Blog

<p>I've had this conversation more times than I can count, a friend, a neighbour, someone at a dinner party who finds out what I do for a living and asks the same question: where do I even start? I used to try to answer that properly, walking through passwords, two-factor authentication, backups, phishing, and VPNs, the lot. By the time I'd finished, most people had glazed over, and worse, they hadn't actually changed anything. So I stopped trying to cover everything, and now I keep it to what I can genuinely explain in about ten minutes, standing in a kitchen, without a single slide or link.</p><h2>Why I Stopped Trying to Cover Everything at Once</h2><p>The problem with a comprehensive answer is that it sounds like homework, and homework gets postponed indefinitely. If I list ten things someone should do, they leave with a vague sense of guilt and do none of them. If I give them two things, they can actually go home and do those two things that evening. I'd rather someone properly finish two changes than half-remember eight. So the first thing I do now, before I say anything technical, is pick the two most consequential things instead of trying to be thorough.</p><h2>The Two Things I Always Explain First</h2><p>The two things are a <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">password manager</a> and turning on two-factor authentication for email, in that order, because email is the account that can reset almost everything else if it's compromised. I don't get into the technical detail of how a password manager works or which one to choose in that first conversation, I just tell them it exists, that it takes about five minutes to install, and that it will fix the reused-password problem almost every person I've ever talked to has without realising how much risk it creates. Once that's installed, turning on two-factor for email is usually a two-minute job inside the account's own security settings, and I stay on the phone or in the room while they do it, because a task that gets left for later usually stays left.</p><h2>The One Habit That Matters More Than Any Setting</h2><p>If there's a third thing I make time for, it's not a setting at all, it's a habit: treating any message that creates pressure to act immediately as suspicious by default, regardless of who it claims to be from. I've written elsewhere about <a href="https://kellssecurity.com/blog/the-one-thing-nearly-every-scam-i-ve-seen-has-in-common" data-mce-href="https://kellssecurity.com/blog/the-one-thing-nearly-every-scam-i-ve-seen-has-in-common">why that particular pressure is the thread running under almost every scam format</a>, but in a ten-minute conversation I keep it simple: if something wants an answer right now, wait five minutes and check it a different way before doing anything. That one habit catches more than any piece of software does, and unlike a setting, it doesn't need updating or renewing.</p><h2>What I Deliberately Leave Out of That First Conversation</h2><p>I don't mention VPNs, antivirus software, router settings, or backup strategy in that first ten minutes, not because they don't matter, but because introducing five more things guarantees none of them get done either. Those are things I'll happily go into if someone's genuinely interested or comes back with a specific worry, but they're not where the risk actually concentrates for most people. A reused password and a slow reaction to a fake emergency cause far more real damage, in my experience, than a missing VPN ever does. Being selective isn't the same as being incomplete, it's recognising that ten minutes spent on the two highest-impact changes beats an hour spent on everything at once.</p><h2>Where I Send Someone Once They Want to Go Further</h2><p>For the people who do want more once the basics are in place, I point them toward <a href="https://kellssecurity.com/blog/the-order-i-d-tackle-your-online-security-in-if-you-re-starting-from-scratch" data-mce-href="https://kellssecurity.com/blog/the-order-i-d-tackle-your-online-security-in-if-you-re-starting-from-scratch">a proper priority order to work through themselves</a>, rather than trying to cram it into the same conversation. The <a href="https://www.ncsc.gov.uk/cyberaware/home" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/cyberaware/home">NCSC </a>also has solid general guidance if someone wants a source that isn't just my opinion. And I always mention my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">free Safety Toolkit</a> at the end, mostly because it means the conversation doesn't have to end when I leave the room, they've got something to come back to if a question occurs to them later that evening.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

Online Safety Basics I Can Explain in Ten Minutes

<p>People ask me where to start more than almost anything else, and the honest answer is that most advice out there is either too vague to act on or too long to actually finish. So here's the order I'd genuinely work through myself if I was starting from nothing, based on what stops the most damage for the least effort, not what makes the longest checklist.</p><h2>Start With a Password Manager, Before Anything Else</h2><p>If you only do one thing this week, make it this. Password reuse is still the single biggest reason accounts get taken over, because one leaked password from an old, forgotten site gets tried against everything else you own. A <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">password manager</a> fixes that in one sitting. It generates a unique, complicated password for every account and remembers it for you, so you never have to. I moved everything into one years ago and it's still the change that's done the most for my own security, by a wide margin.</p><h2>Turn On Two-Factor Authentication Next, Even If It Feels Like a Hassle</h2><p>Once your passwords are unique, two-factor authentication is what stops a leaked or guessed password from being enough on its own. I used to find the extra step annoying, and I'll admit I put it off longer than I should have. I've written before about the <a href="https://kellssecurity.com/blog/why-i-treat-two-factor-authentication-as-non-negotiable" data-mce-href="https://kellssecurity.com/blog/why-i-treat-two-factor-authentication-as-non-negotiable">excuses I used to make about this myself</a> and looking back, none of them held up once I actually tried it for a week. Start with email and banking, since those two accounts can be used to reset almost everything else if someone gets into them.</p><h2>Update Everything and Then Leave Auto-Updates On</h2><p>Most of the exploits that actually get used against ordinary people target known, already-patched vulnerabilities that people just haven't updated yet. It's not usually some clever new attack, it's an old door someone forgot to lock. Go through your phone, laptop, and router once, update everything that's behind, then turn on automatic updates so you're not relying on remembering to do this again. This is part of the <a href="https://kellssecurity.com/blog/the-security-checklist-i-run-through-every-time-i-set-up-a-new-device" data-mce-href="https://kellssecurity.com/blog/the-security-checklist-i-run-through-every-time-i-set-up-a-new-device">same routine I run through every time I set up a new device</a>, and it takes far less time than people expect.</p><h2>Back Up What You'd Actually Miss</h2><p>Backups don't stop an attack, but they take away most of the reason to panic if one succeeds. If ransomware locks your files or your phone ends up at the bottom of a river, a recent backup means you've lost time, not everything. This doesn't need to be complicated. Turning on the automatic cloud backup that's already built into your phone or laptop covers most people's needs without any extra decisions to make.</p><figure id="figure-8t8dxiz203mtkh1mrv"><img id="8t8dxiz203mtkh1mrv" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: undefined undefined;" title="Man smiling as he uses his phone safely, The Order I'd Fix Your Online Security In" src="https://cdn.durable.co/covers/22JGHvhqAR5zn3MLuxQlQkBE0erI5OO5GkH1wdZLu1DaA6xHoKImht9cHhDDTgyq.jpg" alt="Man smiling as he uses his phone safely, The Order I'd Fix Your Online Security In" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/22JGHvhqAR5zn3MLuxQlQkBE0erI5OO5GkH1wdZLu1DaA6xHoKImht9cHhDDTgyq.jpg" data-mce-style="aspect-ratio: 16/9; object-position: undefined undefined;"></figure><h2>Learn to Pause Before You Click, Not Just What to Click</h2><p>Every list of scam warning signs eventually goes out of date, because scammers update their scripts faster than anyone can update the lists. What doesn't go out of date is a habit of pausing before you act on anything urgent, whether that's a text, an email, or a phone call. If something is pushing you to act immediately, that urgency is usually the tell, not the request itself. The <a href="https://www.ncsc.gov.uk/cyberaware/home" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/cyberaware/home">NCSC </a>has some good general guidance on this if you want to read more, and it's held up well against everything I've seen change since.</p><h2>Everything After This Is Optimisation, Not Essentials</h2><p>Once those five things are in place, you've covered the overwhelming majority of how people actually get compromised. Everything past this point, from VPNs to antivirus software to more advanced privacy settings, is worth doing eventually, but it's optimisation on top of a foundation rather than the foundation itself. If you want a simple place to keep track of all of this as you work through it, my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">free Safety Toolkit</a> walks through the same order I've laid out here.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The Order I'd Fix Your Online Security In

<p>Every time I bring a new phone, laptop, or tablet into my life, I go through the same sequence before I let myself actually use it for anything, and I don't let convenience or excitement about a new device shortcut it. None of these steps take long individually, but skipping even one is exactly how devices end up compromised in their first few weeks, back when everything on them still looks new, nothing's backed up yet, and nobody's paying close attention. This is the order I actually follow, every single time.</p><h2>The First Thing I Do Is Update Everything Before I Touch a Single App</h2><p><br></p><p>A brand new device can still be running software that's weeks or months out of date by the time it reaches me, since it was likely sitting in a warehouse, a delivery van, or a shop shelf before I bought it. I go straight to the settings menu and run every update available, operating system, firmware, and any pre-installed apps I'm actually going to keep, before I sign into a single account or download anything new. I do this even when the device claims to already be up to date, since I've had more than one new phone quietly have a second update waiting once the first one finished installing. Known vulnerabilities in outdated software are one of the easiest ways in, and there's no reason to carry that risk forward from day one just because I was excited to start using the thing.</p><p><br></p><figure id="figure-dm6c0vx33bmtkbr70u"><img id="dm6c0vx33bmtkbr70u" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Man smiling as he uses his phone safely, The Security Checklist I Run on Every New Device" src="https://cdn.durable.co/covers/22JGHvhqAR5zn3MLuxQlQkBE0erI5OO5GkH1wdZLu1DaA6xHoKImht9cHhDDTgyq.jpg" alt="Man smiling as he uses his phone safely, The Security Checklist I Run on Every New Device" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/22JGHvhqAR5zn3MLuxQlQkBE0erI5OO5GkH1wdZLu1DaA6xHoKImht9cHhDDTgyq.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>Every New Device Gets Its Own Unique Password From Day One</h2><p><br></p><p>I don't carry old passwords over to a new device, and I don't reuse a password I've already got sitting on something else either, no matter how strong that old password is. Every account I sign into on that device, starting with the device's own lock screen or user account, gets a fresh password generated by my <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">password manager </a>rather than something I type from memory. It sounds like more effort than reusing something I already know, but the manager fills it in for me anyway once it's set up, so the actual day-to-day friction is close to zero. What I get back in exchange is that a breach on one account, or one device, never quietly becomes a breach on everything else I own.</p><p><br></p><h2>Two-Factor Authentication Goes On Before the Device Ever Leaves My Hands</h2><p><br></p><p>Setting up two-factor authentication is one of the last things a lot of people get around to, if they get around to it at all, but I do it before the device is even fully set up for anything else. Every account that supports an authenticator app over a text message code gets the authenticator app instead, and I add the new device itself to whatever account recovery method I'm already using so I don't end up locked out of my own accounts later. It's a five-minute job while I'm already sitting in the settings menu, and it's a far worse job to try and do retroactively once something's already gone wrong.</p><p><br></p><h2>I Turn On Full-Disk Encryption Even Though It's Rarely the Default</h2><p><br></p><p>Most phones ship with encryption switched on by default now, but laptops and some tablets often still don't, and even when it's available it's usually a single toggle buried a few menus deep rather than something turned on automatically for me. I check it on every new device regardless of what I'd expect the default to be, because I've been wrong about that assumption before. If the device is ever lost or stolen, encryption is the entire difference between someone getting a locked box they genuinely can't do anything useful with, and someone getting a device they can plug straight into a computer and pull every file, photo, and saved login off in a few minutes.</p><p><br></p><h2>Find My Device Gets Switched On Before I Ever Need It</h2><p><br></p><p>I can't set this up after the device is already missing, so I do it the same day it arrives instead, while I still have it in my hands to test with. Every device I own gets added to whatever remote find, lock, and wipe service its platform offers, and I actually confirm the location and remote wipe functions work rather than assuming they do. It's not something I think about again once it's done, right up until the one time a phone goes missing on a train or gets left in a taxi, and it's the only thing standing between me and someone else having full access to everything on it.</p><p><br></p><h2>I Go Through Every App's Permissions Before I Trust It With Anything</h2><p><br></p><p>The last step is going through whatever apps came pre-installed on the device and removing the ones I'm never going to use, since bloatware sitting there untouched is still software that can carry its own vulnerabilities even if I never open it. For everything I do keep, and everything I install afterward, I check what permissions it's actually asking for against what it plausibly needs to do its job. A flashlight app asking for access to my contacts list or my precise location gets uninstalled on the spot, no matter how convenient or well-reviewed it looked in the app store. The one app I do install deliberately, before almost anything else gets the chance to land on the device first, is the <a href="https://www.bitdefender.com/en-us/consumer/?irclickid=WxSzmdWRXxyZWsOzKNx6sWZFUkrxGHQpm0ekVY0&amp;im_rewards=&amp;irgwc=1&amp;afsrc=1&amp;MPid=6273270&amp;cid=aff|c|IR|Cyber%20Jay" target="_blank" rel="noopener" data-mce-href="https://www.bitdefender.com/en-us/consumer/?irclickid=WxSzmdWRXxyZWsOzKNx6sWZFUkrxGHQpm0ekVY0&amp;im_rewards=&amp;irgwc=1&amp;afsrc=1&amp;MPid=6273270&amp;cid=aff|c|IR|Cyber%20Jay">antivirus app I trust on my own devices</a> so it's already watching by the time anything risky has a shot at getting through.</p><p><br></p><p>None of these steps are complicated on their own, they just have to happen in the right order and before the device has any of my real information sitting on it, not after. Most of it takes less time overall than setting up the wallpaper and home screen the way I actually like them. Once a device has been running for a while, this setup checklist stops applying and becomes <a href="https://kellssecurity.com/blog/the-safety-check-in-i-run-on-my-own-accounts-every-few-months" data-mce-href="https://kellssecurity.com/blog/the-safety-check-in-i-run-on-my-own-accounts-every-few-months">the same account check-in I already run every few months</a> instead, checking what's still logged in, what's changed, and what needs fixing. My <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">free Safety Toolkit </a>covers the account-level basics that sit underneath all of this, and <a href="https://www.ncsc.gov.uk/cyberaware/home" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/cyberaware/home">NCSC </a>has more detailed guidance if you want to go further than my own checklist covers.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The Security Checklist I Run on Every New Device

<p>The volume of online shopping I do jumps sharply for a few weeks every year, and so does the number of scams built specifically to catch people out during exactly that window. None of the individual tricks are new, they just get dressed up in seasonal packaging and timed to land when I'm distracted, buying gifts for people I care about, and moving faster than I normally would. Here's what actually changes about how I shop online once the season kicks in.</p><h2>Delivery Text Scams Multiply the Moment Parcels Start Piling Up</h2><p>For a few weeks a year my phone gets more "missed delivery" texts than at any other point, and that's exactly why scammers time their fake versions for right now. Genuine parcel volume is so high during this window that a fake redelivery text blends straight into the noise instead of standing out the way it would in a quiet month. The message usually asks for a small "redelivery fee" or claims a customs charge is owed, with a shortened link that leads to a page built to grab card details rather than actually reschedule anything. My rule hasn't changed even though the volume has: I never tap the link in the text. If a parcel genuinely needs action, I go straight to the courier's own app or the tracking page I already have bookmarked, typed in manually rather than followed from a message.</p><h2>I Check My Statement Line by Line the January After, Not Just at the Time</h2><p>With the sheer number of transactions across a few weeks, a single fraudulent charge or a subscription that quietly enrolled itself during checkout is far easier to miss inside a long statement than it would be in a normal month. I don't rely on catching something wrong in the moment. Once everything's landed, I go through the full statement line by line, matching each one back to a receipt or confirmation email I've kept, and I query anything I can't immediately account for with the card provider directly rather than assuming it's fine. It's a slower habit than glancing at a balance, but it's caught things a quick glance never would.</p><figure id="figure-rtdsh921fimtkacn7c"><img id="rtdsh921fimtkacn7c" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Traveller holding a passport while using a laptop, How I Shop Online Safely During the Holidays" src="https://cdn.durable.co/covers/26pWI1BYq2abIgKilwLFST9rggowYSKy2U8ly48kMSerNAvkt3zHBYtItKQKI0b2.jpg" alt="Traveller holding a passport while using a laptop, How I Shop Online Safely During the Holidays" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/26pWI1BYq2abIgKilwLFST9rggowYSKy2U8ly48kMSerNAvkt3zHBYtItKQKI0b2.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>Gift Cards Are a Payment Method I Never Use For Buying Anything From a Stranger</h2><p>Gift cards get requested specifically because they're close to untraceable once the code's been handed over, which is exactly why they show up constantly in delivery-fee scams, fake family emergencies, and bogus prize claims around this time of year. No courier, no retailer, no government department, and no genuine family member in an emergency is ever going to ask to be paid in gift card codes. The moment that request appears, whatever story surrounds it, I treat it as the clearest signal available that I'm being scammed, because it's a request that has no legitimate use case at all.</p><h2>A Shop That Only Existed Since November Gets Extra Scrutiny From Me</h2><p>Pop-up storefronts that appear purely for the holiday season are a known pattern, take payment for goods that either never arrive or arrive as cheap counterfeits, and vanish before complaints catch up with them. A quick domain lookup showing a site was registered a few weeks ago is one of the fastest ways I've found to catch this before I've handed over any card details. I pair that with a plain search for the shop's name plus "reviews" or "scam" before trusting a new site with a purchase, especially one I found through an ad rather than a search I ran myself.</p><h2>Charity Appeals Get a Slower, More Deliberate Response This Time of Year</h2><p>Giving season brings out genuine charity appeals and fake ones in roughly equal measure, and the fake versions lean hard on urgency, an unsolicited message or email asking for an immediate donation before some deadline that conveniently can't wait. I never donate through a link in a message I didn't go looking for. If I want to support a charity, I go to its site directly by typing the address myself, and if I don't already know the organisation I check its registration through the Charity Commission first.</p><p>None of this is about being suspicious of everything for a few weeks and then relaxing again. It's the same checks I run all year, just applied a little more deliberately when the volume of parcels, deals, and requests for money is high enough that something fake has a genuinely good chance of blending in. Being twenty seconds slower before I click a link, pay with a gift card, or trust a new shop heads off nearly all of it, whether it's the <a href="https://kellssecurity.com/blog/the-checkout-red-flags-i-check-before-i-enter-my-card-details" data-mce-href="https://kellssecurity.com/blog/the-checkout-red-flags-i-check-before-i-enter-my-card-details">practical checkout habits I rely on for every online purchase</a> or <a href="https://kellssecurity.com/blog/the-online-shopping-routine-i-follow-from-search-to-delivery" data-mce-href="https://kellssecurity.com/blog/the-online-shopping-routine-i-follow-from-search-to-delivery">the wider routine I follow from search to delivery</a>. If you want the fuller version of how I vet a shop and pay safely, <a href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" target="_blank" rel="noopener" data-mce-href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902">NordVPN </a>is also worth having switched on if any of this shopping happens over a hotel or family member's wifi while I'm travelling for the holidays, since a shared network isn't somewhere I want to be typing card details unprotected. My <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">free Safety Toolkit</a> covers the account-level basics that sit underneath all of this, and <a href="https://www.actionfraud.police.uk/" target="_blank" rel="noopener" data-mce-href="https://www.actionfraud.police.uk/">Action Fraud </a>is where I'd report it if any of these ever actually caught me out.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

How I Shop Online Safely During the Holidays

<p>Most phishing advice is about catching the message once it's already sitting in front of you: check the sender, look for spelling mistakes, hover over the link before clicking. That's useful, but it puts the whole job on me noticing something wrong in the two seconds before I tap anything. I don't trust myself to be that sharp every single time, especially on a rushed morning with three tabs open and a coffee going cold. What actually protects me is a stack of defences running quietly in the background whether or not I'm paying close attention that day, so one bad decision in one moment doesn't automatically turn into a real problem. I've pulled every check together in one guide on <a href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything" data-mce-href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything">how to identify a phishing email</a>, if you want the full version.</p><h2>My Email Provider's Spam Filter Does More of the Job Than People Realise</h2><p>Long before a phishing email has any real chance of reaching me, most of them are already gone. My email provider's spam filter quietly strips out the bulk stuff, the obvious mass-sent scams, before they ever land in my inbox at all. I used to think of that filter as background noise I could safely ignore, right up until I actually looked at what was sitting in the spam folder on an ordinary week. It's not just careless clutter, it's a genuine first line of defence that's already doing more filtering than I could ever manage by eye alone. I still check that folder every so often, not because I expect to find something legitimate stuck in there, but because marking things correctly, phishing as phishing rather than just deleting it and moving on, is part of what keeps the filter sharp over time.</p><p><br></p><h2>A Password Manager Won't Autofill on a Fake Site, and That's Caught Me More Than Once</h2><p>The single most useful anti-phishing tool I use isn't marketed as one at all. My <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">password manager </a>checks the exact domain before it offers to fill anything in, and if the site I've landed on isn't the real one, character for character, it simply stays quiet. No login box gets filled, no password gets handed over automatically. That's flagged fake banking pages and lookalike login screens for me more than once, in moments where the page itself looked convincing enough that I might well have typed my details in manually without a second thought. It's a strange thing to lean on a password manager as your fraud detector, but that's genuinely become one of its main jobs for me. If you're still typing logins from memory on every site, that's one entire layer of protection you're going without.</p><p><br></p><h2>Two-Factor Authentication Is the Backstop for the Day My Judgement Slips</h2><p>Even with every other defence in place, I assume there will eventually be a day my judgement slips and I hand over a password to a page I shouldn't have trusted. That's what two-factor authentication is actually for, as far as I'm concerned. It isn't there to stop the phishing attempt itself, it's there to stop a stolen password from actually being enough to get in. An app-based code or a physical security key means a phished password on its own is close to useless to whoever's holding it. I've written before about <a href="https://www.kellssecurity.com/blog/the-different-kinds-of-two-factor-authentication" data-mce-href="https://www.kellssecurity.com/blog/the-different-kinds-of-two-factor-authentication">the different kinds of two-factor authentication and which one I actually trust,</a> because not every version offers the same level of protection, but having some form of it turned on everywhere is what keeps a single bad click from spiralling into an actual account takeover.</p><p><br></p><h2>My Browser Warns Me Before a Known Phishing Page Even Loads</h2><p>Modern browsers keep running lists of known phishing and malware sites, and mine checks every page I try to load against that list before it renders anything at all. It's not a perfect system, brand-new fake sites won't be flagged yet because nobody's reported them, but it catches a genuine share of recycled and reused phishing pages before I even get the chance to look at them properly myself. I keep that protection switched on rather than treating it as something that just slows the browser down, because the handful of times it's actually stopped me landing on something dangerous have been worth every extra half-second of load time.</p><figure id="figure-tlqhtp2awjmtkcxym4"><img id="tlqhtp2awjmtkcxym4" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: undefined undefined;" title="Phone showing a fake text message beside a laptop, The Layers of Protection Against Phishing Emails" src="https://cdn.durable.co/covers/8inEPs1ne1Ks8XrRvFgnfPrJTIoYpVFysQ3peVkoGOzFYNE3VZMLp5SH7If8XZ3g.jpg" alt="Phone showing a fake text message beside a laptop, The Layers of Protection Against Phishing Emails" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/8inEPs1ne1Ks8XrRvFgnfPrJTIoYpVFysQ3peVkoGOzFYNE3VZMLp5SH7If8XZ3g.jpg" data-mce-style="aspect-ratio: 16/9; object-position: undefined undefined;"></figure><p><br></p><h2>I Use a Different Email Address for Anything That Doesn't Need My Real One</h2><p>The less my main email address is floating around in random databases, the fewer opportunities there are for it to end up on a phishing list in the first place. I keep a separate address for one-off signups, competitions, and anything I'm not fully confident about, so if that address does eventually get caught up in a data breach or sold on somewhere, it isn't connected to my banking, my main accounts, or anything that actually matters to me. It's a small habit on its own, but it genuinely cuts down how often my real inbox becomes a target at all.</p><p><br></p><h2>Why I Treat Suspicious Texts and Phone Calls the Same Way I Treat Email</h2><p>Phishing doesn't stay in your inbox anymore, and treating email as the only channel worth being careful about leaves an obvious gap. A text claiming to be a delivery company asking me to pay a small customs fee, a call from someone claiming to be my bank's fraud team, a voicemail about a parcel I'm not expecting, all get exactly the same treatment as a suspicious email: I don't click the link, I don't call the number provided, and I don't confirm any personal details on the spot. If a caller claims to be my bank, I hang up and ring the number on the back of my card myself, since a genuine fraud team will never be offended by that and a scammer posing as one always is.</p><h2>Reporting Is Part of the System, Not Just Cleanup After the Fact</h2><p>Every phishing email I do spot gets reported, not just deleted and forgotten about. <a href="https://www.kellssecurity.com/blog/the-phishing-report-habit-i-never-skip" data-mce-href="https://www.kellssecurity.com/blog/the-phishing-report-habit-i-never-skip">I've got a specific habit I never skip once I've identified one,</a> because reporting isn't just tidying up after the fact, it feeds back into the systems that protect everyone else too, including the spam filter I mentioned right at the start. The National Cyber Security Centre runs a reporting service for exactly this, and forwarding a phishing attempt on takes less time than it took to actually spot it in the first place.</p><p><br></p><p>None of these layers are enough on their own. The spam filter misses things, the password manager can't help on a site I've never set up a login for, and two-factor authentication doesn't stop me handing over other information a scammer might ask for directly. What actually works is having all of them running at once, so a single mistake in any one moment gets caught somewhere else in the chain instead of becoming the whole story. My <a href="https://www.kellssecurity.com/toolkit" data-mce-href="https://www.kellssecurity.com/toolkit">free Safety Toolkit </a>covers how to set most of this up from scratch, and <a href="https://www.ncsc.gov.uk/cyberaware/home" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/cyberaware/home">NCSC </a>has further guidance if you want to go deeper into any one layer of it.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The Layers of Protection Against Phishing Emails

<p>I've rewritten this website's blog nearly top to bottom by now, working back through phishing emails, voice clone calls, AI-generated messages, and every scam format in between. Somewhere around post sixty I started noticing the same thread running under nearly all of them, and it isn't the platform, the technology, or even how convincing the fake looks. It's the deadline. Almost every scam that's ever come close to catching me out was, underneath everything else, an attempt to get me to decide something before I'd had time to think about it properly.</p><h2>The Pressure Is the Point, Not the Story</h2><p>The specific story changes constantly. One week it's a bank's fraud team calling about a payment that needs confirming right now. Another week it's a courier saying a parcel is stuck until a small customs fee gets paid within the hour, or a message claiming to be from a family member who's in trouble and needs money sent immediately, no questions. The details are built to match whatever's plausible for the moment, and whoever's writing them clearly puts real effort into that part. But if I strip away the story and just look at the shape of what's being asked, it's always the same request: act now, don't check, don't wait, don't tell anyone. That shape is far more reliable to spot than any individual detail, because the story is disposable and gets rewritten constantly, but the pressure never changes.</p><h2>Why My Brain Falls for It Even When I Know Better</h2><p>I run a website about exactly this and I've still felt that jolt of adrenaline when a message says my account will be locked in ten minutes. Knowing the trick exists doesn't fully protect me from it, because urgency doesn't target what I know, it targets how I think in the moment. A rushed decision uses a completely different part of the brain to a considered one, the fast, instinctive kind of thinking that's brilliant for stepping out of the way of traffic and terrible for evaluating whether a text message is real. Scammers aren't guessing at this, they're relying on it, which is why almost every scam script includes some version of a countdown. It's not a coincidence that shows up everywhere from fake fraud alerts to fake job offers to fake romance. It's the one part of the con that has to be there for the rest of it to work.</p><h2>The Three-Second Pause That Breaks the Spell</h2><p>The single habit that's done the most for me isn't a piece of software or a checklist, it's a pause. The moment I notice a message or call is pushing me toward an immediate decision, I stop and do nothing for a few seconds before I do anything else. Not because three seconds changes the facts, but because it's usually enough to let the instinctive reaction pass and the slower, more sceptical part of my thinking catch up. In that pause I ask myself one question: who benefits if I act on this in the next five minutes instead of the next hour? If the honest answer is whoever sent this message, that's the entire scam, right there, and I haven't had to spot a fake logo or a misspelled word to catch it.</p><h2>The Legitimate Version of Act Now Actually Looks Different</h2><p>Real organisations do sometimes need a quick response, so I don't treat urgency alone as automatic proof of a scam. What I've noticed is that genuine urgency and manufactured urgency behave differently once I push back on them. A real bank fraud team will still be reachable if I hang up and call the number printed on my card rather than the number they gave me. A real delivery company won't threaten to destroy or return my parcel because I wanted five extra minutes to check. A real employer won't withdraw a job offer because I asked to verify it through the company's official careers page first. The <a href="https://www.ncsc.gov.uk/cyberaware/home" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/cyberaware/home">NCSC </a>has more general guidance on verifying contact from banks and other organisations if you want a second opinion on a specific case. Legitimate urgency survives a pause, manufactured urgency depends on you never taking one, which is why the request to skip verification is usually a bigger red flag than the urgency itself.</p><h2>What I Do the Moment Something Feels Rushed</h2><p>These days my response is close to automatic. I stop engaging with whatever channel the pressure arrived through, whether that's a call, a text, or an email, and I find the organisation's contact details independently rather than using anything supplied in the message. If it's account-related, I check by logging in directly through the official site or app rather than any link I've been sent. If money or personal details are involved and I still feel unsure, I contact the organisation through a number I already had before the message showed up. And I use a <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">password manager</a> for every account I hold, so a spoofed login page tied to a fake urgent message can't get anywhere even if I do click through by mistake, because the manager simply won't fill in credentials on the wrong domain. None of this takes long once it's a habit, and it's a far better use of five minutes than dealing with <a href="https://kellssecurity.com/blog/what-actually-happens-when-you-report-a-scam" data-mce-href="https://kellssecurity.com/blog/what-actually-happens-when-you-report-a-scam">what actually happens if I report it </a>after the fact and discover money's already gone.</p><p>If any of this sounds familiar because you've read some of <a href="https://kellssecurity.com/blog/the-newer-scam-formats-i-keep-having-to-warn-people-about" data-mce-href="https://kellssecurity.com/blog/the-newer-scam-formats-i-keep-having-to-warn-people-about">the newer formats these pressure tactics show up in</a>, that's not an accident, it's the same mechanic wearing a different outfit each time. My <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">free Safety Toolkit </a>walks through this pause-and-verify habit alongside the other checks I run before trusting anything unexpected online.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The One Thing Nearly Every Scam I've Seen Has in Common

Kells Security Solutions

I teach people around the world how to spot online scams and stay safe on the internet, explained in plain English with no jargon. I cover phishing emails, two-factor authentication, password managers, VPNs and antivirus software, written for people who are not tech experts and want to protect themselves and their families.