Blog

<h2>What Actually Happens When You Report a Scam, and Why I Still Do It</h2><p>For a long time I didn't bother reporting scam messages, even the obvious ones. I'd just delete the text, block the number, or ignore the email, and get on with my day. Reporting felt like it disappeared into a void somewhere, with no way of knowing if it did anything at all. What changed my mind wasn't a single dramatic moment, it was slowly learning what actually happens after you report something, and realising the five minutes it takes is doing more than I'd assumed.</p><h2>Why I Almost Didn't Bother Reporting Anything</h2><p>My honest reason for skipping it for years was that I couldn't see the point. Nobody was going to knock on the scammer's door because I'd forwarded one text message, and it felt like the kind of thing that mattered in theory but achieved nothing in practice. I also didn't know where reports actually went, which made the whole thing feel like shouting into an empty room. It took me a while to understand that individual reports aren't meant to catch one scammer on their own, they're meant to feed a much bigger picture, and that picture is only useful if people like me actually contribute to it.</p><h2>Where I Actually Report Different Types of Scams</h2><p>One thing that used to put me off was not knowing where a report was even supposed to go, so I've settled on a short list depending on what's landed in front of me. Suspicious texts get forwarded to 7726, which routes them straight to my phone provider for free. Scam emails get reported through whatever tool my email provider has built in, which usually takes seconds. Anything involving money, a fraudulent purchase, or a scam I've fallen for even partially goes to Report Fraud (the police service that replaced Action Fraud), since that's the UK's actual national reporting centre for fraud and cybercrime. Suspicious posts or profiles on social media get reported through the platform itself, since that's the fastest route to getting a fake account or listing actually taken down, even though it doesn't feed into the wider national picture the same way. Having these routes sorted in my head means I'm never standing there wondering where something is supposed to go, which used to be enough friction on its own to stop me bothering, and it means the whole process takes under a minute rather than turning into a research task every single time.</p><h2>What Information Actually Helps</h2><p>I used to think reporting meant writing out a long explanation of what happened, which was part of what put me off. In practice, the most useful thing I can do is forward or screenshot the message exactly as it arrived, rather than paraphrasing it from memory. The sender's number or email address matters more than I expected, since that's often what gets matched against other reports of the same scam. If money changed hands, the amount and the method, bank transfer, card payment, gift cards, matters too, since different payment methods get handled differently on the recovery side. I don't need to write a story about how I felt about it. The raw details are what actually get used.</p><figure id="figure-kqqf4wg0uemtdckfup"><img id="kqqf4wg0uemtdckfup" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Phone showing a fake text message beside a laptop, What Actually Happens When You Report a Scam" src="https://cdn.durable.co/covers/8inEPs1ne1Ks8XrRvFgnfPrJTIoYpVFysQ3peVkoGOzFYNE3VZMLp5SH7If8XZ3g.jpg" alt="Phone showing a fake text message beside a laptop, What Actually Happens When You Report a Scam" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/8inEPs1ne1Ks8XrRvFgnfPrJTIoYpVFysQ3peVkoGOzFYNE3VZMLp5SH7If8XZ3g.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>What Happens After I Hit Submit</h2><p>This was the part I genuinely didn't understand for years, and once I did, reporting stopped feeling pointless. Reports to 7726 get used by phone networks to identify and block numbers being used at scale, not just for me individually but across their whole network, which is part of why the same scam text tends to stop arriving a while after enough people report it. Reports to Report Fraud get fed into a national database run alongside the National Fraud Intelligence Bureau, used to spot patterns, connect cases that look separate but aren't, and build the evidence that occasionally does lead to prosecutions, even if that outcome is rare for any single report on its own. None of this happens instantly, and I don't get a satisfying update telling me exactly what my report contributed to. But knowing it's going somewhere that actually does something with the pattern, rather than nowhere at all, was what got me to start bothering in the first place, and it's changed how pointless the whole exercise feels while I'm doing it.</p><h2>Why I Keep Doing It Anyway</h2><p>I'll be honest that reporting still doesn't feel dramatic or immediately rewarding, and I don't expect a personal outcome from any single report I file. What changed is that I stopped judging it by whether it caught the specific person who targeted me and started judging it by whether it added one more data point to a system that genuinely uses those data points. I also report things now even when I wasn't close to falling for them, <a href="https://www.kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything" data-mce-href="https://www.kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything">a scam I could spot instantly</a>, because the report is still useful even if I personally was never at risk. It costs me almost nothing, and I've stopped assuming that nothing happens with it just because I can't see the result directly.</p><p>If something does slip through and you end up clicking a link or handing over details before catching it, reporting is still worth doing immediately rather than out of embarrassment later, and it's worth changing anything that might be exposed straight away, starting with <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">a password manager </a>if you haven't already moved your important accounts onto one. I've pulled together the fuller version of what I report and how in a <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">free Safety Toolkit</a>, and <a href="https://www.reportfraud.police.uk/" target="_blank" rel="noopener" data-mce-href="https://www.reportfraud.police.uk/">Report Fraud</a> has its own guidance on what to do if you think you've been scammed, including cases where money has actually left your account.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

What Actually Happens When You Report a Scam

<h2>The Four Tools I Actually Rely On to Stay Safe Online</h2><p>People ask me fairly often what security software they actually need, usually expecting a long list. I understand the instinct, there's no shortage of apps and services promising to protect you, and it's tempting to think more tools automatically means more safety. In practice, I've settled on four things I actually use every day, and everything else I've tried over the years has either been redundant, more hassle than it was worth, or solving a problem I didn't really have. Here's what actually earns a permanent place on my devices, and why.</p><h2>A Password Manager Comes First</h2><p>If I had to keep only one tool, this would be it, and it isn't close. Every other security habit I have sits on top of this one. Before I started using a password manager properly, I was reusing variations of the same few passwords across dozens of accounts, which meant a single breach anywhere could unlock everything else I owned. A password manager generates a long random password for every account, remembers all of them for me, and fills them in automatically so I never have to type or memorise anything. I've written before about <a href="https://kellssecurity.com/blog/why-i-finally-switched-to-a-password-manager" data-mce-href="https://kellssecurity.com/blog/why-i-finally-switched-to-a-password-manager">why I finally switched to a password manager</a>, and the honest answer is that I put it off for years for no good reason. It's the one tool on this list I'd tell anyone to install today, before any of the others. I use <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass </a>myself, it does exactly what I need it to and stays out of my way.</p><h2>A VPN for the Networks I Don't Trust</h2><p>A VPN sits in second place, and I'll be upfront that I don't think it needs to run every single second the way a password manager does. What it does well is protect what I'm doing on networks I don't control, coffee shop wifi, hotel wifi, anywhere I'm connecting through infrastructure someone else owns and manages. I've written before about <a href="https://kellssecurity.com/blog/what-a-vpn-actually-protects-you-from" data-mce-href="https://kellssecurity.com/blog/what-a-vpn-actually-protects-you-from">why I run a VPN on every device I own</a>, and while my usage has settled into something less constant than that title suggests, the principle hasn't changed, it's still switched on automatically the moment I'm on a network I didn't set up myself. I use a VPN specifically because it's fast enough that I don't notice it running and it's simple enough that I never have an excuse to skip turning it on. <a href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" target="_blank" rel="noopener" data-mce-href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902">NordVPN </a>is the one I use, it connects quickly and I genuinely don't notice it's on.</p><h2>Antivirus Software I Don't Think About</h2><p>This is the tool I actually think about least, which is exactly the point. Good antivirus software should run quietly in the background, catch the small percentage of threats that get past everything else, and never demand my attention unless something's genuinely wrong. I use <a href="https://www.bitdefender.com/en-us/consumer/?irclickid=WxSzmdWRXxyZWsOzKNx6sWZFUkrxGHQpm0ekVY0&amp;im_rewards=&amp;irgwc=1&amp;afsrc=1&amp;MPid=6273270&amp;cid=aff|c|IR|Cyber%20Jay" target="_blank" rel="noopener" data-mce-href="https://www.bitdefender.com/en-us/consumer/?irclickid=WxSzmdWRXxyZWsOzKNx6sWZFUkrxGHQpm0ekVY0&amp;im_rewards=&amp;irgwc=1&amp;afsrc=1&amp;MPid=6273270&amp;cid=aff|c|IR|Cyber%20Jay">security software </a>across my devices for this reason specifically, it's thorough without constantly interrupting me with upsells or false alarms, which was a real problem with software I'd used previously. I don't think antivirus software is the most important tool on this list, most of what actually puts people at risk is behavioural rather than something a scan catches, but it's a reasonable last line of defence for the malware and dodgy downloads that occasionally slip through despite everything else I do.</p><h2>Two-Factor Authentication on Everything That Matters</h2><p>This one is slightly different from the other three because it isn't a piece of software I installed once, it's a setting I turned on individually across every account that matters to me. I don't count it as optional anymore. A strong password from my password manager stops someone guessing their way in, but it does nothing if that password ever gets exposed somewhere I didn't expect, a breach on a site I'd forgotten about, a phishing page that caught me on a bad day. Two-factor authentication is what still holds the door shut even after the password itself has leaked. It costs nothing, takes a few minutes per account, and closes a gap that a password alone genuinely can't.</p><figure id="figure-cuaqownfymtdbww2h"><img id="cuaqownfymtdbww2h" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Man smiling as he uses his phone safely, The Four Tools I Actually Rely On to Stay Safe Online" src="https://cdn.durable.co/covers/22JGHvhqAR5zn3MLuxQlQkBE0erI5OO5GkH1wdZLu1DaA6xHoKImht9cHhDDTgyq.jpg" alt="Man smiling as he uses his phone safely, The Four Tools I Actually Rely On to Stay Safe Online" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/22JGHvhqAR5zn3MLuxQlQkBE0erI5OO5GkH1wdZLu1DaA6xHoKImht9cHhDDTgyq.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>What I Deliberately Don't Bother With</h2><p>I want to be honest about what I've left off this list, because I think it says as much as what's on it. I don't run a separate firewall app, since the one built into my operating system does the job without me needing to manage it myself. I don't use ad blockers as a security measure, only as a convenience one, they're not designed to stop the kind of threats that actually cause damage. I've also tried a couple of all-in-one "security suite" products that bundled a weaker version of everything I've already listed into one subscription, and found I preferred using one good tool for each job rather than one mediocre tool for all of them at once. More apps isn't the same as more protection, and a cluttered phone full of security software I don't understand isn't a safer one.</p><p>What I'd genuinely recommend is starting with the password manager, since almost everything else on this list becomes easier once that's in place, then adding the rest one at a time rather than trying to overhaul everything in a single weekend. None of these four tools took more than a few minutes to set up individually, and together they cover the overwhelming majority of what actually goes wrong for people online. If you want the fuller version of what I've put in place, including step by step guidance on setting each of these up, I've pulled it together in a <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">free Safety Toolkit</a>, and the <a href="https://www.ncsc.gov.uk" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk">NCSC </a>has clear guidance on choosing security software as well if you want a second, independent source to check any of this against.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The Four Tools I Actually Rely On to Stay Safe Online

<h2>Why I Stopped Oversharing on Social Media</h2><p>For years I posted without thinking twice about it. Holiday photos while I was still away, the school my kids went to tagged in a dozen pictures, a running commentary on my daily routine that anyone could piece together in an afternoon. None of it felt risky in the moment because none of it felt like a secret. It's just what you post, isn't it. The shift for me wasn't a single bad experience. It was slowly realising that a stranger scrolling through my profile could build a surprisingly accurate picture of my life, my habits, and my family, without me ever handing it to them directly.</p><p><br></p><h2>What I Used to Post Without Thinking</h2><p><br></p><p>My old habit was simple. If something happened, I posted about it, usually in real time. A weekend away, a new car, a work trip, my daughter's first day at a new school. I liked the connection it gave me with friends and family who weren't nearby, and I still think that part of it is genuinely valuable. What I didn't think about was how much of that content, added together over months, formed a detailed pattern. Anyone could have worked out roughly when my house was empty, which school my children attended, what car I drove and therefore what it was worth, and who was in my immediate circle.</p><p><br></p><p>None of that felt sensitive individually. A single holiday photo isn't a security risk on its own. The problem was the accumulation, and I wasn't thinking in those terms at all.</p><p><br></p><h2>What That Information Actually Adds Up To</h2><p><br></p><p>The specific thing that changed my thinking was reading about how scammers use publicly available information to make fraudulent approaches feel personal and convincing. A message that references your actual holiday dates, your child's actual school, or the name of a relative you've tagged before doesn't read as a generic scam. It reads as something only someone who knows you could have sent, which makes people far more likely to lower their guard.</p><p><br></p><p>I've written before about <a href="https://kellssecurity.com/blog/the-voice-clone-call-that-almost-had-me-fooled" data-mce-href="https://kellssecurity.com/blog/the-voice-clone-call-that-almost-had-me-fooled">a voice clone call that nearly caught me out</a>, and the unsettling part wasn't the cloned voice itself. It was how a scammer could combine a few seconds of publicly posted audio with details lifted from social profiles to build something convincing enough to fool someone who wasn't expecting it. Social media doesn't need to be hacked for this to work. Public information, freely posted, is often enough on its own.</p><p><br></p><h2>The Specific Things I Stopped Sharing</h2><p><br></p><p>I didn't delete my accounts or stop posting altogether, because that felt like an overcorrection I wasn't prepared to make. What I changed was more specific. I stopped posting about travel while I was still away, and now wait until I'm back home before sharing anything. I stopped tagging my children's school by name, even in posts that felt otherwise harmless. I got more careful about geotagging, since a location tag on a photo taken at home effectively confirms an address to anyone looking.</p><p><br></p><p>I also went back through older posts and removed a few that, on reflection, gave away more than I'd intended, a work ID badge visible in a photo, a house number caught in the background of a picture I'd forgotten about. None of it was catastrophic individually, but together it was more than I was comfortable having permanently public.</p><figure id="figure-0p25ygvd5mtd9tzjo"><img id="0p25ygvd5mtd9tzjo" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Woman reading online safety advice on her laptop, Why I Stopped Oversharing on Social Media" src="https://cdn.durable.co/covers/1b6yok9RJBZAfVJCU68TtCAefcOkWASoEAg2dAh9pXKihM78nnfL0P7qcT5IAgmm.jpg" alt="Woman reading online safety advice on her laptop, Why I Stopped Oversharing on Social Media" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/1b6yok9RJBZAfVJCU68TtCAefcOkWASoEAg2dAh9pXKihM78nnfL0P7qcT5IAgmm.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>How I Handle Privacy Settings Now</h2><p><br></p><p>Beyond what I post, I changed who could see it. I moved my main accounts to a more restricted audience rather than fully public, and I went through my friends and followers lists to remove accounts I no longer recognised or had any real connection to. It's an uncomfortable thing to do, culling a list you built up over years, but a follower list full of people you can't actually vouch for isn't really privacy at all.</p><p><br></p><p>I also locked down the account itself the same way I treat anything else that matters, with a strong unique password kept in <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">a password manager</a> rather than something reused from another site, and two-factor authentication turned on wherever the platform offers it. A social account is still a login like any other, and losing access to it can be just as disruptive as losing access to email or banking.</p><p><br></p><h2>What I Still Post, and Why That's Fine</h2><p><br></p><p>I want to be clear that this isn't an argument for disappearing from social media entirely. I still post plenty, and I still enjoy the connection it gives me with people I don't see often enough. What changed is the timing and the specifics, not the overall willingness to share. Holidays get posted once I'm home. Family milestones get shared without naming exact schools or routines. Photos get a quick check for background details before they go up, not an anxious audit, just a habit that takes a few seconds.</p><p><br></p><p>That's really the whole shift. I didn't need to become paranoid about social media to close the gap I'd been ignoring. I needed to notice that<a href="https://kellssecurity.com/blog/the-simple-checks-i-use-to-stop-ai-scams" data-mce-href="https://kellssecurity.com/blog/the-simple-checks-i-use-to-stop-ai-scams"> the same basic checks I use for suspicious messages </a>apply just as well to what I choose to post myself, since the goal in both directions is the same: don't hand a stranger more than they need. If you want the fuller version of what I've put in place, I've pulled it together in a<a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit"> free Safety Toolkit</a> and the <a href="https://www.ncsc.gov.uk/cyberaware/home" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/cyberaware/home">NCSC </a>has clear guidance on protecting your personal information online too.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

Why I Stopped Oversharing on Social Media

<h2>Why My Email Login Gets More Protection Than Any Other</h2><p>If I had to rank every account I own by how much damage its loss would cause, email wouldn't just be near the top. It would be first, by a distance. Not because my inbox is full of anything dramatic, but because almost every other account I have is tied back to it. Forget your banking password and the reset link goes to your email. Lose access to a shopping account, a social media profile, a subscription service, and the recovery path almost always runs through the same inbox. Email isn't just one account among many. It's the key that unlocks most of the others, which is exactly why I stopped treating it the same way I treat everything else.</p><p><br></p><h2>Why My Email Account Matters More Than People Think</h2><p><br></p><p>I used to think about account security account by account, as if each one existed in its own little box. A strong password here, a different one there, maybe a bit of extra care on the banking app. What I hadn't fully absorbed was that my email account sat underneath all of it, quietly holding the master key. If someone got into my email, they wouldn't need to guess my other passwords one at a time. They could just request a reset on each service in turn and let my inbox hand them the access directly.</p><p><br></p><p>That realisation changed how I prioritise my own security effort. It's not that every account deserves equal attention, because they genuinely don't carry equal risk. Email deserves more scrutiny than almost anything else I log into, precisely because it's the one account that can unravel all the others if it fails.</p><p><br></p><h2>What Actually Happens When Email Gets Compromised</h2><p><br></p><p>I've read enough accounts of email compromises to know the pattern tends to follow a similar shape. Someone gets into the inbox, often through a reused or guessed password, and the first thing they do isn't send obvious spam. They quietly search the inbox for anything useful, old password reset emails, account confirmations, financial statements, then start working through other services one by one, requesting resets and locking the real owner out as they go.</p><p><br></p><p>What makes this worse is how long it can take someone to even notice. If a scammer is careful, they'll set up a forwarding rule so copies of anything interesting get sent elsewhere without deleting the originals, meaning the account owner sees nothing unusual for weeks. By the time the pattern becomes obvious, several other accounts may already be compromised too. That chain reaction is the specific thing I've built my own habits around preventing.</p><figure id="figure-nlo3fhnytymtd50f96"><img id="nlo3fhnytymtd50f96" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Woman reading online safety advice on her laptop, Why My Email Login Gets More Protection Than Any Other" src="https://cdn.durable.co/covers/1b6yok9RJBZAfVJCU68TtCAefcOkWASoEAg2dAh9pXKihM78nnfL0P7qcT5IAgmm.jpg" alt="Woman reading online safety advice on her laptop, Why My Email Login Gets More Protection Than Any Other" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/1b6yok9RJBZAfVJCU68TtCAefcOkWASoEAg2dAh9pXKihM78nnfL0P7qcT5IAgmm.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><p><br></p><h2>The Specific Things I've Done to Lock Mine Down</h2><p><br></p><p>The first and most obvious step was making sure my email password is nothing like any other password I use, generated randomly rather than something I've adapted from a phrase I like, and stored in <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">a password manager</a> rather than somewhere I'd have to remember it. I've written before about <a href="https://kellssecurity.com/blog/why-i-finally-switched-to-a-password-manager" data-mce-href="https://kellssecurity.com/blog/why-i-finally-switched-to-a-password-manager">why I finally switched to a password manager</a>, and email was the account that made the decision feel non-negotiable rather than just sensible.</p><p><br></p><p>Two-factor authentication was the second piece, and I treat it as essential on email specifically even in cases where I've been lazier about turning it on elsewhere. An extra prompt or code on login means a stolen password alone isn't enough to get in, which closes off the most common way these compromises actually start. I also went through and removed any old, half-forgotten devices and apps that still had access to my account from years ago, since each one is a door I'd stopped watching.</p><p><br></p><h2>The Recovery Options I Had to Rethink</h2><p><br></p><p>The part I'd genuinely overlooked for years was my own account recovery settings. I had an old recovery phone number attached to my email that I hadn't used in ages, and a recovery email address that was, awkwardly, another account tied to the same provider. If one had ever been compromised, the other would have gone down with it. I updated both to something current and genuinely separate, a different provider entirely for the backup email, so a single point of failure couldn't take out my recovery options along with the main account.</p><p><br></p><p>I also checked what happens if I lose access to my phone specifically, since that's where most of my two-factor codes land. Having backup codes saved somewhere safe, not in the same inbox they're meant to protect, closes a gap that's easy to miss until the moment you actually need it and realise your safety net was inside the thing that just locked you out.</p><p><br></p><h2>What I'd Tell Someone Setting This Up for the First Time</h2><p><br></p><p>If someone asked me where to start, I wouldn't tell them to audit every account they own in one sitting, because that's exactly the kind of advice that gets nodded at and then never actioned. I'd tell them to start with email specifically, get a strong unique password on it through a password manager, turn on two-factor authentication, and check that the recovery options actually point somewhere current and separate. That's maybe twenty minutes of work, and it does more to protect everything else you own online than almost any other single change available to you.</p><p><br></p><p>Once that's done, the rest of your accounts become far less catastrophic to lose individually, because the one account that could cascade into all of them is finally locked down properly. I still keep an eye on <a href="https://kellssecurity.com/blog/the-simple-checks-i-use-to-stop-ai-scams" data-mce-href="https://kellssecurity.com/blog/the-simple-checks-i-use-to-stop-ai-scams">the checks I use to catch AI-driven scams</a> for the messages that try to get me to hand over access directly, but the account-level protection is what stops a single mistake from spreading everywhere else. If you want the fuller version of what I've put in place, I've pulled it together in a <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">free Safety Toolkit</a>, and the <a href="https://www.ncsc.gov.uk" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk">NCSC </a>has solid guidance on email account security too if you want the fuller technical detail.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

Why My Email Login Gets More Protection Than Any Other

<h2>What I Used to Tell People About Staying Safe Online, and What I Say Now</h2><p>For years I gave more or less the same advice to anyone who asked how to stay safe online. Use a strong password, look for the padlock icon in the browser bar, don't click links from people you don't know, keep your software updated. It was solid advice, it was easy to remember, and I genuinely believed it covered most of what mattered. I've since changed almost all of it, not because it was wrong exactly, but because the threats it was built to answer have mostly moved on.</p><p><br></p><p>I still get asked the same question constantly, usually some version of "what's the one thing I should actually do." I used to have a tidy answer. I don't anymore, and I think that's worth explaining rather than pretending I still have a neat list.</p><p><br></p><h2>What I Used to Tell People</h2><p><br></p><p>The old advice was built around spotting things. Spot the fake email by its bad spelling. Spot the fake website by the missing padlock. Spot the scam call by the pushy tone. It worked because for a long time, scams genuinely did look different from the real thing if you knew where to look. A phishing email in 2015 was often clumsy enough that a careful reader had a real chance of catching it on sight.</p><p><br></p><p>That advice made people feel capable. You didn't need to understand how any of it worked technically, you just needed to notice a few tells, and I could teach those tells in five minutes. It was good advice for the threats of its time, and I don't think it was wrong to give it then.</p><p><br></p><h2>Why That Advice Stopped Being Enough</h2><p><br></p><p>The tells mostly aren't there anymore. Scam messages are now written using the same AI tools everyone else uses, which means the spelling is fine, the tone is professional, and the branding is often lifted directly from the real company's own emails. A fake banking site can be an almost perfect copy of the real one, padlock icon included, because getting a padlock is just a matter of installing a free certificate, not a mark of legitimacy anymore.</p><p><br></p><p>Voice cloning has done something similar to phone scams. The tell used to be that the voice sounded slightly off, or the story didn't quite add up. Now a scammer can clone a few seconds of someone's voice from a video posted online and use it to fake a distressed phone call, which removes the one signal a lot of people were leaning on without realising it.</p><p><br></p><p>None of this means the old advice is actively harmful. Strong passwords still matter. Updated software still matters. But treating those as the finish line rather than the starting point leaves a gap that's much bigger than it used to be, and I was underselling that gap for longer than I'd like to admit.</p><p><br></p><h2>What Changed My Approach</h2><p><br></p><p>The shift for me happened gradually, through writing about specific incidents rather than through any single moment. I've covered<a href="https://kellssecurity.com/blog/the-voice-clone-call-that-almost-had-me-fooled" data-mce-href="https://kellssecurity.com/blog/the-voice-clone-call-that-almost-had-me-fooled"> a voice clone call that nearly caught me ou</a>t, and it's a strange thing to sit with the fact that a technique like that is no longer rare or expensive to pull off. I've also written about why bad grammar doesn't give scam messages away anymore, which is really the same underlying shift applied to text instead of speech.</p><figure id="figure-vgidswpjvimtd4h2xd"><img id="vgidswpjvimtd4h2xd" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Laptop on a desk being kept up to date, What I Used to Tell People About Staying Safe Online" src="https://cdn.durable.co/covers/1eIcH0PYPPse9y9EvviBdOBAWMXawnR1P7ap30fM6N8xpR3gsZOa6lpCYxOXYe7d.jpg" alt="Laptop on a desk being kept up to date, What I Used to Tell People About Staying Safe Online" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/1eIcH0PYPPse9y9EvviBdOBAWMXawnR1P7ap30fM6N8xpR3gsZOa6lpCYxOXYe7d.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><p><br></p><p>What connects all of it is that the old checklist assumed a scammer's effort was the limiting factor. Bad actors used to be constrained by time, language skill, or technical knowledge, and the tells were really just symptoms of those constraints. AI tools removed most of those constraints, so the tells disappeared along with them. That's the part I had to rebuild my thinking around, not just the specific list of do's and don'ts.</p><p><br></p><h2>What I Actually Tell People Now</h2><p><br></p><p>These days my advice is less about spotting fakes and more about verifying independently. If a message or call asks you to act, urgently or otherwise, the useful question isn't whether it looks convincing. It's whether you can confirm the claim through a channel you chose yourself, rather than one the message handed you. Open the banking app directly instead of clicking the link. Call the number on the back of your card instead of the one in the text. Ring the family member back on their usual number instead of trusting the voice on an unexpected call.</p><p><br></p><p>I also tell people to put a small number of things on autopilot rather than relying on vigilance for everything, because vigilance runs out by the end of a long day and scammers know that. A <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">password manager</a> removes the temptation to reuse passwords without you having to think about it each time.<a href="https://kellssecurity.com/blog/what-a-vpn-actually-protects-you-from" data-mce-href="https://kellssecurity.com/blog/what-a-vpn-actually-protects-you-from"> I run a VPN on every device I ow</a>n by default, not because I'm doing anything sensitive most of the time, but because it means I don't have to judge every network I connect to. Decisions you've already made ahead of time hold up better than judgement calls made in the moment a message arrives.</p><p><br></p><h2>The One Thing That Hasn't Changed</h2><p><br></p><p>If there's a piece of the old advice that's held up completely, it's this: nobody legitimate needs you to do something urgent right now through a channel they chose for you. That was true when the tell was bad spelling, and it's still true now that the spelling is perfect. Everything else I tell people has had to evolve as the threats got more convincing, but that one instinct, slow down and verify independently, has done more work for me than any specific checklist ever did.</p><p><br></p><p>I'd still rather someone walked away from this with one good instinct than a list of ten rules they'll half remember. If you want the fuller version of what I actually put in place day to day, I've pulled it together in a <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">free Safety Toolkit</a>. And if something does slip through, <a href="https://www.actionfraud.police.uk" target="_blank" rel="noopener" data-mce-href="https://www.actionfraud.police.uk">Action Fraud</a> is the right place to report it in the UK.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

What I Used to Tell People About Staying Safe Online

<h2>Why Bad Grammar Doesn't Give Scam Messages Away Anymore</h2><p>For years I had one rule of thumb that rarely let me down. If a message was full of clumsy grammar, strange phrasing, or a greeting like "Dear Valued Customer" from a company that supposedly had my name on file, I binned it without a second thought. Bad writing was practically a watermark for a scam. I passed that advice on to family members too, telling them the typos were the giveaway, the thing that would always save them if nothing else did.</p><p><br></p><p>I don't give that advice anymore, because it stopped being reliable somewhere in the last couple of years, and I think a lot of people are still relying on a rule that quietly stopped working.</p><p><br></p><h2>What Changed Once Scammers Started Using AI Properly</h2><p><br></p><p>The shift is simple enough once you say it out loud. Writing convincing English used to be the hard part of running a scam at scale, especially for operations working from scripts translated badly from another language. AI writing tools removed that bottleneck almost overnight. A scammer with no particular skill in English can now generate a message that reads as smoothly as anything a legitimate company would send, complete with correct grammar, natural phrasing, and a tone that matches whatever brand it's impersonating.</p><p><br></p><p>That means the entire category of scam that used to announce itself through broken English has largely vanished, or at least stopped being something you can count on spotting. The messages that get through now are fluent, professional, and often genuinely well written. Polish used to be evidence of legitimacy. It isn't anymore, and treating it that way is exactly how people get caught out.</p><p><br></p><h2>The Message That Actually Caught Me Out</h2><p><br></p><p>I got a text a while back that I genuinely hesitated over, which almost never happens to me anymore given how much of this I read about for work. It claimed to be from my bank, referenced a recent transaction in a way that felt specific rather than generic, and asked me to confirm my details through a link because of "unusual account activity." The English was flawless. There was no urgency-in-capital-letters, no missing punctuation, nothing that matched the old checklist I used to rely on.</p><figure id="figure-brfk2msfnmtd3h30f"><img id="brfk2msfnmtd3h30f" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Worried woman looking at a suspicious message on her phone, Why Bad Grammar Doesn't Give Scam Messages Away" src="https://cdn.durable.co/covers/bNpxqcqZZ9SB0cSWvBxgcLktufx9Ij9Qasg0VLu60b7XVOjKOCoR6PagqBlcmfzD.jpg" alt="Worried woman looking at a suspicious message on her phone, Why Bad Grammar Doesn't Give Scam Messages Away" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/bNpxqcqZZ9SB0cSWvBxgcLktufx9Ij9Qasg0VLu60b7XVOjKOCoR6PagqBlcmfzD.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><p><br></p><p>What actually stopped me wasn't the writing at all. It was that I hadn't made any transaction resembling the one it referenced, and that my bank has never once, in years of banking with them, asked me to confirm details through a text link. I closed the message, opened my banking app separately, and confirmed nothing was wrong. If I'd been judging it purely on how well it was written, I'd have had no reason to doubt it at all.</p><p><br></p><h2>What I Actually Look For Instead Now</h2><p><br></p><p>Since writing quality stopped being a useful signal, I've had to rebuild the checklist around things that are harder for a scammer to fake convincingly, AI or not. The biggest one is whether the message is asking me to act somewhere other than the official channel I already use, a link in a text rather than logging into the app directly, a phone number in the message rather than the one printed on my card. Genuine organisations very rarely need you to do anything urgent through a link they've just sent you.</p><p><br></p><p>I also pay attention to whether the specific detail in the message actually checks out, not just whether it sounds specific. A scam text can reference "your recent order" convincingly without referencing an order that exists. It costs nothing to open the relevant app or account directly and see whether anything matches, and that single step catches far more than reading the prose carefully ever did.</p><p><br></p><p>Urgency is still a useful signal, but I look for it in the structure of the request rather than the tone of the sentence. A message that wants a decision made immediately, with a specific narrow action like clicking one link or calling one number right now, is behaving the way a scam behaves regardless of how well it's phrased. I've written before about<a href="https://kellssecurity.com/blog/the-simple-checks-i-use-to-stop-ai-scams" data-mce-href="https://kellssecurity.com/blog/the-simple-checks-i-use-to-stop-ai-scams"> the checks I use to catch AI-driven scams</a> more broadly, and this fits into the same habit of judging the request rather than the writing.</p><p><br></p><h2>The Habit That Matters More Than Spotting Bad Writing</h2><p><br></p><p>If there's one adjustment I'd want everyone to make, it's this. Stop using writing quality as a filter at all, in either direction. A badly written message isn't automatically fake, and a beautifully written one isn't automatically real. The writing tells you almost nothing useful now. What tells you something is whether the request matches how the real organisation actually operates, and whether you can verify the claim independently rather than through the channel the message itself provided.</p><p><br></p><p>That's a slower habit than scanning for typos, and it asks a bit more of people than the old rule did. But the old rule is broken, and pretending it still works is worse than admitting it and building something sturdier in its place. I'd rather take the extra thirty seconds to check an account directly than trust a message just because it reads well, because reading well has stopped meaning anything at all.</p><p><br></p><p>If you want a fuller rundown of the other basics I'd put in place alongside this, I've pulled them together in a <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">free Safety Toolkit</a>. It's also worth knowing <a href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything" data-mce-href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything">what a real phishing email actually looks like line by line</a>, so you know what you're comparing a suspicious message against. And if you do get caught out,<a href="https://www.actionfraud.police.uk/" target="_blank" rel="noopener" data-mce-href="https://www.actionfraud.police.uk/"> Action Fraud</a> is the place to report it in the UK.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

Why Bad Grammar Doesn't Give Scam Messages Away

Kells Security Solutions

I teach people around the world how to spot online scams and stay safe on the internet, explained in plain English with no jargon. I cover phishing emails, two-factor authentication, password managers, VPNs and antivirus software, written for people who are not tech experts and want to protect themselves and their families.