Blog

<h2>The Cyber Threats I Watch For That Rarely Make the Warning Lists</h2><p>Most of the cyber safety advice out there covers the same five or six threats: phishing emails, malware, data breaches, identity theft, ransomware.<a href="https://kellssecurity.com/blog/the-different-online-threats-i-actually-plan-around" data-mce-href="https://kellssecurity.com/blog/the-different-online-threats-i-actually-plan-around"> I've written about those categories separately</a>, and they matter, but they're not the whole picture. The threats that actually worry me most these days are the ones that rarely make it onto a typical warning list, because they're harder to explain in a single sentence and they don't fit the "don't click the link" template that most advice defaults to. If you consider yourself reasonably careful online already, these are the ones I'd actually spend your remaining attention on.</p><p><br></p><figure id="figure-4xs8od3x0bmtju77bd"><img id="4xs8od3x0bmtju77bd" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Laptop on a desk being kept up to date, The Cyber Threats That Rarely Make the Warning Lists" src="https://cdn.durable.co/covers/1eIcH0PYPPse9y9EvviBdOBAWMXawnR1P7ap30fM6N8xpR3gsZOa6lpCYxOXYe7d.jpg" alt="Laptop on a desk being kept up to date, The Cyber Threats That Rarely Make the Warning Lists" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/1eIcH0PYPPse9y9EvviBdOBAWMXawnR1P7ap30fM6N8xpR3gsZOa6lpCYxOXYe7d.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>SIM Swapping That Bypasses the Two-Factor Codes I Rely On</h2><p><br></p><p>I used to think two-factor authentication by text message was close to bulletproof. Then I learned about SIM swapping, where someone convinces your mobile provider to move your number onto a SIM card they control, usually with a stolen bit of personal information and a plausible enough story. Once they have your number, every text-message code meant to protect your accounts gets sent straight to them instead of you. It's a low-probability attack for most people, but a high-value one for anyone with meaningful savings or a business account, and the fix isn't complicated: switch from text-message codes to an authenticator app wherever the option exists, and ask your mobile provider about adding a PIN or passcode to your account specifically to stop a number transfer without it.</p><p><br></p><h2>Browser Extensions That Quietly Ask For More Access Than They Need</h2><p><br></p><p>I still see people install browser extensions the way they'd install an app on their phone, without a second look at what permission they're granting. A shopping-discount extension or a note-taking tool asking for permission to "read and change all your data on all websites you visit" is asking for far more than it needs to do its actual job, and a surprising number of extensions get sold to new owners after they've built up a user base, at which point that broad permission can quietly start being used for something else entirely. I go through my installed extensions every few months now, the same way I review<a href="https://kellssecurity.com/blog/the-safety-check-in-i-run-on-my-own-accounts-every-few-months" data-mce-href="https://kellssecurity.com/blog/the-safety-check-in-i-run-on-my-own-accounts-every-few-months"> which apps still have access to my accounts</a>, and remove anything I can't immediately justify keeping. It takes minutes and it's one of the easiest wins available.</p><p><br></p><h2>Session Hijacking Through a Stolen Cookie, Not a Stolen Password</h2><p><br></p><p>This one surprised me when I first understood how it worked. Even with a strong, unique password and two-factor authentication switched on, a piece of malware or a malicious script can steal the small file your browser uses to prove you're already logged in, called a session cookie, and use it to access your account without ever needing your password at all. It's the reason logging out of accounts on shared or public devices actually matters, and why keeping your browser and operating system updated matters more than people assume, since those updates close off a lot of the specific techniques used to grab a session cookie in the first place. A password manager doesn't directly stop this one, but it does mean you're not reusing the same session-adjacent habits across every site, which limits how far a single stolen cookie can actually reach.</p><p><br></p><h2>Software Updates That Arrive From a Compromised Supplier</h2><p><br></p><p>This is the threat that changed how I think about updates generally. A supply-chain attack happens when someone compromises a piece of software you trust at the source, so the update you install is malicious before it ever reaches your device, meaning the usual advice of "keep everything updated" briefly stops being enough. These attacks are rare and usually aimed at larger organisations rather than individuals, but they've hit widely-used consumer software before, and there's genuinely very little an individual user can do to catch one in the moment. What I can control is limiting how much software I install in the first place, sticking to well-established tools with a track record rather than something new and unvetted, and keeping backups current enough that a bad update doesn't cost me more than the time it takes to restore.</p><p><br></p><h2>Credential Stuffing That Doesn't Need to Guess My Password at All</h2><p><br></p><p>Credential stuffing doesn't try to guess your password, it takes a password that's already been exposed in a completely different breach and tests it automatically against thousands of other sites, betting that you've reused it somewhere else. This is the single biggest reason password reuse is worse than people assume, because it means a breach at a site you barely remember signing up for years ago can still compromise an account you actually care about today, with no phishing, no malware, and no mistake on your part in the moment it happens. <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">A password manager </a>generating a genuinely unique password for every account is the direct fix, since it means a credential-stuffing attempt built on an old breach simply doesn't work anywhere else.</p><p><br></p><h2>Why I Still Think the Basics Come First</h2><p><br></p><p>None of this means the standard advice is wrong, it's still where most people actually get caught, and getting the fundamentals right closes off the vast majority of real-world attacks before any of this becomes relevant. But if you've already got the basics handled, these five are where I think the next layer of attention is actually worth spending, because they're the ones that slip past someone who's doing everything the standard checklist tells them to. The <a href="https://www.ncsc.gov.uk/cyberaware/home" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/cyberaware/home">NCSC</a> publishes more technical guidance for anyone who wants to go deeper on any of these, and my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">free Safety Toolkit</a> still covers the account-level fundamentals that make most of these threats far less effective even when they do land. Staying ahead of this stuff isn't about knowing every possible attack, it's about not assuming that ticking the standard boxes means you're covered against everything.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The Cyber Threats That Rarely Make the Warning Lists

<h2>The AI Scam Patterns I'm Seeing Move From Individuals to Small Businesses</h2><p>For a long time the AI scam stories I heard were all personal: a cloned voice on a phone call, a message that sounded a little too convincing. What I'm seeing now is the same technology showing up in a completely different context, aimed at small businesses rather than individuals, and it worries me more, because the money involved is bigger and the people making payment decisions often have less time to stop and question what's in front of them. If you run even a small operation, this is worth understanding on its own terms rather than assuming the family-scam warnings you've already heard cover it.</p><h2>Why AI Scams Aren't Just a Personal-Target Problem Anymore</h2><p>The economics of this shift make sense once you think about it. A scammer cloning a voice to target one family member might get a few hundred pounds if it works. A scammer impersonating a supplier or a director to authorise a business payment can be targeting thousands in a single message, and a small business often has fewer checks in place than a large one with a dedicated finance team. AI has made the impersonation itself cheap and convincing enough that the extra effort of targeting a business instead of a person barely costs the scammer anything more, while the potential payout is far higher. That's the shift I think a lot of small business owners haven't clocked yet, because the warnings they've seen are still framed around grandparents and voice clones rather than invoices and video calls.</p><h2>The Fake Video Call That's Replacing the Fake Phone Call</h2><p>A phone call used to be the gold standard for verifying something felt suspicious, because at least you could hear a real person's tone even if the details were fake. AI video generation has started to close that gap. I've heard from other small business owners about video calls that looked and sounded like a real supplier or colleague on a brief connection, just convincing enough to get an urgent instruction across before anything felt off. It's not yet common enough to panic about, but it's common enough that I no longer treat "I saw them on a call" as proof of anything on its own, especially when the call is short, the connection is poor, or the request is unusually time-pressured.</p><h2>Invoice Fraud That Now Mimics a Supplier's Exact Tone</h2><p>Invoice fraud isn't new, but AI has made it far more convincing than the slightly-off emails that used to give it away. A scammer can now feed a genuine supplier's previous emails into a tool and get back a message that matches their actual writing style, their usual phrasing, even inside jokes or references to a real ongoing project. The old advice to look for spelling mistakes or a strange tone is close to useless against this. What still works is having a separate verification step for any change to payment details specifically, a phone call to a number you already have on file rather than one in the email, before a changed account number is ever used. That single habit, kept completely separate from how convincing the message reads, is the thing I'd actually recommend over trying to spot the fake by feel.</p><figure id="figure-rqxdjo3fjmtjt6u4v"><img id="rqxdjo3fjmtjt6u4v" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Worried older man on a suspicious phone call, AI Scams Moving From Individuals to Small Businesses" src="https://cdn.durable.co/covers/53TSLRnp03hV6RbE3sAyBIrtLB7DB0QpFBjOkVjCSmt9lTxV8mwEZUb7Zr3Wxekr.jpg" alt="Worried older man on a suspicious phone call, AI Scams Moving From Individuals to Small Businesses" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/53TSLRnp03hV6RbE3sAyBIrtLB7DB0QpFBjOkVjCSmt9lTxV8mwEZUb7Zr3Wxekr.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>The Job Applicant Who Never Actually Existed</h2><p>This is the one that surprised me most when I first heard about it. Small businesses hiring remotely have started encountering job applicants using AI-generated photos, AI-written CVs, and in some cases AI-assisted video interviews, sometimes to get access to company systems and sensitive data under a fake identity rather than to actually work the job. It's a specific and growing enough problem that some recruitment platforms have started building in detection tools for it. If you're hiring for any role with access to financial systems, client data, or admin-level accounts, a basic identity verification step before onboarding isn't excessive caution anymore, it's a reasonable baseline, in the same category as <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">a password manager</a> keeping every account's login genuinely unique rather than assuming a strong-looking application speaks for itself.</p><h2>Building Verification Into the Process, Not Just Into Suspicion</h2><p>The thread running through all of this is that suspicion alone doesn't scale the way a business needs it to. I can't rely on a gut feeling catching every convincing fake video call or every well-mimicked supplier email, especially on a busy day when someone is trying to get a payment out quickly. What actually works is building a verification step into the process itself, a callback to a trusted number before any payment detail changes, a second person's sign-off on anything above a set amount, an identity check before systems access is granted, so that the check happens automatically rather than depending on someone noticing something felt wrong in the moment. I've written separately about <a href="https://kellssecurity.com/blog/the-verification-habits-i-rely-on-whenever-i-suspect-an-ai-scam" data-mce-href="https://kellssecurity.com/blog/the-verification-habits-i-rely-on-whenever-i-suspect-an-ai-scam">the verification habits I rely on personally whenever I suspect an AI scam</a>, and the same principle underneath is even more important here: build the check into the process, not into your ability to spot a fake in real time. <a href="https://kellssecurity.com/blog/the-simple-checks-i-use-to-stop-ai-scams" data-mce-href="https://kellssecurity.com/blog/the-simple-checks-i-use-to-stop-ai-scams">The specific AI scam techniques I think are actually getting harder to spot</a> keep evolving on their own, but a verification step that doesn't depend on spotting anything holds up regardless of how convincing the fake gets. The <a href="https://www.ncsc.gov.uk/cyberaware/home" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/cyberaware/home">NCSC </a>has guidance aimed specifically at small businesses if you want a second source to build a process around, and my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">free Safety Toolkit</a> covers the account-level basics worth having in place before you even get to business-specific verification steps. None of this needs to be complicated. It just needs to happen every time, not just on the days something feels off.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

AI Scams Moving From Individuals to Small Businesses

<h2>How I Actually Handle Online Safety Across Three Generations of My Family</h2><p>I used to treat "family cyber safety" as one conversation I'd eventually get around to having, a single sit-down where I'd cover passwords, scams, and app permissions in one go and consider the job done. It doesn't work like that. My kids, my teenager, and my parents are exposed to completely different risks, use completely different platforms, and need completely different explanations, and trying to give all three the same generic talk just meant nobody actually retained anything useful. What's worked better is treating it as three separate, ongoing relationships, each with its own approach, revisited regularly rather than delivered once and filed away.</p><p><br></p><h2>Why I Stopped Treating "Family Cyber Safety" as One Conversation</h2><p><br></p><p>The turning point was realising that a warning genuinely useful to my dad, about a caller pretending to be his bank, would have meant nothing to my ten-year-old, who has never had a bank call him in his life. Meanwhile the thing my teenager actually needed to hear, about what she shares with people she's only ever met through a game, wasn't remotely relevant to my parents. Once I stopped trying to write one script for the whole family, the conversations actually started landing, because each one addressed a risk the person in front of me could recognise from their own life rather than a hypothetical.</p><p><br></p><h2>What I Actually Set Up on My Kids' Devices</h2><p><br></p><p>For my younger kids, the safety work happens mostly in settings rather than conversation, because they're too young for a lot of the reasoning to stick yet. I set up parental controls at the device level rather than trusting an individual app's own settings, since those get changed or reset far more easily than I'd like. Screen time limits and app-approval requirements go on before a device is ever handed over, not added later once habits have already formed. I also keep their accounts logged in under a shared family <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">password manager</a> rather than letting them create their own logins with whatever they can remember, which usually means the same three passwords reused everywhere. It's less about them understanding the "why" at this age and more about the guardrails simply being in place before they need them.</p><p><br></p><figure id="figure-o4kudqufmjmtjsbudk"><img id="o4kudqufmjmtjsbudk" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Mum showing her children how to stay safe online on a laptop, Online Safety Across Three Generations of My Family" src="https://cdn.durable.co/covers/17KfQCYYdw4jsmu8go1XugXnqvcXfAVpTswPyhvZz7KO69SBcrIeUb2BonZ1aI0c.jpg" alt="Mum showing her children how to stay safe online on a laptop, Online Safety Across Three Generations of My Family" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/17KfQCYYdw4jsmu8go1XugXnqvcXfAVpTswPyhvZz7KO69SBcrIeUb2BonZ1aI0c.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>The Conversation I Have With My Teenager That Actually Lands</h2><p><br></p><p>My teenager is a different problem entirely, because at this age the controls I could still enforce on a younger child stop being appropriate, and honestly stop being effective too. What's worked is treating her as capable of understanding real reasoning rather than just being told what's off-limits. We've talked through <a href="https://kellssecurity.com/blog/the-verification-habits-i-rely-on-whenever-i-suspect-an-ai-scam" data-mce-href="https://kellssecurity.com/blog/the-verification-habits-i-rely-on-whenever-i-suspect-an-ai-scam">a family code word</a>, the same one I use to verify anyone claiming to be a relative on the phone, so she has something concrete to fall back on if she's ever contacted by someone pretending to be me or another family member asking for money or details urgently. We've also gone through what she actually shares with people she only knows through games or group chats, not as an accusation but as a genuine "here's what that information could be used for" conversation. She's more receptive to it framed that way than she ever was to a flat "don't talk to strangers online" rule, which she'd correctly point out doesn't match how she actually socialises.</p><p><br></p><h2>Helping My Parents Without Making Them Feel Patronised</h2><p><br></p><p>My parents are the group I've had to be most careful with, because the instinct to just take over and manage everything for them comes from a good place but lands as condescending fast. What's worked is setting things up alongside them rather than doing it to them, explaining each step as we go rather than just handing back a device that now works differently with no explanation. I've helped my dad set up <a href="https://kellssecurity.com/blog/the-safety-check-in-i-run-on-my-own-accounts-every-few-months" data-mce-href="https://kellssecurity.com/blog/the-safety-check-in-i-run-on-my-own-accounts-every-few-months">the same account check-in</a> I run on my own accounts every few months, checking for known data breaches, cleaning up recovery details, and reviewing what's still connected, but I frame it as something we're doing together rather than a fix for a problem he caused. I've also talked through specific scam patterns rather than vague warnings, since "be careful online" means very little but "if someone calls claiming to be your bank and asks you to move money, hang up and call the number on your card yourself" is something concrete he can actually act on when it happens.</p><p><br></p><h2>The One Rule That Applies to Everyone in the House</h2><p><br></p><p>Despite all the differences in approach, there's one rule I've made non-negotiable for every generation in the family: if something creates urgency, whether that's a call demanding immediate action, a message saying an account will be locked in the next hour, or a text claiming a family member needs money right now, the response is always to stop and verify through a separate channel before doing anything else. Urgency is the one tactic that shows up identically whether the target is a ten-year-old, a teenager, or a retired parent, and it's the one thing I can teach the same way to everyone in the house without needing three different scripts. The <a href="https://www.ncsc.gov.uk/cyberaware/home" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/cyberaware/home">NCSC </a>has useful guidance aimed specifically at families if you want a second source to build your own approach around, and my<a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit"> free Safety Toolkit</a> covers the account-level basics I'd recommend having in place regardless of which generation you're setting up. None of this is about achieving some perfect, permanent state of protection. It's an ongoing set of conversations and check-ins I keep having, adjusted for whoever I'm actually talking to.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

Online Safety Across Three Generations of My Family

<h2>The Privacy Settings I Actually Lock Down on Every Social Platform</h2><p>I used to treat social media privacy settings the way most people do, as something I'd get around to eventually. Then I helped a friend deal with a stranger who'd pieced together her daily routine, her kids' school run, and the fact she was away on holiday, all from public posts she never realised were visible to anyone. Nothing had been hacked. She'd simply never gone in and changed what the platform showed by default. That was the moment I stopped leaving those settings alone. Every platform I use now gets the same run through before I post anything on it, and I go back and check again every few months, because platforms quietly change what's shared by default more often than people expect.</p><p><br></p><h2>Why I Stopped Trusting the Default Privacy Settings</h2><p><br></p><p>Every social platform is built to encourage sharing, and the settings you get on day one reflect that. A new account usually starts with your profile, your friend or follower list, and often your posts themselves visible to anyone, not just the people you actually know. That's not an accident. Visibility drives engagement, and engagement is the business model, so the defaults lean toward open rather than closed. It's on you to go in and narrow that down, and most people simply never do, because nothing prompts them to and the settings menus aren't exactly front and centre. I've stopped assuming a platform has my best interests in mind when it decides what to show and to whom. I check the settings myself, on every account, and I don't assume last year's choices still apply after an update, because a redesign or a new feature rollout can quietly reset something I'd already switched off, or introduce a new sharing option that defaults to on.</p><p><br></p><h2>Locking My Profile Down to People I Actually Know</h2><p><br></p><p>The first thing I check on any platform is who can actually see my profile and my posts. I restrict that to people I'm connected with, not "friends of friends" or the wider public, and I turn off whatever setting lets my profile show up in outside search engines. I also look at who can tag me in a post or a photo without my approval first, because a public tag from someone else's account can expose exactly the information I've locked down on my own. Most platforms let you require approval before a tag becomes visible on your profile, and I turn that on everywhere it exists. It's a small setting that closes a fairly obvious gap.</p><p><br></p><h2>Turning Off Location Tagging Before I Ever Post</h2><p><br></p><p>Location is the one I see people get wrong most often, because it feels harmless in the moment. A geotagged photo or a "checked in here" post tells anyone watching exactly where you are right now, and posting from a family holiday can just as easily tell someone exactly where you aren't, which is its own problem. I keep precise location sharing switched off at the app level, not just on individual posts, since a setting left on can quietly reattach itself to your next upload. When I do want to share where I've been, I post after I've left rather than while I'm still there, and I check that the photo itself isn't carrying embedded location data before it goes anywhere.</p><p><br></p><figure id="figure-fqufif9zqimtjqy9ky"><img id="fqufif9zqimtjqy9ky" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Man working at a desk with online safety in mind, The Privacy Settings I Lock Down on Every Social Platform" src="https://cdn.durable.co/covers/4IoZLwzEazYn5vx7hOa2BVriIWr70ma5OwxhttLbWrDsOynBuSFRKZ3fDy3HrhLt.jpg" alt="Man working at a desk with online safety in mind, The Privacy Settings I Lock Down on Every Social Platform" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/4IoZLwzEazYn5vx7hOa2BVriIWr70ma5OwxhttLbWrDsOynBuSFRKZ3fDy3HrhLt.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>Reviewing Which Apps Still Have Access to My Accounts</h2><p>The setting people skip most is the list of third-party apps and services still connected to their social accounts, sometimes for years after they stopped using them. An old quiz app, a games platform I haven't opened since a phone I no longer own, a scheduling tool from a job I left. All of those can still read profile data or post on my behalf unless I've gone in and revoked access, and I've genuinely been surprised by what turns up when I look. This is part of a wider habit I've written about separately: <a href="https://kellssecurity.com/blog/the-safety-check-in-i-run-on-my-own-accounts-every-few-months" data-mce-href="https://kellssecurity.com/blog/the-safety-check-in-i-run-on-my-own-accounts-every-few-months">reviewing which apps still have access to my accounts </a>sits alongside checking for known data breaches and cleaning up recovery details as one of the periodic account check-ins I run every few months, and I'd recommend treating it the same way on your social accounts specifically, not just email and banking. While I'm in there, I also make sure <a href="https://kellssecurity.com/blog/why-i-treat-two-factor-authentication-as-non-negotiable" data-mce-href="https://kellssecurity.com/blog/why-i-treat-two-factor-authentication-as-non-negotiable">two-factor</a> is switched on for every account that offers it, since a password alone isn't enough to stop someone getting in even if my other settings are locked down properly, and a <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">password manager</a> makes it far easier to keep each account's login genuinely unique instead of reusing one across platforms.</p><p><br></p><h2>What I Still Share, and Why the Rest Stays Private</h2><p><br></p><p>None of this has made me post less, and it hasn't made me paranoid about being online either. I still share plenty, I just decide who gets to see it rather than letting the platform decide for me by default. The <a href="https://www.ncsc.gov.uk/cyberaware/home" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/cyberaware/home">NCSC </a>has straightforward guidance on securing your social accounts if you want a second source to check your own settings against, and my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">free Safety Toolkit</a> covers the account-level basics I'd recommend having in place before you even get to individual privacy settings. Going through each platform properly took me less than an hour in total, and it's the kind of hour that quietly closes off a lot of the ways a stranger could otherwise build a picture of your life without you ever knowing they'd looked. I'd rather spend that hour once, and again briefly every few months, than find out the hard way what someone else pieced together from posts I'd forgotten were even public.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The Privacy Settings I Lock Down on Every Social Platform

<h2>The Difference Between Phishing and Every Other Scam I Deal With</h2><p>People use "phishing" as a catch-all word for basically any scam that arrives online, and I understand why, it's the term that's stuck in the public vocabulary the hardest. But treating every scam as a flavour of phishing actually makes it harder to spot the ones that don't look anything like it. Phishing has a specific goal and a specific shape, and once I started separating it properly from the other scam types I run into, I noticed the warning signs for each got a lot easier to catch. This isn't about picking nits over terminology, it's about the fact that the defence that stops one of these doesn't automatically stop the others. My full guide on <a href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything" data-mce-href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything">how to recognise a phishing email</a> walks through every check I make, in the order I make them.</p><p><br></p><h2>Phishing Is About Stealing Credentials, Not Just Money</h2><p><br></p><p>The thing that actually defines phishing, to me, is the target. It isn't trying to get me to hand over cash directly, it's trying to get me to type a username and password into a page that looks like my bank, my email provider, or some other account I trust. Once that credential is captured, the money or the damage comes later, through a second step the scammer takes once they're already inside. That's a meaningfully different threat model to a scam that just wants me to transfer funds outright, because it means the danger doesn't end the moment I close the email, it sits there waiting on whichever account I just handed over. <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass </a>simply won't autofill my details on a lookalike login page because it checks the actual address rather than how convincing the page looks, which is exactly the kind of protection this specific threat needs. The <a href="https://www.ncsc.gov.uk/cyberaware/home" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/cyberaware/home">NCSC </a>has more detail on spotting these fake login pages if you want to dig into it further.</p><p><br></p><h2>Vishing and Smishing Are Phishing, Just Wearing a Different Channel</h2><p><br></p><p>A lot of people mentally file "phishing" as something that only happens in an email inbox, which is out of date. A scam text about a missed parcel and a scam phone call from someone claiming to be my bank's fraud team are both still phishing in every way that matters, they're just using SMS and voice instead of email to get me to the same fake login page or to read out a one-time code. I've started treating the channel as irrelevant to how suspicious I am and paying attention only to the pattern instead, an unexpected message creating urgency and steering me toward handing over credentials or a code. The delivery method changes, the goal underneath it doesn't.</p><p><br></p><h2>A Romance Scam Plays a Much Longer Game Than Phishing Does</h2><p><br></p><p>This is where the comparison actually gets useful, because a romance scam looks nothing like phishing once you line them up side by side. Phishing wants a fast reaction, a click and a login within minutes of the message landing. A romance scam is built around weeks or months of genuine-feeling conversation before any request for money ever comes up, and the scammer is playing a patient, relationship-based game rather than trying to catch me off guard in a single moment. The warning signs are completely different too, phishing tells are about urgency and fake login pages, romance scam tells are about a relationship that's moved fast emotionally but has never once happened in person. Treating both as "just phishing" would mean watching for the wrong signal in each case.</p><p><br></p><figure id="figure-j07l1ruibl5mtjq0bn0"><img id="j07l1ruibl5mtjq0bn0" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Phone showing a fake text message beside a laptop, The Difference Between Phishing and Other Scams" src="https://cdn.durable.co/covers/8inEPs1ne1Ks8XrRvFgnfPrJTIoYpVFysQ3peVkoGOzFYNE3VZMLp5SH7If8XZ3g.jpg" alt="Phone showing a fake text message beside a laptop, The Difference Between Phishing and Other Scams" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="null" data-positiony="null" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/8inEPs1ne1Ks8XrRvFgnfPrJTIoYpVFysQ3peVkoGOzFYNE3VZMLp5SH7If8XZ3g.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><p><br></p><h2>Investment Scams Sell a Story, Phishing Sells a Login Page</h2><p>An investment scam doesn't usually try to steal a password at all, it tries to sell me a narrative, a crypto opportunity, a too-good return, a countdown timer creating pressure to commit before the price goes up. There's often no fake login screen involved anywhere in the process, just a persuasive pitch and a payment request straight to a wallet or an account the scammer controls. Where phishing succeeds by impersonating something I already trust, an investment scam succeeds by making something new sound irresistible, and that's a completely different psychological lever being pulled. I've found the most useful question to ask myself is which of those two things is actually happening, am I being asked to log into something that looks familiar, or am I being sold a story about an opportunity that didn't exist yesterday.</p><p><br></p><h2>Why the Defence Against Phishing Doesn't Automatically Cover the Rest</h2><p><br></p><p>None of this is an academic exercise, it changes what I actually do about each one. A password manager and careful attention to login pages genuinely does most of the heavy lifting against phishing specifically, because the whole attack depends on a fake page fooling either me or my software. That same setup does nothing to protect me from a romance scam or an investment pitch, because neither of those ever asks me to log into anything, they ask for trust and then for money directly. I've written before about <a href="https://kellssecurity.com/blog/the-different-kinds-of-cybercriminals-i-ve-learned-to-watch-for" data-mce-href="https://kellssecurity.com/blog/the-different-kinds-of-cybercriminals-i-ve-learned-to-watch-for">the different kinds of people actually running these operations</a>, and understanding which category a message falls into tells me which specific defence is actually relevant, rather than reaching for the same generic caution every time and hoping it covers whatever's actually in front of me.</p><p><br></p><p>Splitting these apart hasn't made me more paranoid, it's done the opposite, because I'm no longer applying one blunt "is this a scam" filter to everything and instead recognising the specific shape each one takes. If you want to know exactly where to report whichever type you've actually run into, <a href="https://kellssecurity.com/blog/where-to-report-a-scam" data-mce-href="https://kellssecurity.com/blog/where-to-report-a-scam">I've covered that separately</a>, and my<a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit"> free Safety Toolkit</a> covers the practical setup I'd recommend having in place against all of them, not just the one that happens to look most like phishing.</p><p><br></p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The Difference Between Phishing and Other Scams

<h2>The Different Online Threats I Actually Plan Around</h2><p>"Cyber threat" gets used as one catch-all phrase so often that it stops meaning very much, a vague cloud of danger somewhere out there online. That vagueness doesn't help anyone actually protect themselves, because a virus, a phishing email, a data breach, stolen identity, and ransomware are genuinely different problems that call for genuinely different responses. I've stopped thinking about "online safety" as one big undifferentiated worry and started thinking about it as five separate, specific things I plan around, each with its own warning signs and its own fix. Breaking it down this way is what actually changed how I protect myself, not another generic reminder to "be careful online."</p><p><br></p><h2>Malware That Doesn't Need You to Click Anything</h2><p><br></p><p>The version of malware most people picture still involves clicking a dodgy attachment or downloading a cracked piece of software, and that version absolutely still exists. What's changed is that a lot of modern malware doesn't need you to actively do anything wrong at all, it can arrive through a vulnerability in software you already trust and never patched, sitting quietly on a device for weeks before you notice anything. That's exactly why I treat software updates as a security task rather than an annoying interruption, and why I run proper antivirus software on every device rather than assuming careful browsing habits alone are enough. The <a href="https://www.ncsc.gov.uk/cyberaware/home" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/cyberaware/home">NCSC </a>publishes plain-English guidance on exactly this kind of basic device hygiene, and it's worth reading properly once rather than picking up habits secondhand. The threat isn't always a mistake you made, sometimes it's just a gap you didn't know was there.</p><p><br></p><h2>Phishing That's Evolved Past the Obvious Fake Email</h2><p><br></p><p>Phishing used to be shorthand for a badly written email claiming to be your bank. That version still lands in inboxes daily, but the more effective versions now arrive as a text about a parcel, a WhatsApp message from a "colleague," or a QR code stuck on a lamppost, and they've largely dropped the spelling mistakes that used to be the easy tell. I've had to retrain my own instincts around this, the specific format matters less to me now than the underlying pattern, an unexpected message creating urgency and pointing me toward a link or a reply. <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass </a>simply won't autofill my login details on a copy of a site that isn't the real one, because it checks the actual address rather than how convincing the page looks, which has caught more than one cleverly disguised attempt for me without any real effort on my part.</p><p><br></p><h2>The Data Breach You Only Hear About Months Later</h2><p><br></p><p>This is the threat category that unsettles me most, because it doesn't involve me making any mistake at all, it happens to a company holding my data, often long before I find out about it. A breach at a retailer, a service I signed up for years ago and forgot about, or even a genuinely well-secured company can still expose my email, password, or personal details, and the gap between the breach happening and me hearing about it can stretch into months. I check <a href="https://haveibeenpwned.com/" target="_blank" rel="noopener" data-mce-href="https://haveibeenpwned.com/">Have I Been Pwned</a> periodically for exactly this reason, entering an email address there tells me whether it's shown up in a known breach, and it's the closest thing I have to an early warning system for a threat I otherwise wouldn't know about until something went wrong downstream. Once I know a password's been exposed, changing it stops being optional.</p><p><br></p><figure id="figure-mvwggzh2a9mtjcvzr9"><img id="mvwggzh2a9mtjcvzr9" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Man smiling as he uses his phone safely, The Different Online Threats I Actually Plan Around" src="https://cdn.durable.co/covers/22JGHvhqAR5zn3MLuxQlQkBE0erI5OO5GkH1wdZLu1DaA6xHoKImht9cHhDDTgyq.jpg" alt="Man smiling as he uses his phone safely, The Different Online Threats I Actually Plan Around" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/22JGHvhqAR5zn3MLuxQlQkBE0erI5OO5GkH1wdZLu1DaA6xHoKImht9cHhDDTgyq.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>Identity Theft That Starts With Information You Gave Away Willingly</h2><p><br></p><p>Identity theft rarely starts with a dramatic hack, it usually starts with small pieces of information I handed over willingly over time, a birthday on a public profile, a pet's name used as a security question answer, a full name and address on a delivery confirmation shared publicly. None of those things feel risky in isolation, which is exactly the problem, someone patient enough can assemble a convincing profile from scraps that were never meant to be a security risk on their own. I've become noticeably stingier about what I post publicly, and I use different, fabricated answers for security questions rather than true ones that could be pieced together from things I've shared elsewhere. The goal isn't paranoia, it's making sure the scraps I do leave behind don't add up to anything useful.</p><p><br></p><h2>Ransomware That Targets Small Businesses, Not Just Big Ones</h2><p><br></p><p>Ransomware headlines tend to focus on major hospitals or big-name companies, which creates a false sense that it's not a threat worth worrying about for a smaller operation. In practice, small businesses are frequently targeted precisely because they're assumed to have weaker defences and are often more willing to pay quickly just to get back up and running, without the legal or IT resources a larger company would have on hand to fight back or negotiate. I back up my own business files somewhere separate from my main working device specifically because of this, not because I expect to be personally targeted, but because a backup is the one thing that makes a ransomware demand irrelevant rather than catastrophic if it ever did happen. I test that backup occasionally too, a backup you've never actually tried restoring from is really just an assumption, and I'd rather find out it works on an ordinary afternoon than discover it doesn't on the one day I actually need it.</p><p><br></p><p>Naming these five threats separately hasn't made me more anxious about being online, it's actually made me calmer, because each one now has a specific response attached to it rather than one big undefined worry sitting in the back of my mind. If you want a closer look at the different kinds of people actually running these operations, I've <a href="https://kellssecurity.com/blog/the-different-kinds-of-cybercriminals-i-ve-learned-to-watch-for" data-mce-href="https://kellssecurity.com/blog/the-different-kinds-of-cybercriminals-i-ve-learned-to-watch-for">written about that separately</a>, and my free <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">Safety Toolkit </a>covers the practical setup I'd recommend having in place against all five of these, not just the one that happens to be in the news this month.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The Different Online Threats I Actually Plan Around

Kells Security Solutions

I teach people around the world how to spot online scams and stay safe on the internet, explained in plain English with no jargon. I cover phishing emails, two-factor authentication, password managers, VPNs and antivirus software, written for people who are not tech experts and want to protect themselves and their families.