Blog

<h2>Why I Give Every Company a Different Email Address</h2><p>I used to have one email address for everything: my bank, a clothing website I bought from once, a newsletter I signed up for out of curiosity, my actual personal correspondence, all sitting behind the same address for over a decade. That single address became the one thing every company, every marketer, and eventually every scammer trying to reach me all had in common. This isn't a general list of email security tips. It's the specific habit that's actually changed how much junk and risk reaches my inbox, and it started with something far simpler than switching providers or overhauling my whole setup.</p><h2>The Trick Is Just Adding a Tag to My Own Address</h2><p>Most email providers support what's called plus-addressing without anyone ever pointing it out, and I only discovered it by accident. Any address like mine can add a tag after a plus sign before the @ symbol, so <a href="mailto:jay@example.com" data-mce-href="mailto:jay@example.com">jay@example.com</a> can become <a href="mailto:jay+retailername@example.com" data-mce-href="mailto:jay+retailername@example.com">jay+retailername@example.com</a>, and it still lands in exactly the same inbox as if I'd typed my normal address. I don't need a different account for each company. I need one extra habit at the point I type my email into a sign-up form, and mail still arrives at the one place I actually check.</p><h2>How This Actually Caught the Company That Leaked My Address</h2><p>The reason I stuck with this habit is that it did exactly what I hoped it would within the first year. I started getting spam addressed to jay+onlinestore, one specific tag I'd only ever given to one retailer, which meant I knew precisely which company had either sold my details on or been breached without ever telling me. A shared address gives you no way to trace that back. A tagged one hands you the answer the moment junk mail starts arriving with that exact tag attached, and I stopped giving that retailer any more of my information the same day. It's also the account I've written about separately for <a href="https://kellssecurity.com/blog/why-my-email-login-gets-more-protection-than-any-other" data-mce-href="https://kellssecurity.com/blog/why-my-email-login-gets-more-protection-than-any-other">why it gets more protection than any other login I own</a>, since none of this tracing matters if the inbox itself isn't secure to begin with.</p><h2>Why I Don't Reuse the Same Address for Sign-Ups I Don't Trust Yet</h2><p>Now, any site I'm not fully confident in, a one-off purchase, a forum I'm trying out, a free tool that wants an email before I've even seen what it does, gets its own tag rather than my plain address. I keep track of which tag belongs to which site inside my <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">password manager</a>, the same one I use for everything else, since it already has a note field sitting right next to the login itself. If a specific tag starts getting spam or turns up in a breach notification, I know exactly where it came from and I can block that tag entirely without touching the inbox everything else relies on.</p><h2>Checking a Tagged Address Against the Same Habit I Use for Everything Else</h2><p>Tracing a leak after the fact is useful, but I'd rather catch it earlier where I can. I run <a href="https://kellssecurity.com/blog/the-safety-check-in-i-run-on-my-own-accounts-every-few-months" data-mce-href="https://kellssecurity.com/blog/the-safety-check-in-i-run-on-my-own-accounts-every-few-months">the same account check-in I've written about separately </a>across every tagged address I've created, not just my main one, since a breach tracker doesn't care whether the address it's checking has a plus sign in it or not. It takes a few extra minutes to paste in a handful of tags instead of one address, and it's caught exposure on a tagged account before the spam itself ever showed up.</p><h2>The Attachments and Links I Still Won't Open, Aliased Address or Not</h2><p>None of this replaces basic caution about what actually lands in that inbox once mail arrives. I still don't open an attachment I wasn't expecting, even one that looks like it's from a company I recognise, since a spoofed sender name costs a scammer nothing to fake. I hover over any link before clicking to see where it actually leads rather than trusting the text it displays, and I check the sender's actual domain rather than just the display name, since "Amazon" as a name means nothing if the address behind it clearly isn't. Aliasing tells me where a message should have come from. It's still up to me to check whether it actually did.</p><figure id="figure-li2yl6qzzdmtk5d9d3"><img id="li2yl6qzzdmtk5d9d3" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Woman reading online safety advice on her laptop, Why I Give Every Company a Different Email Address" src="https://cdn.durable.co/covers/1b6yok9RJBZAfVJCU68TtCAefcOkWASoEAg2dAh9pXKihM78nnfL0P7qcT5IAgmm.jpg" alt="Woman reading online safety advice on her laptop, Why I Give Every Company a Different Email Address" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/1b6yok9RJBZAfVJCU68TtCAefcOkWASoEAg2dAh9pXKihM78nnfL0P7qcT5IAgmm.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>Unsubscribing Isn't Always Safe, So I Block Instead</h2><p>The other habit that changed once I started paying attention is what I do with unwanted mail itself. Clicking "unsubscribe" on a genuine newsletter is fine, but doing the same on a message I'm not sure is legitimate can confirm to whoever sent it that my address is real and actively read, which is worth more to a spammer than the one email it stops. I block and report messages I don't recognise rather than unsubscribing from them, and I only use the unsubscribe link on senders I actually remember signing up with in the first place.</p><p>None of this took a weekend or a new piece of software, just one small habit added at the point I hand my email address over to anyone new. My free <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">Safety Toolkit </a>covers the account-level basics that sit alongside this, and the NCSC has its own <a href="https://www.ncsc.gov.uk/cyberaware/home" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/cyberaware/home">guidance on staying safe from phishing</a> if you want to check your wider email habits against it. Giving every company its own version of my address turned my inbox from something I reacted to into something I could actually trace.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

Why I Give Every Company a Different Email Address

<h2>The Home Network Setup I Actually Use to Protect My Family</h2><p>I used to think of my home Wi-Fi as one single thing everyone in the house shared, the same way we all shared the electricity or the water pressure. Once it was switched on, it just worked the same for everyone. That thinking held up fine until I actually looked at how many different devices, people, and trust levels were sitting on that one network at any given moment: my own work laptop, my partner's phone, the kids' tablets, my in-laws' phones whenever they visit, and a growing scatter of smart devices that don't need to talk to any of it. This isn't a general checklist for keeping a family safe online. It's the specific setup I've actually built at home, piece by piece, once I stopped assuming one flat network was good enough for everyone using it.</p><p><br></p><h2>Why I Stopped Treating My Home Wi-Fi as a Single Trusted Network</h2><p><br></p><p>The moment that actually changed my thinking was realising what a single flat network really means in practice: if one device on it gets compromised, whether that's a kid's tablet with a dodgy app or a visitor's phone that's already infected with something, it can potentially see and reach every other device sitting on the same network, including the laptop I do my banking on. I'd been treating "everyone's on the Wi-Fi" as a convenience question rather than a security one. Once I started thinking about the network itself as something with different trust levels inside it, the rest of the changes below followed naturally.</p><p><br></p><h2>The Guest Network I Now Run for Every Kid's Device and Visitor</h2><p><br></p><p>Almost every router sold in the last several years supports a separate guest network, and I'd genuinely never turned mine on until I looked into it properly. I now run two networks from the same router: my main one, reserved for my own work laptop and the devices I actually trust completely, and a guest network that every kid's tablet, every visitor's phone, and every smart gadget in the house connects to instead. Devices on the guest network can reach the internet but can't see or reach anything on my main network, which means a compromised tablet is a contained problem rather than a household-wide one. Setting it up took about ten minutes through my router's own admin panel, and I've never had to touch it since.</p><p><br></p><h2>Changing My Router's Admin Password Was the Fix I Kept Putting Off</h2><p><br></p><p>The Wi-Fi password gets all the attention, but the login that actually controls the router itself, the one that lets anyone reconfigure the network, view connected devices, or open up access from outside, is arguably more important, and mine had been sitting on the factory default for years. A lot of routers ship with a default admin password that's either printed on a label anyone in the house can read or is a known default for that model published online. I changed mine to a proper unique passphrase the same evening I found this out, and it took less time than I'd spent putting off doing it.</p><p><br></p><h2>How I Actually Use Parental Controls Without Turning Into the Enemy</h2><p><br></p><p>I use my router's built-in parental control app to set content filtering and screen-time limits for the <a href="https://kellssecurity.com/blog/how-i-actually-handle-online-safety-across-three-generations-of-my-family" data-mce-href="https://kellssecurity.com/blog/how-i-actually-handle-online-safety-across-three-generations-of-my-family">kids' devices on the guest network</a>, but I've been deliberate about what that tool is actually for. It sets boundaries around what sites and app categories are reachable and for how long, and it stops there. I don't use it to read messages or monitor conversations, and I've told the kids exactly that, because a tool that quietly does more than the boundary it's meant to enforce tends to get worked around the moment it's discovered, and it damages the trust that actually matters more long-term than any filter setting.</p><p><br></p><h2>Why My Family Now Shares One Password Manager Vault, Not Passwords</h2><p><br></p><p>For years our shared logins, streaming accounts, the family calendar app, a couple of subscription services, lived on a sticky note in a kitchen drawer that everyone half-remembered the current version of. We've since moved every one of those shared logins into a single shared vault inside a proper <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">password manager</a>, which means everyone still gets access to what they actually need without the password itself ever being written down or texted around. Building a password worth trusting for that master vault was its own project, and I used <a href="https://kellssecurity.com/blog/the-method-i-actually-use-to-build-a-password-worth-trusting" data-mce-href="https://kellssecurity.com/blog/the-method-i-actually-use-to-build-a-password-worth-trusting">the same method I've written about separately </a>to get there. It's the one login every one of us actually has to remember, so it's worth getting right.</p><p><br></p><h2>The One Household Rule That Covers Everything Else</h2><p><br></p><p>All of the setup above matters, but the single rule that catches more than any router setting is this: if a message on any device in the house, any network, any account, asks for money or login details urgently, it gets checked with me directly before anyone acts on it. It doesn't matter whether it lands on the main network or the guest network, a kid's tablet or my own laptop. Scammers don't care which part of the household infrastructure they've reached, so the one rule that has to hold everywhere is a human one, not a technical one.</p><figure id="figure-qjfczspfutmtk3u0ml"><img id="qjfczspfutmtk3u0ml" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Woman reading online safety advice on her laptop, The Home Network Setup I Actually Use to Protect My Family" src="https://cdn.durable.co/covers/1b6yok9RJBZAfVJCU68TtCAefcOkWASoEAg2dAh9pXKihM78nnfL0P7qcT5IAgmm.jpg" alt="Woman reading online safety advice on her laptop, The Home Network Setup I Actually Use to Protect My Family" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/1b6yok9RJBZAfVJCU68TtCAefcOkWASoEAg2dAh9pXKihM78nnfL0P7qcT5IAgmm.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><p><br></p><p>None of this came from a single incident, more from slowly noticing how much of my home network I'd left running on factory defaults and shared assumptions. The NCSC publishes its own <a href="https://www.ncsc.gov.uk/cyberaware/home" data-mce-href="https://www.ncsc.gov.uk/cyberaware/home">guidance on securing a home network</a> if you want a second source to check your own router settings against, and my free <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">Safety Toolkit </a>covers the account-level basics that sit alongside everything here. Getting the network itself right made every other safety habit in the house easier to actually stick to.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The Home Network Setup I Actually Use to Protect My Family

<h2>What I've Actually Changed About How I Protect Myself Online This Year</h2><p><br></p><p>I used to think of my online security setup the way I think of a smoke alarm: install it once, forget it exists, and assume it'll still work whenever it matters. That assumption held up fine for years, right up until I noticed how much of what actually threatens people now barely existed in the same form eighteen months ago. This isn't a roundup of predictions. It's a plain account of what I've actually changed about my own habits over the past year, and what's pushed me to change them.</p><p><br></p><h2>Why I Stopped Treating My Security Setup as "Done"</h2><p><br></p><p>The moment that actually shifted my thinking wasn't a headline, it was realising that half the advice I'd been repeating to people was written for a threat landscape that had already moved on. Passwords alone stopped being the main battleground years ago, but I was still talking and acting like they were the whole story. Once I started paying closer attention to what was actually catching people out, I found myself quietly updating one habit after another, not because a single event forced my hand but because the old defaults had quietly stopped being enough.</p><p><br></p><h2>Passkeys Replaced More of My Passwords Than I Expected</h2><p><br></p><p>I was sceptical about passkeys when they first started appearing as an option on major accounts, mostly because "sign in without a password" sounded like exactly the kind of convenience feature that trades security for ease. I was wrong about that. A passkey is tied to your device and can't be phished the way a typed password can, since there's no shared secret for a fake login page to steal in the first place. I've switched over on every account that offers it, which is now a meaningful chunk of the logins I use daily, and I still keep a <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">password manager</a> running everything else that hasn't caught up yet.</p><p><br></p><h2>I Now Assume Any Voice or Video Call Could Be Faked</h2><p><br></p><p>A year ago I would have said a phone call was one of the more trustworthy ways someone could reach me, precisely because you could hear it was really them. That assumption doesn't hold anymore. AI voice cloning has gotten cheap and convincing enough that a short clip of someone's voice, the kind anyone posts on social media without thinking twice, is enough to fake a call that sounds exactly like a family member in distress. My actual behaviour change is small but consistent: any unexpected call asking for money or sensitive information gets a <a href="https://kellssecurity.com/blog/the-verification-habits-i-rely-on-whenever-i-suspect-an-ai-scam" data-mce-href="https://kellssecurity.com/blog/the-verification-habits-i-rely-on-whenever-i-suspect-an-ai-scam">callback on a number I already trus</a>t, not the number that just rang me, no matter how convincing the voice sounded.</p><p><br></p><h2>QR Codes Get the Same Suspicion I Used to Reserve for Links</h2><p><br></p><p>I used to scan QR codes without a second thought, mostly because they felt like a neutral piece of infrastructure rather than something that could be tampered with. That's changed since I started seeing reports of scammers physically sticking fake QR code stickers over legitimate ones on parking meters and restaurant tables. A QR code hides the actual destination until after you've already tapped it, which is exactly the kind of blind trust I'd never extend to a random text link. I still use them, but I check the URL that loads before entering anything, the same habit I already had for links, just extended to a format I'd been treating as exempt.</p><p><br></p><figure id="figure-bw0e8ouapmtk2traj"><img id="bw0e8ouapmtk2traj" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Laptop on a desk being kept up to date, What I've Changed About How I Protect Myself Online" src="https://cdn.durable.co/covers/1eIcH0PYPPse9y9EvviBdOBAWMXawnR1P7ap30fM6N8xpR3gsZOa6lpCYxOXYe7d.jpg" alt="Laptop on a desk being kept up to date, What I've Changed About How I Protect Myself Online" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/1eIcH0PYPPse9y9EvviBdOBAWMXawnR1P7ap30fM6N8xpR3gsZOa6lpCYxOXYe7d.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>I Pay More Attention to What My Smart Devices Are Doing</h2><p><br></p><p>My smart home setup has grown steadily over the past few years without me ever really auditing it as a whole, and that's the habit I've most deliberately corrected recently. Every smart device on my network is a small computer with its own firmware, its own update schedule, and its own potential vulnerabilities, and I'd been treating most of them as appliances rather than as what they actually are. I now check my router's <a href="https://kellssecurity.com/blog/the-cyber-threats-i-find-hiding-in-places-nobody-checks" data-mce-href="https://kellssecurity.com/blog/the-cyber-threats-i-find-hiding-in-places-nobody-checks">connected-device list</a> every few months and actually recognise what's supposed to be there, rather than assuming everything on it belongs. A device I don't recognise gets investigated before it gets ignored.</p><p><br></p><h2>The One Habit That Hasn't Changed at All</h2><p><br></p><p>For everything I've adjusted this year, the most valuable habit I have is one that hasn't changed at all: treating urgency as a warning sign rather than a reason to act fast. Every new format the scams take, cloned voices, spoofed QR codes, convincing fake emails, relies on the same underlying pressure to skip the pause where you'd normally think something through. The specific technology keeps shifting and I expect it'll keep shifting again next year, but the instinct to slow down when something feels urgent has outlasted every individual trend so far, and the <a href="https://www.ncsc.gov.uk/cyberaware/home" data-mce-href="https://www.ncsc.gov.uk/cyberaware/home">NCSC's own guidance </a>leans on exactly that same principle.</p><p><br></p><p>None of these changes came from a single dramatic event. They came from paying closer attention to what was actually working against people and being honest with myself about which of my own habits were built for a threat landscape that had already moved on. My free <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">Safety Toolkit </a>covers the fundamentals that make it easier to keep adjusting as things keep changing, and I'd rather update a habit a little too early than find out I needed to a little too late.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

What I've Changed About How I Protect Myself Online

<h2>The Password Manager Migration I Actually Went Through</h2><p>&nbsp; If you're picking one for the first time, I've written up <a href="https://kellssecurity.com/blog/how-id-choose-a-password-manager-if-i-were-starting-today" data-mce-href="https://kellssecurity.com/blog/how-id-choose-a-password-manager-if-i-were-starting-today">how I'd choose a password manager</a> from scratch.</p><p>I'd known for years that keeping passwords scattered across memory and browser autofill wasn't a real strategy, but knowing that and actually doing something about it turned out to be two very different problems. Choosing a password manager took me an afternoon of comparing options. Actually moving well over a decade of scattered logins into it took considerably longer, and most of what I'd read beforehand focused entirely on which tool to pick rather than what the move itself actually involves. This is the process I went through, not the shortlist I used to choose the software.</p><p><br></p><h2>Why I Finally Stopped Putting Off the Move</h2><p><br></p><p>The thing that finally pushed me to do it wasn't a data breach notification, it was a moment of trying to log into an old account and realising I genuinely couldn't remember which of four password variations I'd used for it. I'd been telling myself the migration would take a whole weekend I never had, which is exactly the kind of excuse that keeps people using the same three passwords for a decade. It took me about ninety minutes spread across two evenings, not a weekend, and most of that time went into the next step rather than the actual software setup.</p><p><br></p><h2>Exporting What My Browser Already Had Saved</h2><p><br></p><p>My starting point wasn't a blank slate, it was whatever my browser had quietly saved over the years through its own built-in autofill, which turned out to be well over a hundred entries I'd half forgotten existed. Every major browser has an export option buried in its password settings that produces a plain CSV file, and that file became my actual starting inventory rather than trying to remember and re-enter every login by hand. The catch is that a file like that sits unencrypted on your device for as long as it exists, so I imported it straight into the password manager and then deleted the file immediately rather than letting it linger in my downloads folder.</p><figure id="figure-fk1bjy0a4kmtk21wet"><img id="fk1bjy0a4kmtk21wet" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Woman reading online safety advice on her laptop, The Password Manager Migration I Actually Went Through" src="https://cdn.durable.co/covers/1b6yok9RJBZAfVJCU68TtCAefcOkWASoEAg2dAh9pXKihM78nnfL0P7qcT5IAgmm.jpg" alt="Woman reading online safety advice on her laptop, The Password Manager Migration I Actually Went Through" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/1b6yok9RJBZAfVJCU68TtCAefcOkWASoEAg2dAh9pXKihM78nnfL0P7qcT5IAgmm.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>Working Through the List Instead of Importing It Blind</h2><p><br></p><p>I could have just imported that whole file and called the job done, but importing blind just moves the same mess into a nicer-looking box. Most password managers will flag reused and weak passwords automatically once you import, and mine turned up more repeated passwords than I wanted to admit to, along with a handful of accounts I didn't even recognise the names of anymore. I went through that flagged list first rather than the full alphabetical one, since that's where the actual risk was concentrated, and it took the job from "everything imported" to "everything imported and actually looked at," which is a meaningfully different thing.</p><p><br></p><h2>Changing the Passwords That Actually Mattered First</h2><p><br></p><p>I didn't try to fix every single flagged password in one sitting, because that's how a ninety-minute job turns into something I'd abandon halfway through. Instead I prioritised by consequence: email first, since it's the recovery route into almost everything else, then banking, then anything with stored payment details, and left the low-stakes accounts like old forum logins for whenever I got round to them. That ordering meant the accounts that could actually do damage if compromised were secured within the first sitting, even though the full list took another few evenings to work all the way through.</p><p><br></p><h2>Setting Up the Unlock Method I'd Actually Use Every Day</h2><p><br></p><p>A password manager only works if unlocking it is easier than the bad habit it's replacing, so I spent real time deciding how I'd get into it day to day rather than accepting whatever the default was. I use a long passphrase for the master password itself, the same <a href="https://kellssecurity.com/blog/the-method-i-actually-use-to-build-a-password-worth-trusting" data-mce-href="https://kellssecurity.com/blog/the-method-i-actually-use-to-build-a-password-worth-trusting">four-random-word method</a> I've written about separately, since that's the one thing that has to live in my head and nowhere else. On top of that I turned on biometric unlock on my phone and laptop, which means I'm not typing the master password out in public more often than I actually need to.</p><p><br></p><h2>Clearing My Browser's Own Saved Passwords Once the Manager Was Ready</h2><p><br></p><p>The step I nearly skipped was going back into the browser afterwards and actually clearing out its own saved password store, rather than leaving both systems running in parallel. Having the same credentials sitting in two places doubles the number of places a breach could expose them from, and browser-saved passwords are typically protected by nothing more than whether someone's already logged into your device, which is a much weaker bar than a proper password manager's encryption. I waited a full week after the migration before clearing the browser's store, just to be sure nothing had been missed, and then went through and deleted it properly rather than just clicking "stop saving."</p><p><br></p><h2>Why I Think of the Manager as Ongoing, Not a One-Time Job</h2><p><br></p><p>The migration itself was a single afternoon-and-a-few-evenings project, but treating it as finished the moment the import was done would undo most of the point of doing it. I run the same <a href="https://kellssecurity.com/blog/the-safety-check-in-i-run-on-my-own-accounts-every-few-months" data-mce-href="https://kellssecurity.com/blog/the-safety-check-in-i-run-on-my-own-accounts-every-few-months">account check-in</a> every few months now, the one I've written about separately, which catches new reused passwords and old accounts I've since abandoned before they turn into the same mess I started with. A <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">password manager</a> makes the daily habit painless, but it's still a tool that needs occasional attention rather than something you set up once and never look at again, and the <a href="https://www.ncsc.gov.uk/cyberaware/home" data-mce-href="https://www.ncsc.gov.uk/cyberaware/home">NCSC </a>has its own guidance on password management worth checking your own setup against. My free <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">Safety Toolkit</a> covers the basics that make everything after the migration easier to keep up.</p><p>If you want the full picture on spotting the scams that go after your accounts, grab my <a href="https://79516839.sibforms.com/serve/MUIFAAzCSl0YuEwRMq4a4xv696PrjPtci8pqRdpNUvPRnH9fF-gauC1E_eGFVnwYYGIz2Wdg8bfKiwSjYjxoukXt_Dz7JlzqD5-mpQiIXVKfIA0-0B2cjR54xgODntiOjGBJ2K4Pq2-T3AQqxmQ5ER1uv0WQSEUzNeTje1QXmDkFm_sADqNAYtxABtGZXkJfeM24GY5zcWVw8UV1" data-mce-href="https://79516839.sibforms.com/serve/MUIFAAzCSl0YuEwRMq4a4xv696PrjPtci8pqRdpNUvPRnH9fF-gauC1E_eGFVnwYYGIz2Wdg8bfKiwSjYjxoukXt_Dz7JlzqD5-mpQiIXVKfIA0-0B2cjR54xgODntiOjGBJ2K4Pq2-T3AQqxmQ5ER1uv0WQSEUzNeTje1QXmDkFm_sADqNAYtxABtGZXkJfeM24GY5zcWVw8UV1">free Safety Checklist</a> and I'll send you a short email series with the rest. If you'd rather have it all in one place, my book <a href="https://www.amazon.co.uk/dp/B0HJMF41G2" data-mce-href="https://www.amazon.co.uk/dp/B0HJMF41G2">Spot the Scam:</a> A Plain English Guide to the Ten Cons Trying to Catch You Out is on Amazon.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The Password Manager Migration I Actually Went Through

<h2>The Personal Information I Never Hand Over to an Online Store</h2><p>I've written elsewhere about <a href="https://kellssecurity.com/blog/the-online-shopping-routine-i-follow-from-search-to-delivery" data-mce-href="https://kellssecurity.com/blog/the-online-shopping-routine-i-follow-from-search-to-delivery">my full routine from search to delivery</a> but that routine assumes I'm already comfortable with the retailer itself. This is the layer underneath it: the actual personal information I do and don't hand over once I've decided to buy, because the checkout page is where casual browsing turns into pieces of my identity sitting in someone else's database, and most of what gets asked for there isn't actually required to complete the order.</p><h2>Why I Default to Guest Checkout Whenever It's an Option</h2><p>Every account I create with a retailer is another database holding my name, address, phone number, and order history, sitting there indefinitely long after I've forgotten the site exists. Guest checkout completes the exact same purchase without creating that permanent record, and I use it by default unless I'm actually going to order from a site regularly enough that saved details are worth the tradeoff. I've lost count of how many "member accounts" I've created over the years for a single one-off purchase, most of which I never logged into again, and every one of them is still sitting somewhere with my address and order history attached whether I remember creating it or not.</p><h2>The Payment Details I Never Let a Site Save</h2><p>Retailers ask to save card details "for next time" at almost every checkout now, and I decline by default, typing the card number in fresh each time even though it costs an extra fifteen seconds. A saved card sitting in a retailer's system is only as safe as that retailer's security, and small and mid-sized online shops are exactly the kind of target that doesn't make headline news when they're breached, unlike the big-name breaches that actually get reported. I'd rather deal with that fifteen seconds of extra typing every single time than find my card number sitting in a database I have no visibility into and no real way to check.</p><h2>Why I Give Deliberately Vague Answers to "Optional" Profile Fields</h2><p>A lot of checkout and account-creation forms ask for a date of birth, a phone number, or a "tell us about yourself" field that has genuinely nothing to do with completing an order, and marks itself optional while still sitting right there asking anyway. I skip anything actually marked optional without exception, and where a field is presented as required but clearly isn't, a date of birth for a clothing order, for instance, I've stopped assuming I have to answer it accurately, since that data point usually exists for marketing profiling rather than order fulfilment. The pattern I watch for is a request for information that has no plausible connection to shipping me a physical item.</p><h2>Why I Don't Use "Sign In With Facebook" to Speed Up Checkout</h2><p>The one-click social login options at checkout are genuinely convenient, and that's exactly why I avoid them. Signing in with an existing social account doesn't just save me typing a password, it usually hands the retailer a slice of whatever profile data that platform is willing to share, and it links a purchase history I'd rather keep separate to an account that already knows a great deal about me. A separate email and password through a <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">password manager</a> takes a few seconds longer at checkout and keeps the two entirely apart, which matters more the day one of them gets breached and I need to know exactly what was exposed rather than guessing how many services quietly had a copy. It also means a compromised shopping account never becomes a door into the social account it was signed in through, which is exactly the kind of chained access I've seen catch people out with accounts they thought had nothing to do with each other.</p><h2>The Marketing and Data-Sharing Boxes I Always Opt Out Of</h2><p>Somewhere near the bottom of most checkout pages sits a pre-ticked box agreeing to marketing emails, and often a second one agreeing to share my details with "trusted partners," a phrase that could mean almost anything. I go through and untick both every single time, since a pre-ticked box is a default written to work in the retailer's favour, not mine, and "trusted partners" is rarely defined anywhere I can actually check before I've already handed the information over. It costs a few extra seconds per order, and it's the difference between one retailer having my email address and an unknown number of others acquiring it without my ever agreeing to that directly. I've traced more than one wave of unfamiliar marketing emails back to a single order where I skipped past that box without reading it, which is usually enough motivation to actually read it properly the next time.</p><figure id="figure-fijx3nqznjmtk0bd0t"><img id="fijx3nqznjmtk0bd0t" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Woman reading online safety advice on her laptop, The Personal Information I Never Give an Online Store" src="https://cdn.durable.co/covers/1b6yok9RJBZAfVJCU68TtCAefcOkWASoEAg2dAh9pXKihM78nnfL0P7qcT5IAgmm.jpg" alt="Woman reading online safety advice on her laptop, The Personal Information I Never Give an Online Store" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/1b6yok9RJBZAfVJCU68TtCAefcOkWASoEAg2dAh9pXKihM78nnfL0P7qcT5IAgmm.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>Why the Information I Withhold Matters as Much as the Password I Choose</h2><p>A strong unique password protects an account after it exists, but it does nothing about the data I chose to hand over while creating that account in the first place. Every optional field I skip, every account I don't create, every card number I don't let get saved is one less thing sitting in a database somewhere waiting for the next <a href="https://kellssecurity.com/blog/the-safety-check-in-i-run-on-my-own-accounts-every-few-months" data-mce-href="https://kellssecurity.com/blog/the-safety-check-in-i-run-on-my-own-accounts-every-few-months">breach notification email</a>. The <a href="https://www.ncsc.gov.uk/cyberaware/home" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/cyberaware/home">NCSC </a>publishes guidance on shopping safely online if you want a second source to check your own habits against, and my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">free Safety Toolkit</a> covers the account-level basics that make the rest of this easier to keep up. I'd rather spend an extra minute at checkout now than spend an afternoon later working out which of my old accounts got compromised.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The Personal Information I Never Give an Online Store

<h2>The Social Media Habits That Quietly Put People at Risk</h2><p>I've written separately about <a href="https://kellssecurity.com/blog/the-privacy-settings-i-actually-lock-down-on-every-social-platform" data-mce-href="https://kellssecurity.com/blog/the-privacy-settings-i-actually-lock-down-on-every-social-platform">the privacy settings I lock down on every platform</a>, but settings are only half the picture. The other half is habit, the small everyday choices people make without thinking twice, and those habits are usually what actually gets someone into trouble, not a setting they forgot to change. These are the five I see trip people up most often, the ones that have nothing to do with a locked-down profile and everything to do with what someone does day to day once they're already logged in.</p><p><br></p><h2>Accepting Every Friend Request Without a Second Look</h2><p><br></p><p>The habit I see most is treating a friend or follow request as basically harmless, something to accept on autopilot because saying no feels awkward even to a stranger you'll never actually meet. A fake profile built to look like a mutual friend, sometimes using a cloned name and photo from someone real, gets accepted the same way a genuine request would, and once it's accepted that account can see everything your normal privacy settings would otherwise have hidden from a stranger. I check for shared friends, a profile history that actually looks lived-in rather than freshly created, and photos that don't look lifted from somewhere else before I accept anything from someone I don't actually know, and I'd rather leave a request pending for a day than accept something I can't quite place. Once someone's in, they're usually in for good, since almost nobody goes back later to prune a friend list the way they'd review a password, which means one careless accept years ago can still be sitting there quietly today.</p><p><br></p><h2>Answering "Fun" Quiz Posts That Double as Security Questions</h2><p><br></p><p>These circulate constantly, the kind that ask for your first pet's name, the street you grew up on, your first car, framed as a bit of harmless nostalgia everyone in the comments is playing along with. The problem is those are almost word for word the security questions banks and email providers still use to verify identity or reset a password, and answering publicly hands that information to anyone watching, not just the friends you meant to share it with. I don't answer these anymore, and if I want to reminisce about a first car I'll just message a friend directly instead of posting it somewhere searchable. It's a small habit shift that costs nothing and closes off a genuinely common way people get themselves compromised without ever being hacked in the technical sense.</p><p><br></p><figure id="figure-4gbxog6qjpmtjwo6o1"><img id="4gbxog6qjpmtjwo6o1" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Man working at a desk with online safety in mind, The Social Media Habits That Quietly Put People at Risk" src="https://cdn.durable.co/covers/4IoZLwzEazYn5vx7hOa2BVriIWr70ma5OwxhttLbWrDsOynBuSFRKZ3fDy3HrhLt.jpg" alt="Man working at a desk with online safety in mind, The Social Media Habits That Quietly Put People at Risk" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/4IoZLwzEazYn5vx7hOa2BVriIWr70ma5OwxhttLbWrDsOynBuSFRKZ3fDy3HrhLt.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>Posting Real-Time Instead of After the Fact</h2><p><br></p><p>A post that says where you are right now, whether that's a check-in, a geotagged photo, or just a caption that makes your current location obvious, tells anyone watching two things at once: exactly where you are, and by extension exactly where your home isn't. I've written about turning location tagging off at the app level, but the habit that matters even more is simply timing what I post. I share photos from a trip after I've left, not while I'm still there, and I've gotten comfortable with the idea that nobody actually needs to know where I am in the moment, no matter how good the photo is right now. It feels like a small delay. It closes off a specific and fairly obvious risk.</p><p><br></p><h2>Reusing an Email Password as a Social Login</h2><p><br></p><p>I still see people use the same password for their main social account that they use for their personal email, treating the two as separate enough not to matter even though one is usually the recovery method for the other. If a social account gets compromised through a data breach on a completely different site, and that same password unlocks the email account tied to it, whoever has it can often reset every other account linked to that inbox before you even notice something's wrong.<a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356"> A password manager</a> generating a genuinely unique password for every account, social platforms included, closes this off completely, and it takes less effort to set up than most people assume once they actually sit down and do it properly.</p><p><br></p><h2>Ignoring the Tag and Mention Review Queue</h2><p><br></p><p>Most platforms let you approve what gets attached to your name before it appears on your profile, a tag, a mention, a photo someone else uploaded, but the setting only works if you actually check the queue instead of leaving it to pile up unread. I've been tagged in things I'd never have posted myself, sometimes just an unflattering photo, sometimes something that gave away more context about my life than I'd have chosen to share. Reviewing that queue regularly, not just switching the approval setting on and forgetting about it, is the habit that actually makes the setting worth having in the first place. I've started treating it the same way I treat <a href="https://kellssecurity.com/blog/the-safety-check-in-i-run-on-my-own-accounts-every-few-months" data-mce-href="https://kellssecurity.com/blog/the-safety-check-in-i-run-on-my-own-accounts-every-few-months">checking for known data breaches on my main accounts</a>, a short recurring task rather than a one-off fix, because new tags and mentions never actually stop arriving.</p><p><br></p><h2>Why the Habit Matters as Much as the Setting</h2><p><br></p><p>None of this replaces locking down your actual privacy settings, that groundwork still matters and I'd genuinely start there if you haven't already. But settings only cover what happens automatically. The rest comes down to habits, and habits are the part people tend to skip because they don't feel like a "setting" worth thinking about, right up until one of them causes a real problem. The <a href="https://www.ncsc.gov.uk/cyberaware/home" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/cyberaware/home">NCSC </a>has straightforward guidance on staying safe on social platforms if you want a second source to check your own habits against, and my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">free Safety Toolkit</a> covers the account-level basics worth having in place underneath all of this. I'd rather build a few small habits now than find out the hard way which one I'd been skipping.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The Social Media Habits That Quietly Put People at Risk

Kells Security Solutions

I teach people around the world how to spot online scams and stay safe on the internet, explained in plain English with no jargon. I cover phishing emails, two-factor authentication, password managers, VPNs and antivirus software, written for people who are not tech experts and want to protect themselves and their families.