Blog

<p>A friend of mine transferred money to what she thought was her landlord's account last year, and the first thing she did was panic and stare at her phone for twenty minutes before telling anyone. By the time she called her bank, the money had already moved on. I think about that timeline a lot, because most advice about scams focuses entirely on spotting them before they happen. Nobody talks much about what to actually do in the first ten minutes after you realise something's wrong, and that gap in advice is exactly where people lose the most time they can't get back.</p><h2>Why the First Ten Minutes Matter More Than the Rest</h2><p><br></p><p>Fraud response works on a clock that most people don't know is running. Banks can sometimes recall a transfer if it's caught early enough, before the receiving account has been emptied out, but that window closes fast, often within hours rather than days. The natural instinct is to sit with the shock for a while, replaying the message or call and trying to work out exactly how you got caught out. That instinct is understandable, but it's also the most expensive thing you can do. I've trained myself to treat the moment of realisation as the start of a checklist, not the start of a post-mortem. The reflecting can happen later, once the practical steps are actually moving. What follows is the order I actually work through, not because it's the only order that works, but because having a fixed sequence means I don't waste time deciding what to do next while I'm still rattled.</p><p><br></p><h2>Calling My Bank Before I Do Anything Else</h2><p><br></p><p>If money has moved or a card's been used, my bank comes before anything else, including before I've fully worked out what happened. Every UK bank has a dedicated fraud line that's faster than the general customer service number, and I keep that number saved in my phone rather than searching for it under pressure. Calling early does two things: it can sometimes stop or reverse a transfer that hasn't fully settled yet, and it flags the account for closer monitoring immediately, which matters if the scammer got more than just the one payment. I'd rather make this call and find out it wasn't necessary than lose the twenty minutes my friend lost weighing it up. Most fraud teams will also ask you to freeze the card there and then, which takes seconds through the banking app and stops any further use while the rest of the conversation is still happening.</p><p><br></p><h2>Changing Passwords Starting With Email, Not the Compromised Account</h2><p><br></p><p>Once the money side is moving, I go straight to passwords, and I always start with email rather than whatever account the scam actually targeted. Email is the reset point for almost everything else I own, so if a scammer has any foothold there, changing my banking password alone won't keep them out for long. I use <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass </a>to generate a new, unique password on the spot rather than a variation of the old one, since scammers who've seen one password often try close variations first. Only once email is secured do I move on to the account that was actually compromised.</p><p><br></p><h2>Checking What Else That Password Was Protecting</h2><p><br></p><p>This is the step I used to skip, and it's the one that's bitten people I know the hardest. If a password was reused anywhere, and most people reuse at least a few, that same combination is now a key to every other account it unlocks, not just the one that got scammed. I go through my password manager's list and change anything sharing that password, even accounts that feel low-stakes, because a scammer with patience will work through them one by one looking for something valuable. It's tedious, but it takes twenty minutes once and closes a door that would otherwise stay open indefinitely.</p><p><br></p><h2>Freezing My Credit Before I Even Know If I Need To</h2><p><br></p><p>I don't wait to find out whether personal details were actually taken before I consider a credit freeze, because by the time I know for certain, it's often too late to matter. A credit freeze stops new accounts being opened in your name without unlocking it first, and in the UK you can apply one through each of the three main credit reference agencies without it costing anything. It sounds like an overreaction for a scam that might have only cost a password, but identity-based fraud frequently shows up weeks or months after the original incident, once the initial panic has faded and nobody's watching as closely. Lifting the freeze later, when I actually need a new credit account myself, takes a couple of minutes online, so the ongoing inconvenience is nowhere near as large as it sounds up front.</p><p><br></p><h2>Reporting It Somewhere, Even If I Feel Embarrassed</h2><p><br></p><p>The embarrassment is real, and I think it's the single biggest reason people delay reporting or skip it entirely. I report anyway, because the report does something beyond satisfying a box-ticking instinct: it feeds into the pattern that lets <a href="https://www.actionfraud.police.uk/" target="_blank" rel="noopener" data-mce-href="https://www.actionfraud.police.uk/">Action Fraud</a> and banks flag repeat scammers faster for the next person. I've written before about <a href="https://kellssecurity.com/blog/what-actually-happens-when-you-report-a-scam" data-mce-href="https://kellssecurity.com/blog/what-actually-happens-when-you-report-a-scam">what actually happens once you report an incident like that</a>, and it's more useful than most people expect. Reporting isn't an admission that you were careless, it's the action that turns a bad afternoon into data that protects someone else's afternoon too. Between this checklist and <a href="https://kellssecurity.com/blog/the-safety-check-in-i-run-on-my-own-accounts-every-few-months" data-mce-href="https://kellssecurity.com/blog/the-safety-check-in-i-run-on-my-own-accounts-every-few-months">the periodic check-in I run on my own accounts every few months</a>, I've found the two together do more than any amount of after-the-fact regret ever could, and my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">free Safety Toolkit</a> has a version of both you can start from today.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The First Things I Do the Moment I Suspect a Scam

<p>Most phishing advice pictures the same scene: an email with a slightly-off sender address and a link to a fake login page. That's still one of the ways it shows up, but it's far from the only one anymore, and treating email as the whole picture leaves the other formats free to catch me off guard. I've had close calls in a text message, over the phone, and once through a QR code stuck to a parking meter, none of which looked anything like a typical phishing email. Recognising which formats phishing actually turns up in matters just as much as recognising the warning signs inside any one of them. If you want the whole routine in one place, I've written up <a href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything" data-mce-href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything">how to spot a phishing email</a> before you click anything.</p><h2>Text Messages That Pretend to Be a Courier or My Bank</h2><p>A text message strips away most of the things I'd normally check. There's no sender domain to inspect, no logo to compare, just a short line claiming a parcel couldn't be delivered or that my account's been flagged, with a link sitting right there ready to tap. The ones that get me thinking twice are timed well, arriving the same week I'm actually expecting a delivery, which is no accident. My rule now is simple: I never tap a link in a text claiming to be my bank or a courier, I go to the app or the official site directly instead, typed in myself rather than followed.</p><p><br></p><h2>Phone Calls Built Around Urgency Before I Can Think It Through</h2><p>A phone call adds a pressure an email or text can't easily create, a real voice on the line, sometimes recreated by AI now, telling me something needs sorting immediately. The pattern is always the same: a problem that supposedly can't wait, and a request to act, confirm, or pay before I've had a chance to check anything independently. I've started treating any unexpected call like this the same way regardless of how convincing it sounds, I say I'll call back on a number I already have for that organisation, and hang up. A genuine caller has no problem with that; a scammer usually does.</p><p><br></p><h2>QR Codes That Skip Past Every Warning My Browser Would Give Me</h2><p>A QR code is just a link wearing a disguise, but it skips the one thing that usually gives a bad link away, the visible web address. I scan it, my phone opens whatever's encoded in it, and I'm relying entirely on trusting where the code itself came from rather than anything I can read beforehand. The one that caught my attention was stuck over a genuine parking payment sticker, printed to look identical, redirecting to a fake payment page instead. Now I check whether a QR code looks stuck on rather than printed as part of the original sign before I ever scan it, and I look at the URL it opens before entering anything.</p><figure id="figure-mgsw4a3r7cmtkegnoj"><img id="mgsw4a3r7cmtkegnoj" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Worried woman looking at a suspicious message on her phone, The Different Formats Phishing Actually Comes In Now" src="https://cdn.durable.co/covers/bNpxqcqZZ9SB0cSWvBxgcLktufx9Ij9Qasg0VLu60b7XVOjKOCoR6PagqBlcmfzD.jpg" alt="Worried woman looking at a suspicious message on her phone, The Different Formats Phishing Actually Comes In Now" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/bNpxqcqZZ9SB0cSWvBxgcLktufx9Ij9Qasg0VLu60b7XVOjKOCoR6PagqBlcmfzD.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><p><br></p><h2>Adverts and Search Results Leading to a Convincing Fake Login Page</h2><p>Search engines and social platforms both sell ad space, and that space isn't always policed as tightly as it should be. A paid advert or a sponsored search result can lead to a page built to look identical to a real bank, retailer, or software login screen, complete with the right logo and colour scheme, sitting just above the genuine result. My password manager has actually caught more of these than I have by eye, because it checks the exact domain before offering to fill anything in, and stays quiet on a page that isn't the real one no matter how convincing it looks. I treat that as one more reason not to skip using one.</p><p><br></p><h2>Messages From Accounts Impersonating People I Actually Know</h2><p>This one doesn't come from a stranger at all, at least not obviously. A cloned or hacked social media account belonging to someone I actually follow starts messaging with an urgent ask, a loan, a link to click, a codeword to confirm. The profile picture and name match exactly what I'd expect, because it's either a genuinely hacked account or a near-perfect copy of one. I've learned to verify anything unusual through a completely separate channel, a text or a call, rather than replying inside the same conversation where the impersonation is happening.</p><p><br></p><h2>Why the Format Matters as Much as the Message Itself</h2><p>Every one of these formats is doing the same underlying job, creating urgency and removing the normal checks I'd otherwise have time for. But each one closes off a different one of those checks: a text removes the sender domain, a call removes the time to think, a QR code removes the visible link, an advert removes the usual search-result trust signals, and an impersonated account removes the stranger-danger instinct entirely. I've written before about <a href="https://www.kellssecurity.com/blog/the-layers-of-protection-i-rely-on-before-a-phishing-email-ever-reaches-me" data-mce-href="https://www.kellssecurity.com/blog/the-layers-of-protection-i-rely-on-before-a-phishing-email-ever-reaches-me">the layers of protection I rely on for email phishing specifically</a>, and most of that same thinking carries across formats, but the specific check that catches each one is different, which is why I now think about the format first and the message second.</p><p><br></p><p>None of these are exotic. They're all just phishing wearing a different outfit, and the fact that <a href="https://www.kellssecurity.com/blog/the-difference-between-phishing-and-every-other-scam-i-deal-with" data-mce-href="https://www.kellssecurity.com/blog/the-difference-between-phishing-and-every-other-scam-i-deal-with">phishing itself sits apart from most other online scams </a>is worth remembering, because the same underlying defences, checking independently, never trusting urgency, using a <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">password manager</a> that checks the domain for me, work across every format even when the disguise changes. My <a href="https://www.kellssecurity.com/toolkit" data-mce-href="https://www.kellssecurity.com/toolkit">free Safety Toolkit </a>covers how to set most of that up, and <a href="https://www.ncsc.gov.uk/cyberaware/home" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/cyberaware/home">NCSC </a>has further guidance if you want to go deeper into spotting any one of these formats specifically.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The Different Formats Phishing Actually Comes In Now

<p>I get asked a lot whether I've ever nearly fallen for a phishing attempt myself, as if running a business about online safety makes me immune to it. I haven't fallen for one, not fully, but I've come closer than I'd like to admit a few times, and each of those near-misses taught me something a checklist alone never would have. Here are three of the closest calls, stripped of anything that could identify who else was involved, along with what actually saved me in the moment. My full guide on <a href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything" data-mce-href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything">how to recognise a phishing email</a> walks through every check I make, in the order I make them.</p><h2>The Delivery Fee Text That Nearly Had My Card Details</h2><p>The first one arrived as a text message, not an email, which is worth mentioning because I'd spent years mentally filing phishing under an email problem. It said a parcel was being held pending a small customs charge, with a link to pay it. I was expecting a delivery that week, the amount was small enough to not trigger much suspicion, and the page it linked to looked convincing, right down to a version of the courier's logo. I had my card out before I stopped to ask myself why a courier would need payment by text rather than on delivery, which is how every legitimate parcel charge I've ever encountered has actually worked. That one detail, the payment method itself, is what made me close the tab.</p><h2>The Your Account Will Be Locked Email That Looked Exactly Right</h2><p>The second was an email claiming my email account itself would be suspended within twenty four hours unless I verified my details, formatted almost identically to genuine account emails I'd received before, right down to the footer. What saved me wasn't spotting a spelling mistake or a wrong logo, because there weren't any, it was that I typed the provider's actual website address into my browser directly instead of clicking through, and logged in to check my account status there. There was no warning waiting for me, which told me everything the email itself couldn't. I've since learned that <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">a password manager</a> would have caught this automatically too, since it simply won't fill in a saved login on a domain that doesn't match, and a fake page always fails that test even when it fools your eyes.</p><h2>The Fake Colleague Message That Tested My Guard at Work</h2><p>The third one was different again, an email that appeared to come from someone I'd worked with, asking me to review an attached invoice urgently before month end. It used the right name, a plausible reason, and arrived at a time when that kind of request wasn't unusual. What made me pause was a small inconsistency in how the message was phrased, something the real person wouldn't have written that way, more than any obvious red flag. I called instead of replying, and confirmed they'd never sent it. Business email compromise like this is one of <a href="https://kellssecurity.com/blog/the-different-formats-phishing-actually-comes-in-now" data-mce-href="https://kellssecurity.com/blog/the-different-formats-phishing-actually-comes-in-now">the newer formats these tactics show up in</a>, and it's often harder to spot than the obvious too-good-to-be-true kind because it uses a real, trusted name.</p><h2>What Each of These Had in Common, Once I Looked Back</h2><p>Looking at all three together afterwards, none of them were caught because I recognised a scam template. Each one asked me to act somewhere I could verify independently, whether that was a courier's actual payment process, a login page I could reach myself, or a phone call I could make. The pressure to move quickly was present in all three, which lines up with <a href="https://kellssecurity.com/blog/the-one-thing-nearly-every-scam-i-ve-seen-has-in-common" data-mce-href="https://kellssecurity.com/blog/the-one-thing-nearly-every-scam-i-ve-seen-has-in-common">the thread running under nearly every scam I've come across</a>, but urgency alone wasn't what saved me. What saved me was refusing to complete the action inside the channel the message arrived through.</p><h2>The One Check I Now Run Before I Trust Any Message</h2><p>These days, before I act on anything that asks for money, login details, or an urgent decision, I move to a channel I chose myself rather than one supplied in the message, whether that's typing an address in directly, calling a known number, or checking an app I already have installed. It sounds like a small habit, but it would have caught all three of the examples above on its own, without needing to spot a single technical red flag. The <a href="https://www.ncsc.gov.uk/cyberaware/home" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/cyberaware/home">NCSC </a>has further guidance on verifying contact from organisations if you want a second opinion on a specific message you've received. I also keep a password manager running in the background for exactly the login page scenario above, since it does the domain checking automatically, faster than I ever could by eye. Phishing keeps evolving, and my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">free Safety Toolkit</a> walks through the verify-independently habit alongside the rest of what I actually rely on.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The Phishing Attempts That Almost Worked On Me

<h2>The Password Rules I Used to Follow That Weren't Actually Helping</h2><p>For years I followed a set of password rules that felt like common sense, the kind of advice that gets repeated so often nobody stops to check if it's actually true anymore. Some of it came from IT departments, some from old security training, some from just picking up what everyone else seemed to be doing. Most of it wasn't wrong exactly, it was just outdated, or it solved a problem that stopped mattering years ago while ignoring the one that actually put me at risk. Here's what I used to believe, and what changed once I actually looked into why.</p><p><br></p><h2>Adding a Symbol Doesn't Make a Weak Password Strong</h2><p><br></p><p>I used to think swapping a letter for a number or bolting an exclamation mark onto the end of a password was what made it secure, because that's what most sign-up forms seemed to reward. In practice, a short password with a symbol tacked on is barely harder to crack than the same password without it, since the tools used to guess passwords already account for the obvious substitutions everyone makes. Length is what actually slows an attacker down, not the character set. A long passphrase built from a few unrelated words takes dramatically longer to crack than an eight-character jumble of symbols, even though the jumble looks more complicated to a human eye. I've written separately about <a href="https://kellssecurity.com/blog/the-method-i-actually-use-to-build-a-password-worth-trusting" data-mce-href="https://kellssecurity.com/blog/the-method-i-actually-use-to-build-a-password-worth-trusting">the actual method I use to build a password worth trusting</a>, and length-over-complexity is the first thing that changed once I understood how the maths actually works.</p><p><br></p><figure id="figure-b921dbmweqmtk8tji8"><img id="b921dbmweqmtk8tji8" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Woman reading online safety advice on her laptop, Password Rules I Used to Follow That Didn't Help" src="https://cdn.durable.co/covers/1b6yok9RJBZAfVJCU68TtCAefcOkWASoEAg2dAh9pXKihM78nnfL0P7qcT5IAgmm.jpg" alt="Woman reading online safety advice on her laptop, Password Rules I Used to Follow That Didn't Help" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/1b6yok9RJBZAfVJCU68TtCAefcOkWASoEAg2dAh9pXKihM78nnfL0P7qcT5IAgmm.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>Changing My Password Every Few Months Was Making Things Worse, Not Better</h2><p><br></p><p>For a long time I assumed that rotating my passwords regularly was just good hygiene, something a careful person did without being asked. It turns out forced periodic changes tend to push people toward weaker patterns, not stronger ones, because remembering a new arbitrary string every ninety days is hard, so people start incrementing a number at the end or cycling through a small set of variations that are trivial to guess once one version leaks. A password only actually needs changing when there's a real reason to believe it's been exposed, not on a fixed calendar. Security guidance has moved away from mandatory rotation for exactly this reason, and I stopped forcing it on myself once I understood the pattern it was encouraging.</p><p><br></p><h2>A Text Message Code Isn't the Same Protection as an Authenticator App</h2><p><br></p><p>I used to treat any form of two-factor authentication as equally secure, on the logic that a second step is a second step regardless of how it arrives. A code sent by text message can be intercepted through SIM-swapping, where someone convinces your mobile provider to move your number onto a SIM card they control, and from that point every text-based code goes straight to them instead of you. An authenticator app generates the code locally on your device instead of sending it over the mobile network, which closes off that specific attack entirely. I've written separately about <a href="https://kellssecurity.com/blog/the-different-kinds-of-two-factor-authentication" data-mce-href="https://kellssecurity.com/blog/the-different-kinds-of-two-factor-authentication">the different kinds of two-factor authentication and which one I actually trust</a>, and SMS codes are still better than no second step at all, they're just the weakest version of one available.</p><p><br></p><h2>Reusing a Strong Password Across a Few "Safe" Sites Still Isn't Safe</h2><p><br></p><p>I used to make an exception for a handful of sites I considered low-stakes, reusing one strong password across a forum, a newsletter sign-up, a one-off shopping account, on the logic that nothing sensitive lived there anyway. The problem is that a password is only ever as safe as the weakest place it's used, and a low-stakes site is often exactly the kind of place that gets breached without much fanfare, since it has less reason to invest in serious security than your bank does. Once that password leaks, it's the first thing tried against every other account you own, sensitive or not. A password manager like <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass </a>removes the temptation entirely by generating and storing a genuinely unique password for every single account, so there's never a "safe enough to reuse" exception to make in the first place.</p><p><br></p><h2>My Fingerprint or Face Unlocking My Phone Isn't Actually a Password</h2><p><br></p><p>I used to think of biometric unlock as a stronger version of a password, since it's tied to something only I physically have. It's more accurate to think of it as a convenience layer sitting on top of a password, not a replacement for one. A fingerprint or face scan can occasionally be fooled by a good enough replica, and in some jurisdictions you can be legally compelled to unlock a device with your face or thumb in a way you can't be compelled to hand over a memorised password, since a password is treated as something you know rather than something you are. I still use biometric unlock for everyday convenience, but I make sure the underlying passcode behind it is one I'd actually trust on its own, not an afterthought I never think about because I stopped typing it in.</p><p><br></p><p>None of these rules were things I made up carelessly, they were the advice that was floating around when I first started paying attention to this, and most of it made sense at the time or came from somewhere reasonable. The gap between what felt secure and what actually was secure only became obvious once I looked into why each rule existed in the first place. The <a href="https://www.ncsc.gov.uk/cyberaware/home" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/cyberaware/home">NCSC </a>publishes its own guidance on password best practice if you want to check your own habits against it, and my free <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">Safety Toolkit </a>covers the account-level basics that sit alongside everything here. Getting the actual reasoning right changed more about how I handle logins than any single new tool ever did.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

Password Rules I Used to Follow That Didn't Help

<p>People ask me a lot which security trend I think matters most right now, and my honest answer changes depending on the week. I read about new attack techniques and new protections pretty much every day, and most of it turns out to be noise dressed up as urgency. But a handful of things keep showing up in my own accounts, in messages from clients, and in conversations with other people who work in this space, and those are the ones I'm actually paying attention to. This isn't a forecast or a list of buzzwords, it's what I'm genuinely watching right now and why.</p><h2>Passkeys Are Finally Showing Up Everywhere I Log In</h2><p>For years passkeys felt like something I'd read about but never actually use. That's changed a lot over the past year. I'm now being offered a passkey option on my email account, my banking app, and a couple of the shopping sites I use regularly. What I like about them is that there's no password to steal in the first place, so the usual phishing tricks that rely on tricking me into typing a password into a fake page simply don't work the same way. I've started setting them up wherever they're offered, partly because they're genuinely more convenient once you're used to them, and partly because I want to be comfortable with the technology before it becomes the default rather than the option.</p><h2>MFA Fatigue and the Push Notifications I've Learned to Question</h2><p>I used to think multi-factor authentication was close to bulletproof. Then I started reading about push bombing, sometimes called MFA fatigue, where someone who already has your password sends approval requests to your phone over and over until you get annoyed or confused enough to tap approve. It's a simple trick and it works often enough that I've changed how I treat every single approval notification. If I get a push request I wasn't expecting, even just one, I don't approve it automatically anymore. I check what device and location it's coming from first, and if anything looks off I change my password straight away rather than assuming it was a fluke. The <a href="https://www.ncsc.gov.uk/cyberaware/home" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/cyberaware/home">NCSC </a>has written about this pattern too, and it's worth reading if you've never seen it explained before.</p><h2>The AI Voice Cloning That's Made Me Rethink Phone Calls Completely</h2><p>This is the one that unsettles me most. I've written before about the <a href="https://kellssecurity.com/blog/the-voice-clone-call-that-almost-had-me-fooled" data-mce-href="https://kellssecurity.com/blog/the-voice-clone-call-that-almost-had-me-fooled">voice clone call that almost had me fooled</a>, and since then I've tested a few of the free voice cloning tools out of curiosity. It genuinely doesn't take much source audio to produce something convincing over a phone line. My response to this hasn't been to panic, it's been to lean harder on the <a href="https://kellssecurity.com/blog/the-verification-habits-i-rely-on-whenever-i-suspect-an-ai-scam" data-mce-href="https://kellssecurity.com/blog/the-verification-habits-i-rely-on-whenever-i-suspect-an-ai-scam">verification habits I already rely on</a> whenever something feels slightly off. If someone calls asking for money or urgent help, I hang up and call them back on a number I already have saved, every single time, no exceptions.</p><figure id="figure-shzuwz0ctumtkfs2pl"><img id="shzuwz0ctumtkfs2pl" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Woman reading online safety advice on her laptop, The Online Security Trends I'm Actually Keeping an Eye On" src="https://cdn.durable.co/covers/1b6yok9RJBZAfVJCU68TtCAefcOkWASoEAg2dAh9pXKihM78nnfL0P7qcT5IAgmm.jpg" alt="Woman reading online safety advice on her laptop, The Online Security Trends I'm Actually Keeping an Eye On" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/1b6yok9RJBZAfVJCU68TtCAefcOkWASoEAg2dAh9pXKihM78nnfL0P7qcT5IAgmm.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>My Browser Catching More Fake Login Pages Than It Used To</h2><p>On a more positive note, I've noticed the built in phishing and malicious site warnings in my browser catching things earlier than they used to. I get the occasional warning page now that stops me before I land on a lookalike login screen, and when I've checked the URLs afterward they've usually been close copies of real banking or delivery company pages. I still don't rely on this as my only line of defence, because these filters are reactive by nature and new fake sites slip through before they're flagged. But it's a noticeable improvement, and it's part of why I keep my browser and operating system updated automatically rather than putting it off.</p><h2>Credential Stuffing Attacks Happening at a Scale I Didn't Expect</h2><p>Credential stuffing isn't new, but the scale of it caught me off guard when I looked into it properly. Attackers take huge lists of email and password combinations leaked from old breaches and simply try them against other websites automatically, hoping people reused the same password somewhere else. I checked my own old email addresses against a breach lookup and found combinations from accounts I'd forgotten even existed. That's what finally pushed me to move everything into a <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">password manager </a>with unique, randomly generated passwords for every account, rather than relying on memory or a handful of variations I could actually remember.</p><h2>Why I Still Think the Basics Matter More Than Any Trend</h2><p>With all of that said, I try not to lose sight of the fact that most of what protects me day to day isn't cutting edge at all. It's unique passwords, multi-factor authentication set up properly, software that updates itself, and a habit of pausing before I click on anything urgent sounding. The trends I've mentioned here are worth knowing about because they show where attackers and defenders are both heading next, but they build on top of fundamentals rather than replacing them. If I had to recommend one thing to someone who hasn't touched their security setup in years, it still wouldn't be passkeys or AI detection tools, it would be a password manager and a few minutes spent turning on multi-factor authentication on the accounts that matter most. If you want a simple starting point, my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">free Safety Toolkit </a>walks through exactly that.</p><p><br></p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The Online Security Trends I'm Actually Keeping an Eye On

<p>People assume online shopping safety comes down to spotting a dodgy website, and while that matters, I've come round to thinking the single most useful protection has almost nothing to do with the site itself. It's how you actually pay for the thing you're buying. Get that one decision right and a scam turns from a disaster into an afternoon's inconvenience.</p><h2>The Legal Protection a Credit Card Gives You That a Debit Card Doesn't</h2><p>In the UK, Section 75 of the Consumer Credit Act makes your credit card provider jointly liable with the seller for anything you buy costing between £100 and £30,000. If the item never turns up, the company goes bust before it ships, or the goods are seriously not as described, you can claim the money back from the card provider directly rather than chasing the retailer yourself. I found this out properly a few years ago when a furniture company I'd ordered from went into administration between taking my payment and delivering anything, and the claim back through my credit card provider was straightforward. Debit cards only have the chargeback scheme, which is a voluntary arrangement between banks rather than a legal right, and it's noticeably weaker and slower in practice. That difference alone is why any card details I hand over for an online purchase now belong to a credit card, even for things I'm fairly confident about.</p><h2>Checking the Shop Itself Comes Before Any of This</h2><p>None of that payment protection matters much if I'm about to hand my details to a shop that was never going to deliver anything in the first place. I've written before about<a href="https://kellssecurity.com/blog/how-i-decide-whether-to-trust-a-new-online-shop" data-mce-href="https://kellssecurity.com/blog/how-i-decide-whether-to-trust-a-new-online-shop"> how I decide whether to trust a new online shop</a> before I get anywhere near checkout, and that step still comes first every single time, no matter how good the payment method behind it is. Payment method is damage control for when something goes wrong. Vetting the seller properly is what stops most of that damage happening at all, and it takes less time than people expect once it's a habit.</p><h2>The Checkout Habits I Rely On No Matter Which Card I'm Using</h2><p>Once I've decided a shop is worth buying from, I still go through the same checkout habits regardless of which card is doing the paying. I've covered <a href="https://kellssecurity.com/blog/the-checkout-red-flags-i-check-before-i-enter-my-card-details" data-mce-href="https://kellssecurity.com/blog/the-checkout-red-flags-i-check-before-i-enter-my-card-details">the checkout red flags I watch for </a>in more detail elsewhere, but the short version here is that I never let a site save my card details after a single purchase, and I always screenshot the order confirmation page before closing the tab. Neither habit depends on which card I used, but both make a dispute far easier to raise if I ever actually need to.</p><figure id="figure-l9uaak4kzemtkiblbc"><img id="l9uaak4kzemtkiblbc" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: undefined undefined;" title="Man smiling as he uses his phone safely, Why I Stopped Paying for Anything Online With My Debit Card" src="https://cdn.durable.co/covers/22JGHvhqAR5zn3MLuxQlQkBE0erI5OO5GkH1wdZLu1DaA6xHoKImht9cHhDDTgyq.jpg" alt="Man smiling as he uses his phone safely, Why I Stopped Paying for Anything Online With My Debit Card" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/22JGHvhqAR5zn3MLuxQlQkBE0erI5OO5GkH1wdZLu1DaA6xHoKImht9cHhDDTgyq.jpg" data-mce-style="aspect-ratio: 16/9; object-position: undefined undefined;"></figure><h2>Every Shop Gets Its Own Password, Never a Reused One</h2><p>Payment method aside, most online shops also want an account, and that means another password sitting somewhere with my card details and address attached to it. I use<a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356"> a password manager</a> to generate a completely unique password for every shop I buy from, including the ones I'm only ever going to use once for a single order. If one of those accounts ever gets breached, and smaller retailers get breached more often than people tend to realise, the damage stays contained to that one account instead of spreading to everything else I own through a reused password.</p><h2>The One Payment Request That Makes Me Walk Away Immediately</h2><p>There's one situation where none of this nuance matters and I just stop entirely: any seller asking for payment by bank transfer or gift card instead of a card. I've seen this most often on marketplace listings, where a seller asks to move the conversation off-platform and pay directly, which strips away every buyer protection in one move. Legitimate shops simply don't need to ask for this. The <a href="https://www.ncsc.gov.uk/cyberaware/home" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/cyberaware/home">NCSC </a>has solid general guidance on spotting this kind of pressure before you've handed anything over, and it's worth reading once so you recognise it instantly the next time it comes up. If you want a simple place to keep all of this straight as you shop, my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">free Safety Toolkit </a>walks through the same checks in the order I've laid them out here.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

Why I Stopped Paying for Anything Online With My Debit Card

Kells Security Solutions

I teach people around the world how to spot online scams and stay safe on the internet, explained in plain English with no jargon. I cover phishing emails, two-factor authentication, password managers, VPNs and antivirus software, written for people who are not tech experts and want to protect themselves and their families.