirty years.</p><h2>Why the Spelling Mistakes Disappeared</h2><p>For years the standard advice was to look for bad grammar and odd phrasing. That advice is now close to useless, and I would rather tell you that plainly than let you rely on it.</p><p>There is an old theory that scammers wrote badly on purpose to filter out anyone too alert to be worth their time. There is something in it, but it does not matter any more, because writing well now costs nothing. The messages I get shown are clean, correctly punctuated, and often better written than the real ones from the same company.</p><p>So the tell has moved. It is no longer in the spelling. It is in the shape of the request. Is someone creating urgency? Are they steering you away from your normal way of doing things? Are they asking you to do something you cannot easily undo? Those three questions still catch almost everything, and they will keep working long after the surface polish gets even better. If you want the practical version of this, it is what I set out in <a href="https://kellssecurity.com/blog/the-simple-checks-i-use-to-stop-ai-scams" data-mce-href="https://kellssecurity.com/blog/the-simple-checks-i-use-to-stop-ai-scams">the simple checks I use</a>.</p><h2>Why It Feels So Personal Now</h2><p>The other half of the change is data.</p><p>Every breach of a company you have dealt with adds a little more to what is publicly known about you. Your email address, an old password, a phone number, the town you live in, where you shop. On its own each fragment is dull. Combined and fed into a system that writes messages, it produces something that sounds like it knows you, because in a limited way it does.</p><p>This is why the message about a delivery arrives when you actually are waiting for one, and why the caller knows which bank you use. It is not surveillance in the dramatic sense. It is old leaked data being used efficiently for the first time.</p><p>There is a practical consequence. Reused passwords used to be a slow risk. Now they are an immediate one, because matching an old leaked password to your current accounts is trivial to automate. A password manager like <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass </a>is not a luxury purchase any more, it is the single cheapest way to make all that leaked data useless.</p><h2>What Still Works Against All of It</h2><p>None of this means you are helpless. It means the defences that rely on spotting a fake have got weaker, and the defences that rely on process have got stronger. So lean on process.</p><p>Verify on a channel you chose. If a message or a call asks for anything that matters, close it and go to the app, the website, or the number on the back of your card. A criminal can imitate a voice, a face and a writing style, but they cannot answer the phone when you dial your bank yourself.</p><p>Agree a family question. Something ordinary that only your family would know the answer to, and that is not written down anywhere online. It costs nothing and it defeats a cloned voice in about four seconds.</p><p>Turn on two factor authentication on your email first, then your bank, then everything else. This is still the highest value hour you will ever spend on your own security.</p><p>Slow down when you are being hurried. Every version of this, old and new, depends on you acting before you think. Urgency is the constant. <a href="https://www.takefive-stopfraud.org.uk" target="_blank" rel="noopener" data-mce-href="https://www.takefive-stopfraud.org.uk">Take Five to Stop Fraud</a> has said the same thing for years and it has not stopped being true.</p><p>That is the honest picture. More attempts, better written, better targeted, and a set of defences that still hold if you use them. If you would like a hand setting any of it up, get in touch and I will walk you through it in plain English.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

Why You Are Getting More Scams Than You Used To

<h2>Why I Still Get Nervous at Checkout</h2><p>I have bought things online for years and I still slow down at the checkout page every single time. Not because I think every shop is a scam, but because this is the exact moment a fake store is designed to catch you. You have already decided you want the item, you are focused on getting a good price, and your guard is naturally lower than it was when you first landed on the site. Scammers know this, which is why so many fake shopping sites put real effort into the browsing experience and cut corners on the parts most people never scrutinise, like the payment page itself. A few seconds of attention here has saved me more than once, and it is the habit I would want every shopper to pick up before the next big sale event, not after something has already gone wrong. I have seen how quickly a good mood about finding a bargain turns into a bad afternoon spent on the phone to a bank, and almost all of it was avoidable with a bit more care at exactly this stage.</p><p><br></p><h2>The Web Address I Look at Before Anything Else</h2><p><br></p><p>Before I type a single card digit, I look at the address bar. I am checking for the padlock, but more importantly I am checking that the domain matches the shop I think I am on. Fake checkout pages are often bolted onto a domain that looks close to the real one, with an extra word, a different ending, or a string of random characters tacked on. If I searched for a product and landed on a site through an advert, I am even more careful, because scam ads have a way of slipping past moderation and pointing to lookalike stores built purely to harvest card details. If anything about the web address looks even slightly wrong, I close the tab and go to the retailer directly by typing the address myself or using their official app. I do the same check again right before I submit payment, because some fake pages redirect partway through the process, after the browsing already felt convincing enough to lower my guard.</p><p><br></p><h2>The Payment Methods That Protect Me If Something Goes Wrong</h2><p><br></p><p>How I pay matters almost as much as who I am paying. I use a credit card for anything above a small amount because of the extra protection it gives me if a purchase turns out to be fraudulent, and I avoid bank transfers entirely for anything bought from a stranger or an unfamiliar site, since that money is very hard to get back once it is gone. I am also careful about which sites I let store my card details for next time. This is one of the areas where a <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">password manager </a>earns its keep, because it can fill in payment details only on the genuine saved site rather than a lookalike, which is one more reason I have written before about the choice between a <a href="https://kellssecurity.com/blog/how-id-choose-a-password-manager-if-i-were-starting-today" data-mce-href="https://kellssecurity.com/blog/how-id-choose-a-password-manager-if-i-were-starting-today">password manager and just memorising everything</a>. Good antivirus software plays a part here too. I run <a href="https://www.bitdefender.com/en-us/consumer/?irclickid=WxSzmdWRXxyZWsOzKNx6sWZFUkrxGHQpm0ekVY0&amp;im_rewards=&amp;irgwc=1&amp;afsrc=1&amp;MPid=6273270&amp;cid=aff|c|IR|Cyber%20Jay" target="_blank" rel="noopener" data-mce-href="https://www.bitdefender.com/en-us/consumer/?irclickid=WxSzmdWRXxyZWsOzKNx6sWZFUkrxGHQpm0ekVY0&amp;im_rewards=&amp;irgwc=1&amp;afsrc=1&amp;MPid=6273270&amp;cid=aff|c|IR|Cyber%20Jay">Bitdefender </a>on my own devices, and its web protection has quietly blocked checkout pages before I ever got the chance to enter anything, which is exactly the kind of second layer I want when I am moving fast and not reading every detail as closely as I should.</p><p><br></p><figure id="figure-vcj8hraanqmtct9re3"><img id="vcj8hraanqmtct9re3" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Man smiling as he uses his phone safely, The Checkout Red Flags I Check Before Entering My Card" src="https://cdn.durable.co/covers/22JGHvhqAR5zn3MLuxQlQkBE0erI5OO5GkH1wdZLu1DaA6xHoKImht9cHhDDTgyq.jpg" alt="Man smiling as he uses his phone safely, The Checkout Red Flags I Check Before Entering My Card" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/22JGHvhqAR5zn3MLuxQlQkBE0erI5OO5GkH1wdZLu1DaA6xHoKImht9cHhDDTgyq.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>The Site Details That Tell Me a Shop Is Real</h2><p><br></p><p>Beyond the address bar, I look for the boring, unglamorous details that scam sites rarely bother getting right. A proper returns policy, a real contact address rather than just a contact form, and reviews that exist somewhere other than the shop's own website are all good signs. I also check how long the site has existed if something feels off, since a domain registered a few weeks ago selling designer goods at half price is a pattern I have seen too many times to ignore. Spelling and grammar across the site is another small tell, not because a genuine shop never makes a typo, but because a whole site full of slightly-off phrasing usually means it was thrown together quickly with no real business behind it. None of this takes long once it becomes habit, and I would rather spend thirty seconds checking than spend weeks trying to claim money back from my bank.</p><p><br></p><h2>What I Do When a Deal Looks Too Good</h2><p><br></p><p>The oldest rule in online shopping is still the most useful one. If a deal looks too good to be true, I treat that as a reason to slow down rather than speed up. Scammers rely on excitement overriding caution, especially around big sale periods when genuine discounts make it harder to tell real bargains from bait. I will often search the product and shop name together along with the word scam before I buy from somewhere unfamiliar, just to see what comes up. If I do get caught out, or even just suspect I have been, I report it through <a href="https://www.actionfraud.police.uk" target="_blank" rel="noopener" data-mce-href="https://www.actionfraud.police.uk">Action Fraud</a>, which is the UK's national reporting centre for fraud and cyber crime, because reporting helps get fraudulent sites taken down faster for everyone else too. For anyone who wants a simple checklist to run through before they buy from a new site, my <a href="../safety-toolkit" data-mce-href="../safety-toolkit">safety toolkit </a>has the free download I mention to clients, and it covers this alongside the wider checks I recommend for staying safe online in general.</p><p><br></p><p>None of this requires any special technical skill. It is a handful of habits that take seconds once you know what you are looking for, and they are exactly the kind of checks that stop most online shopping scams before they cost you anything.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The Checkout Red Flags I Check Before Entering My Card

<h2>The Call That Sounded Exactly Like My Nephew</h2><p>My phone rang on a Tuesday evening and the voice on the other end was unmistakably my nephew. Same pitch, same way he rushes his words when he's stressed, even the little laugh he does halfway through a sentence when he's nervous. He said he'd been in a car accident, that he needed money transferred straight away to cover a tow truck and an excess payment, and that he didn't want his mum finding out yet. Every instinct told me this was him. It wasn't. It was an AI-generated clone of his voice, built from clips of him talking on social media, and I came within a few taps of sending money before something made me pause.</p><p>I'm writing this because I nearly got caught, and because I think a lot of people assume <a href="https://kellssecurity.com/blog/the-simple-checks-i-use-to-stop-ai-scams" data-mce-href="https://kellssecurity.com/blog/the-simple-checks-i-use-to-stop-ai-scams">voice cloning scams </a>are still clumsy or rare. They aren't. The technology has moved fast, and the calls now sound close enough to a real family member that "I'd know my own nephew's voice" isn't the safety net it used to be.</p><h2>How AI Voice Cloning Works With Just Seconds of Audio</h2><p>What shook me afterwards was learning how little material a scammer actually needs. A short video posted online, a voicemail greeting, even a few seconds of someone talking in the background of a clip, is enough for modern voice cloning tools to build a convincing copy. The software analyses tone, pitch, pacing and accent, then generates new sentences in that same voice that the person never actually said.</p><p>This is why the old advice of "listen for anything that sounds off" doesn't hold up as well as it used to. The audio quality on these calls can be excellent, and scammers often add background noise, a shaky signal, or claim the person is in a stressful situation, which conveniently explains away any small imperfections in the voice. The panic in the story does a lot of the scammer's work for them, because it discourages the kind of calm, careful listening that might otherwise catch something wrong.</p><figure id="figure-bl3lytaxzwmtd01rl0"><img id="bl3lytaxzwmtd01rl0" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Worried older man on a suspicious phone call, The Voice Clone Call That Almost Had Me Fooled" src="https://cdn.durable.co/covers/53TSLRnp03hV6RbE3sAyBIrtLB7DB0QpFBjOkVjCSmt9lTxV8mwEZUb7Zr3Wxekr.jpg" alt="Worried older man on a suspicious phone call, The Voice Clone Call That Almost Had Me Fooled" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/53TSLRnp03hV6RbE3sAyBIrtLB7DB0QpFBjOkVjCSmt9lTxV8mwEZUb7Zr3Wxekr.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>The Family Codeword That Stops This Cold</h2><p>After that call, the first thing I did was set up a family codeword with my nephew, my sister, and my parents. It's a simple word or short phrase that has nothing to do with any of us personally, so it can't be guessed from a social media profile, and everyone in the family knows to ask for it if a call involves money, an emergency, or anything urgent.</p><p>The logic is straightforward. A cloned voice can copy how someone sounds, but it can't know a private codeword unless the real person has shared it, and a scammer working from a script has no way to supply it convincingly under pressure. If the person on the phone can't give the word, or hesitates and tries to change the subject, that's the moment to hang up and call them back directly on a number you already have saved, not one they've just given you.</p><p>I'd genuinely recommend this to anyone reading, whatever your family setup looks like. It takes about two minutes to agree on, and it turns an impossible question, does this voice sound right, into a simple one, did they say the word.</p><h2>Other Signs the Call Isn't Who It Claims to Be</h2><p>Beyond the codeword, I've picked up a few habits that help me stay steady when a call like this comes in. Urgency is the biggest tell. Real emergencies rarely require an instant bank transfer with no other option, and a genuine request from a family member can almost always wait the few minutes it takes to call them back on a known number.</p><p>I'm also wary of any call that asks for payment in an unusual form, such as gift cards, cryptocurrency, or a transfer to an account I don't recognise. Legitimate emergencies, like a tow truck or a hospital fee, don't typically require that kind of payment method, and a scammer will often push for something fast and hard to trace.</p><p>Another habit I've built is simply not confirming details the caller should already know. If someone claims to be my nephew but seems to be fishing for his own middle name or his mum's address, that's backwards, and it's worth noticing. A real family member calling in a panic wouldn't need me to remind them who they are.</p><h2>What I Do the Moment Something Feels Off</h2><p>These days, if I get a call like that one again, I don't try to reason it out on the spot. I tell the caller I need to check something and I'll call them straight back, then I hang up and ring my nephew directly, using the number already saved in my phone rather than anything given to me during the call. Nine times out of ten that alone reveals the truth within seconds.</p><p>I've also started talking about this openly with the wider family, including the older relatives I support, because the <a href="https://kellssecurity.com/blog/who-actually-gets-targeted-online-and-with-what" data-mce-href="https://kellssecurity.com/blog/who-actually-gets-targeted-online-and-with-what">people scammers target hardest</a> are usually the ones least likely to have heard that voice cloning is even possible. A quick conversation over a cup of tea about "if I ever ring you sounding panicked about money, ask me the word first" has done more for our family's safety than any piece of software could.</p><p>I've tightened up the basics too, since a scammer who's already studied one part of your life will happily use anything else they can find. My accounts now run on strong, unique passwords through <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass</a>, so if one login was ever exposed somewhere, it couldn't be reused to unlock everything else.</p><p>None of this requires any special technical skill, just a shared plan agreed in a calm moment, before you ever need it. That's the part that actually would have stopped me on that Tuesday evening, and it's the part I'd urge anyone reading this to sort out with their own family today.</p><p>If you want more practical steps like this one gathered in a single place, I've put together a free <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">Safety Toolkit</a> with checklists you can run through with your own family. For the official UK guidance on scam calls and messages, the <a href="https://www.ncsc.gov.uk" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk">NCSC </a>also has clear advice worth bookmarking.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The Voice Clone Call That Almost Had Me Fooled

<h2>The Verification Habits I Rely On Whenever I Suspect an AI Scam</h2><p>I used to think spotting an AI scam was mostly about noticing the right warning signs, a slightly off voice, a video that blinked strangely, a message that felt a bit too polished. I still watch for those things, but I've learned they're not enough on their own anymore. AI tools have gotten good enough that spotting something wrong by instinct alone is a coin flip at best. What actually protects me now isn't sharper instincts, it's a small set of verification habits I fall back on the moment something feels even slightly off, habits that don't depend on catching a technical flaw in whatever I'm looking at. These are the ones I actually use, in the order I actually reach for them.</p><h2>Why Suspicion Alone Isn't Enough Anymore</h2><p>For years the advice was to trust your gut, and for years that mostly worked, because faked audio and video used to carry obvious tells if you knew what to look for. That advantage has mostly disappeared. I've had a <a href="https://kellssecurity.com/blog/the-voice-clone-call-that-almost-had-me-fooled" data-mce-href="https://kellssecurity.com/blog/the-voice-clone-call-that-almost-had-me-fooled">voice clone call almost catch me out </a>despite knowing exactly what to listen for, because the tone, the pacing, even the small verbal habits were all convincingly right. That experience is what pushed me away from relying on instinct as my main defence. If something sounding or looking real can still be fake, then the only thing left that actually works is a verification step that doesn't depend on how convincing the fake is in the first place. That's the shift in thinking behind everything else here, treat suspicion as the trigger for a process, not as the judgement itself.</p><figure id="figure-vxq97kn97mtj2j6w9"><img id="vxq97kn97mtj2j6w9" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Worried older man on a suspicious phone call, The Verification Habits I Use to Spot an AI Scam" src="https://cdn.durable.co/covers/53TSLRnp03hV6RbE3sAyBIrtLB7DB0QpFBjOkVjCSmt9lTxV8mwEZUb7Zr3Wxekr.jpg" alt="Worried older man on a suspicious phone call, The Verification Habits I Use to Spot an AI Scam" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/53TSLRnp03hV6RbE3sAyBIrtLB7DB0QpFBjOkVjCSmt9lTxV8mwEZUb7Zr3Wxekr.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>Calling Back on a Number I Already Trust</h2><p>If a call, text, or voicemail claims to be from my bank, a supplier, or anyone else asking me to act, I don't call back on any number the message itself provides, ever. Scammers can spoof caller ID and hand you a "helpful" callback number that just connects you straight back to them. What I do instead is hang up and dial a number I already had saved before the call came in, from a bank statement, an old invoice, or the official website I typed in myself. This one habit alone closes off almost every version of this scam, because it removes the scammer's ability to control which number I end up calling. It costs me an extra thirty seconds and it's saved me more than once.</p><h2>The Family Code Word That Beats Any Voice Clone</h2><p>This is the habit I'm most glad I set up before I actually needed it. My close family and I agreed on a private code word, something unrelated to anything a scammer could guess or scrape from social media, that gets used specifically for any call claiming to be an emergency involving money or urgent help. A voice clone can copy tone and cadence almost perfectly, but it can't produce a piece of information that was never said out loud anywhere public. If a panicked call comes in asking for money and the code word doesn't come up correctly when I ask for it, that's the end of the conversation as far as I'm concerned, no matter how real the voice sounds. I'd genuinely recommend this to anyone with older relatives specifically, since they tend to be targeted with exactly this kind of urgent, emotional call.</p><h2>Asking for Something Scripted Can't Predict</h2><p>Beyond the code word, I've got a habit of asking for something in the moment that a scripted or cloned interaction can't anticipate, referencing a specific shared memory, asking an oddly specific follow-up question, or simply asking the person to do something live and unscripted rather than continuing to read from whatever they've prepared. This works because most AI-assisted scams, however good the voice or video quality, are still built around a script or a limited set of responses. Pushing the conversation somewhere the scammer didn't plan for tends to expose the gap fast, either the responses get vague and evasive, or the call ends abruptly. I've written separately about <a href="https://kellssecurity.com/blog/the-simple-checks-i-use-to-stop-ai-scams" data-mce-href="https://kellssecurity.com/blog/the-simple-checks-i-use-to-stop-ai-scams">the specific AI scam techniques I think are actually getting harder to spot</a>, which covers the technical side of why this gap still exists even as the audio and video quality keeps improving.</p><h2>Checking Official Channels Directly Instead of Trusting the Message</h2><p>For anything that claims to be from a bank, a government department, or a company I actually use, I go directly to their official app or a web address I typed myself, never a link or number provided in the message that raised my suspicion. This applies whether the message arrived as an email, a text, or something that looked like a genuine account notification. One thing that's made this easier day to day is that a password manager like <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass </a>will only auto-fill your login details on the actual domain it's saved against, so if I land on a convincing fake site and nothing auto-fills, that's an immediate and reliable signal that something's wrong, well before I'd have spotted it by eye. It's a small extra layer, but it catches the cases where everything else about the fake looked right.</p><p>None of these habits require any special technical skill, and none of them depend on me correctly spotting a flaw in whatever I'm looking at, which is exactly why I trust them more than instinct alone these days. A callback number I already had, a code word only my family would know, a question a script can't answer, and going to the source directly rather than trusting the message in front of me. Between them, they cover almost every AI-assisted scam I've come across so far, and they're simple enough that I've been able to get my own family using them too. If you want a second, independent source on the latest AI-driven scam patterns to watch for, the <a href="https://www.ncsc.gov.uk/" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/">NCSC </a>publishes ongoing guidance on deepfakes and AI-enabled fraud, and my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">free Safety Toolkit </a>covers the rest of what I'd recommend if you want to get these habits properly in place.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The Verification Habits I Use to Spot an AI Scam

Kells Security Solutions

I teach people around the world how to spot online scams and stay safe on the internet, explained in plain English with no jargon. I cover phishing emails, two-factor authentication, password managers, VPNs and antivirus software, written for people who are not tech experts and want to protect themselves and their families.