Blog

<h2>The Newer Scam Formats I Keep Having to Warn People About</h2><p>Most of the scam advice still floating around online was written for a version of the internet that's already out of date. People know to be suspicious of a dodgy email with bad spelling, or a stranger asking for gift cards, because that advice has been repeated for years. What I keep running into now are formats that didn't really exist in that form a few years ago, and because they're newer, a lot of otherwise careful people haven't built up the same instinct for spotting them yet. None of these are exotic or rare, I see all five regularly, and each one works precisely because it doesn't look like the scam shape people were taught to watch for. I've already gone through the older, more familiar scam patterns separately, this list is specifically the newer formats that don't fit that older mould. For the ones that come up again and again, I've written about <a href="https://kellssecurity.com/blog/the-scams-people-ask-me-about-most-often" data-mce-href="https://kellssecurity.com/blog/the-scams-people-ask-me-about-most-often">the scams people ask me about most often</a>.</p><p><br></p><h2>The QR Code That Replaces a Link Instead of Being One</h2><p><br></p><p>A suspicious link is something most people have learned to hover over or think twice about before clicking. A QR code sidesteps that habit completely, because you can't preview where it leads before you scan it, and it's turned up somewhere that feels completely ordinary, stuck over a parking meter, printed on a fake parking fine, taped to a café table where the real one used to be. Scanning it takes you straight to a convincing payment or login page with no address bar warning you first, because you're already several steps past the point where you'd normally check. I've started treating any QR code in a public physical space with the same suspicion I'd give an unexpected text link, and I check the sticker itself for signs it's been placed over the original before I ever get my phone out.</p><p><br></p><h2>The Job Offer That Pays Before You've Even Interviewed</h2><p><br></p><p>This one catches people specifically because it inverts the usual scam shape, instead of being asked for money, you're offered it. A message arrives about a flexible remote role, often vague on what the actual work involves, and quickly moves to sending you a cheque or transfer to cover "equipment" or a "starter task," with the real goal being that you forward part of it on or use it to buy gift cards before the original payment bounces days later, leaving you liable for the full amount. The tell isn't the salary or the flexibility, plenty of real jobs offer both, it's the sequence, being asked to move money before you've done any actual work or spoken to a real person. I've learned to treat any job offer that starts with a payment rather than an interview as the whole story, regardless of how professional the messaging looks.</p><p><br></p><h2>The Free Trial That's Designed to Be Forgotten</h2><p><br></p><p>Not every scam involves someone actively lying to you in the moment, some are built entirely around what happens after you've stopped paying attention. A free trial that requires full card details upfront, converts automatically into an expensive subscription, and makes cancellation deliberately awkward, a hidden menu, a phone-only cancellation line, a "are you sure" loop, isn't technically illegal in most cases, but it's designed to profit from you forgetting rather than from you choosing to buy anything. I've started setting a calendar reminder the same day I start any free trial, specifically for a day or two before it converts, because relying on my own memory is exactly the weakness this format is built to exploit. I keep a separate <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass </a>identity for every trial signup now, complete with a unique login and password, which makes it far easier to notice when something I signed up for months ago quietly starts charging me. If cancelling is meaningfully harder than signing up was, I take that difficulty itself as the warning sign.</p><p><br></p><h2>The Marketplace Seller Who Asks to Move the Conversation</h2><p><br></p><p>Buying or selling something secondhand online used to mean staying inside whatever platform you started on, but I now regularly see sellers and buyers try to move the conversation to a messaging app almost immediately, often with a plausible-sounding reason attached. Once you're off the original platform, you lose its buyer protection, its dispute process, and any record the platform itself might use to catch a pattern of reports against the same account. I still occasionally get asked to continue "on WhatsApp, it's easier," and I've made it a firm rule to decline and keep everything on the platform's own messaging until the transaction is actually done, because the request to leave is usually the first sign something's about to go wrong rather than a genuine convenience.</p><p><br></p><figure id="figure-dsz9fdujgmtjc2dwp"><img id="dsz9fdujgmtjc2dwp" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Phone showing a fake text message beside a laptop, The Newer Scam Formats I Keep Having to Warn People About" src="https://cdn.durable.co/covers/8inEPs1ne1Ks8XrRvFgnfPrJTIoYpVFysQ3peVkoGOzFYNE3VZMLp5SH7If8XZ3g.jpg" alt="Phone showing a fake text message beside a laptop, The Newer Scam Formats I Keep Having to Warn People About" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/8inEPs1ne1Ks8XrRvFgnfPrJTIoYpVFysQ3peVkoGOzFYNE3VZMLp5SH7If8XZ3g.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>The Charity Appeal That Times Itself to a Real Disaster</h2><p><br></p><p>The cruellest version of this pattern arrives within hours of an actual crisis, a flood, an earthquake, a fire, when people are already primed to want to help and less inclined to slow down and check who they're actually giving to. A fake fundraising page can look identical to a genuine one, complete with a real photo of the real disaster pulled straight from the news, and the urgency of the moment is exactly what's being exploited rather than any flaw in the story itself. I've started giving directly through a charity's own verified website or a platform I already know rather than through a link shared in a message or post, however moving that post is, because verifying takes an extra minute and a genuine cause will still be there once I've done it.</p><p><br></p><p>What ties all five of these together is that none of them look like the scam template most people were taught to recognise, no obviously broken English, no stranger demanding gift cards outright, no email from a prince. They're built around ordinary situations, a parking meter, a job hunt, a free trial, a secondhand sale, a disaster on the news, and they work by fitting into the moment rather than standing out from it. If you want the <a href="https://kellssecurity.com/blog/the-red-flags-i-check-for-no-matter-what-kind-of-scam-i-m-looking-at" data-mce-href="https://kellssecurity.com/blog/the-red-flags-i-check-for-no-matter-what-kind-of-scam-i-m-looking-at">underlying red flags that hold across scam types </a>like these, not just the five formats above, I've written about that separately, and my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">free Safety Toolkit </a>covers the wider habits I'd recommend building regardless of which of these you run into first. If you ever do come across one of these, <a href="https://www.actionfraud.police.uk/" target="_blank" rel="noopener" data-mce-href="https://www.actionfraud.police.uk/">Action Fraud</a> is the right place in the UK to report it.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The Newer Scam Formats I Keep Having to Warn People About

<h2>Where I Actually Report a Scam, Depending on What Kind It Is</h2><p>For a long time my idea of "reporting a scam" was vague, a general sense that somewhere out there was a form I should probably fill in eventually. That vagueness is exactly why so many scams go unreported, the advice to "just report it" doesn't tell you where, and if the where isn't obvious, most people quietly close the tab and move on instead. Once I actually mapped out which channel handles which kind of scam, reporting stopped feeling like a chore and started taking me a couple of minutes, because I already know exactly where each type is supposed to go before I've even finished reading the message.</p><h2>Forwarding a Suspicious Text to 7726</h2><p>This is the one most people in the UK have never used even though it's sitting on their phone right now. Forwarding a spam or scam text message to 7726 sends it straight to your mobile network provider, who use it to identify and block the numbers and short codes behind mass scam campaigns. It costs nothing, takes about ten seconds, and I do it automatically for every fake delivery text or bogus "your account has been suspended" message before I delete it. I used to just delete these and move on, which felt like the responsible thing to do, until I realised deleting silently does nothing to stop the same message reaching everyone else in that campaign. Forwarding it first means my phone contributes to blocking the number, not just protecting me from it.</p><h2>Reporting a Scam Email to the Right Inbox</h2><p>Email scams get a bit more nuanced because where they go depends on what they're impersonating. A general phishing attempt, something pretending to be a bank, a delivery firm, or a well-known brand, is worth reporting to <a href="https://www.reportfraud.police.uk/" target="_blank" rel="noopener" data-mce-href="https://www.reportfraud.police.uk/">Report Fraud</a> (the police service that replaced Action Fraud) if I've actually engaged with it or lost anything, but for the ones I've simply received and spotted, forwarding the raw email to the National Cyber Security Centre's suspicious email service does more good, because it feeds directly into the takedown process for the fake site behind it. I've learned the difference matters, one channel is about investigating an incident that's already affected me, the other is about getting a malicious site pulled down before it catches someone else. Knowing which of the <a href="https://kellssecurity.com/blog/the-different-kinds-of-cybercriminals-i-ve-learned-to-watch-for" data-mce-href="https://kellssecurity.com/blog/the-different-kinds-of-cybercriminals-i-ve-learned-to-watch-for">different kinds of cybercriminals </a>is actually behind a message also shapes which route I take, a mass phishing email gets forwarded and deleted, but anything that looks like a targeted, researched attempt gets a proper report to Report Fraud because there's a specific person or account behind it worth investigating.</p><figure id="figure-m1dhf1kstlmtj9vs6m"><img id="m1dhf1kstlmtj9vs6m" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Worried older man on a suspicious phone call, Where I Report a Scam, Depending on the Kind" src="https://cdn.durable.co/covers/53TSLRnp03hV6RbE3sAyBIrtLB7DB0QpFBjOkVjCSmt9lTxV8mwEZUb7Zr3Wxekr.jpg" alt="Worried older man on a suspicious phone call, Where I Report a Scam, Depending on the Kind" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/53TSLRnp03hV6RbE3sAyBIrtLB7DB0QpFBjOkVjCSmt9lTxV8mwEZUb7Zr3Wxekr.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>Calling My Bank's Fraud Team the Moment Money's Involved</h2><p>The instant any money has actually moved, or I've entered card details somewhere I shouldn't have, reporting to a general body stops being the priority and my bank becomes the first call, not the third or fourth. Every UK bank has a fraud line, and the 159 short number now works as a fast, verified route to your own bank's fraud team without having to hunt for the right digits on a suspicious call or email first. Time matters enormously here, a transaction reported within minutes can sometimes be stopped or reversed, one reported a week later usually can't be. I've also made it a habit to never check my balance or move money over public wifi without a VPN running, <a href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" target="_blank" rel="noopener" data-mce-href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902">NordVPN </a>encrypts that connection regardless of how trustworthy the network looks, which matters most in exactly the moment I'm already dealing with a fraud scare and not thinking as carefully as I normally would.</p><h2>Using the Platform's Own Report Button First</h2><p>For fake listings, cloned social media profiles, and dodgy marketplace sellers, the platform itself is almost always faster than any external body, because it can act immediately by removing content or suspending an account in a way that Report Fraud simply can't. Every major platform, Meta, Google, Amazon, eBay, has its own reporting flow built directly into the listing or profile, and I use that first for anything that's clearly a platform-specific problem rather than a wider criminal operation. I still separately report it to Report Fraud if actual money or personal details were involved, but for a fake shop that's just sitting there scamming browsers, the platform's own removal process protects the next person faster than any other route I know of.</p><h2>Why I Still Report the Ones That Feel Too Small to Matter</h2><p>The message I most often see people skip reporting is the one that feels too minor to bother with, a slightly odd text, a voicemail that hung up when I answered, an email with just enough wrong about it to notice but nothing you'd call a real attempt. I report these anyway, because a single report rarely changes anything on its own, but the pattern across thousands of small reports is exactly what lets networks and platforms spot and block a campaign before it scales up. I've stopped asking myself whether something feels serious enough to be worth ten seconds of my time, and started asking whether it's actually a scam attempt at all, which is a much easier question to answer honestly. If you want the fuller reasoning behind treating every one of these as worth flagging, my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">free Safety Toolkit </a>covers the wider habits I'd recommend building around it, and <a href="https://www.takefive-stopfraud.org.uk/" target="_blank" rel="noopener" data-mce-href="https://www.takefive-stopfraud.org.uk/">Take Five to Stop Fraud</a> is a genuinely useful UK resource for understanding the bigger picture behind why reporting, even the small stuff, actually works.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

Where I Report a Scam, Depending on the Kind

<h2>The Different Kinds of Cybercriminals I've Learned to Watch For</h2><p><br></p><p>For years I thought about online crime as one big blur, a vague sense that "scammers" were out there and I should be careful. That framing never actually helped me spot anything, because the people behind these messages aren't one type of person running one type of operation. Once I started paying attention to who was actually on the other end, patient researcher, mass-message opportunist, professionalised call centre, or someone playing a long relationship game, I got noticeably better at spotting what was coming before it fully landed. These aren't official categories from a textbook, they're just the patterns I've come to recognise in the messages, calls, and situations I deal with regularly.</p><p><br></p><h2>The Opportunist Playing a Numbers Game</h2><p><br></p><p>This is the one most people picture when they hear "scammer," and it's the easiest to spot once you know what you're looking at. The opportunist isn't targeting you specifically, they're sending the same generic message to thousands of people at once and counting on a tiny percentage responding. A fake delivery text, a "your account has been suspended" email, a too-good voucher offer, none of it is personalised because personalising it isn't worth their time at that scale. The tell is almost always genericness dressed up as urgency, a message that could apply to literally anyone, paired with pressure to act immediately. I've stopped treating these as a personal attack and started treating them as background noise, because that's genuinely what they are, spam that happened to land in front of me rather than someone else. One small habit that's caught more than a few of these for me without any real effort on my part, <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass </a>simply won't autofill my login details on a fake copy of a site, because it checks the actual web address rather than how convincing the page looks.</p><p><br></p><h2>The Patient One Who Researches You First</h2><p><br></p><p>This is a different category entirely, and it's the one that actually worries me more. Someone running a targeted approach has looked at your public profile, your job title, who you work with, maybe even a recent post about a project or a holiday, before ever sending that first message. The result doesn't feel generic at all, it feels specific and plausible, referencing a real colleague's name or a real event you actually attended. That specificity is exactly what makes it dangerous, because it borrows the same trust signal that makes a genuine message feel genuine. I've learned that the more tailored something feels, the more worth double-checking it becomes, not less, because tailoring takes effort that only pays off against a real target, not a random one.</p><p><br></p><figure id="figure-kkxfmj6xfmtj8vs1q"><img id="kkxfmj6xfmtj8vs1q" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Laptop on a desk being kept up to date, The Kinds of Cybercriminals I Watch For" src="https://cdn.durable.co/covers/1eIcH0PYPPse9y9EvviBdOBAWMXawnR1P7ap30fM6N8xpR3gsZOa6lpCYxOXYe7d.jpg" alt="Laptop on a desk being kept up to date, The Kinds of Cybercriminals I Watch For" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/1eIcH0PYPPse9y9EvviBdOBAWMXawnR1P7ap30fM6N8xpR3gsZOa6lpCYxOXYe7d.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>The Organised Operation Behind a Single Text Message</h2><p><br></p><p>What surprised me most once I started reading into this properly is how much of what looks like an amateur scam is actually the output of a genuinely organised operation, scripts, shift patterns, escalation paths for when a target pushes back. A convincing bank-fraud call rarely comes from one person freelancing, it comes from a team that has run that exact script hundreds of times and knows precisely how to sound calm, official, and reassuring under pressure. That professionalism is why so many otherwise careful people get caught out, the caller genuinely sounds like they know what they're talking about, because in a narrow sense they do, they've just rehearsed it against real victims before you. Knowing that a call centre be running the show, rather than one chancer, changes how I treat any unexpected call asking me to act fast, whoever it claims to be from.</p><p><br></p><h2>The Long Con Built on a Relationship, Not a Click</h2><p><br></p><p>This is the category that takes the longest to unfold and does the most damage when it works, because it isn't built around one message at all, it's built around weeks or months of genuine-feeling contact before any ask ever appears. A romance approach, a fake investment mentor, a new online friend who happens to know a great opportunity, all of these work by establishing trust slowly enough that the eventual request doesn't feel like a stranger asking for money, it feels like a friend needing help. I've learned that the length of a relationship isn't itself proof of anything, plenty of genuine friendships also take time to build, but a relationship that consistently steers toward money, urgency, or secrecy is worth examining regardless of how long it's been running or how real it's started to feel.</p><p><br></p><h2>Why the Category Matters Less Than What They're Asking For</h2><p><br></p><p>Naming these categories has helped me spot the early signals faster, but I've noticed the actual decision that matters most is always the same regardless of which type I'm dealing with, what is this message or call actually asking me to do. Send money, share a code, click a link, move to a different platform, every category above eventually arrives at some version of that request, and that request is the moment worth pausing on more than any earlier detail about who's asking or how they found me. I still find it useful to think about which category I might be facing, because it shapes how much scrutiny I apply to the early stages, but I don't let correctly identifying the type replace checking the actual ask when it finally arrives. If you want a more detailed breakdown of the actual <a href="https://kellssecurity.com/blog/the-verification-habits-i-rely-on-whenever-i-suspect-an-ai-scam" data-mce-href="https://kellssecurity.com/blog/the-verification-habits-i-rely-on-whenever-i-suspect-an-ai-scam">verification habits I rely on once I suspect something's off</a>, I've written about that process separately, and my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">free Safety Toolkit</a> covers the wider set of practical protections I'd recommend putting in place regardless of which of these you end up facing. If you're ever unsure whether something you've received fits one of these patterns, <a href="https://www.actionfraud.police.uk/" target="_blank" rel="noopener" data-mce-href="https://www.actionfraud.police.uk/">Action Fraud</a> is the right place in the UK to report it and get it looked at properly.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The Kinds of Cybercriminals I Watch For

<h2>The Everyday Safety Signals I Used to Trust Without Question</h2><p>For a long time I navigated the internet using a handful of quick mental shortcuts, a padlock icon here, a familiar name there, a password-protected wifi network somewhere else, and I treated each one as proof that I was safe. None of them are actually proof of anything on their own, and realising that changed how I approach basically every online decision I make now. These aren't the dramatic, obviously-dodgy scenarios everyone already knows to avoid, they're the small everyday signals that feel reassuring but don't actually hold up once you look at what they're really telling you.</p><h2>The Padlock Icon Isn't the Safety Check I Thought It Was</h2><p>I used to treat the little padlock next to a web address as a shorthand for "this site is safe," and for years that felt like a perfectly reasonable rule of thumb. What that padlock actually confirms is that the connection between my browser and the site is encrypted, nothing more. It says nothing about whether the site itself is genuine, well-intentioned, or run by someone trying to steal my card details. Scam sites can get that same padlock just as easily as a legitimate bank can, setting up encryption is a basic, cheap step that any site owner can take regardless of what they're actually doing with the page. Now I treat the padlock as the bare minimum I'd expect from any site, not as a signal of trustworthiness, and I look at the actual web address and the site's behaviour instead.</p><h2>Why "Deleted" Rarely Means Actually Gone</h2><p>I used to assume that once I deleted a message, a photo, or a post, it had genuinely disappeared, and I made decisions based on that assumption more than I'd like to admit. In reality, deleting something from your own view usually just removes it from your own view. Messages can already be screenshotted or forwarded before you delete them, cloud backups can retain a copy you never see, and platforms often keep data in some form for far longer than the delete button implies. I've stopped thinking of "delete" as an undo button and started thinking of it as closer to "hide," which changes what I'm willing to send or post in the first place. If something isn't fine existing somewhere I can't control, I don't send it, because the delete option was never the safety net I assumed it was.</p><h2>A Message From Someone I Know Isn't Automatically Safe</h2><p>This is the one that genuinely unsettled me the first time it clicked, because it undermines a signal I'd trusted my entire life without thinking about it. A message from a contact whose name and photo I recognise feels inherently safe, it's someone I already know, so my guard naturally drops. But an account being compromised doesn't change how it displays to everyone else, it still shows the right name, the right photo, sometimes even the right writing style if the attacker has seen enough of that person's messages. A link or urgent request from a genuine contact's compromised account looks identical to a message from that person, right up until you act on it. I've written separately about the <a href="https://kellssecurity.com/blog/the-verification-habits-i-rely-on-whenever-i-suspect-an-ai-scam" data-mce-href="https://kellssecurity.com/blog/the-verification-habits-i-rely-on-whenever-i-suspect-an-ai-scam">verification habits I actually rely on </a>whenever I suspect something might be an AI-assisted scam, which covers exactly this kind of situation, where the sender looks completely legitimate but the request itself is the actual red flag.</p><h2>A Password on the Wifi Doesn't Mean the Connection Is Private</h2><p>I spent a long time assuming that if a wifi network asked for a password, that password was doing something meaningful to protect my data once I was connected. A password-protected network keeps random strangers off that specific network, but it doesn't necessarily encrypt what I'm doing once I'm on it, and it says nothing at all about who else set up that network or what they can see from their end. Plenty of cafes and hotels hand the same password to every single customer, which makes it barely different from having no password at all in terms of actual privacy between users on that network. Since realising this, I run a VPN automatically any time I connect to a network I don't control, <a href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" target="_blank" rel="noopener" data-mce-href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902">NordVPN </a>encrypts my traffic regardless of what the network itself is or isn't doing, which means the password on the wifi stops being something I have to trust at all.</p><figure id="figure-6bbpxx13c8mtj7okk5"><img id="6bbpxx13c8mtj7okk5" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Man smiling as he uses his phone safely, The Everyday Safety Signals I Used to Trust" src="https://cdn.durable.co/covers/22JGHvhqAR5zn3MLuxQlQkBE0erI5OO5GkH1wdZLu1DaA6xHoKImht9cHhDDTgyq.jpg" alt="Man smiling as he uses his phone safely, The Everyday Safety Signals I Used to Trust" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/22JGHvhqAR5zn3MLuxQlQkBE0erI5OO5GkH1wdZLu1DaA6xHoKImht9cHhDDTgyq.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>The "Nothing to Hide" Mindset That Quietly Backfires</h2><p>I used to brush off a lot of privacy advice with the thought that I don't really have anything worth hiding, so it didn't feel like it applied to me. The problem with that mindset is that it's not really about hiding anything, it's about what someone else can do with information about you once they have it, regardless of how boring or embarrassing you think that information is. Your daily routine, who you bank with, where your kids go to school, none of that is secret exactly, but all of it is useful to someone trying to impersonate you, target you, or build a convincing scam around details that feel too mundane to protect. I stopped asking myself whether I had anything to hide and started asking what someone could actually do with a given piece of information if they had it, which turned out to be a far more useful question.</p><p>Every one of these assumptions felt completely reasonable at the time, which is exactly why they're worth naming individually rather than lumping under one vague idea of "being careful online." A padlock that only proves encryption, a delete button that only hides rather than erases, a familiar name that can belong to a compromised account, a wifi password that protects the network rather than the connection, and a nothing-to-hide mindset that misses the actual point of privacy. None of these require any technical skill to understand once you see past the shortcut, just a willingness to ask what a signal is actually telling you rather than what it feels like it's telling you. I've covered some of the more <a href="https://kellssecurity.com/blog/the-cybersecurity-assumptions-i-still-have-to-talk-people-out-of" data-mce-href="https://kellssecurity.com/blog/the-cybersecurity-assumptions-i-still-have-to-talk-people-out-of">commonly known assumptions </a>separately if you want the wider list alongside these, and if something ever looks off and you want to report it, <a href="https://www.actionfraud.police.uk/" target="_blank" rel="noopener" data-mce-href="https://www.actionfraud.police.uk/">Action Fraud</a> is the right place to flag a scam message or site in the UK. My <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">free Safety Toolkit </a>covers the practical steps I'd recommend for putting all of this into practice.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The Everyday Safety Signals I Used to Trust

<h2>The Method I Actually Use to Build a Password Worth Trusting</h2><p>I spent years following the same password advice everyone gets, mix in a capital letter, throw in a number, add a symbol somewhere, and you're covered. I followed it religiously and still ended up with passwords that were technically complex and practically useless, because I couldn't remember them, so I wrote them down, reused them, or tweaked the same base password slightly for every account. What actually changed things wasn't finding a stricter rule to follow, it was realising the rule itself was outdated. Here's the method I actually use now, and why it looks nothing like the advice I grew up with.</p><p><br></p><h2>Why Length Beats Complexity, Every Time</h2><p><br></p><p>The old advice was built around how humans might guess a password, not how computers actually crack one. A computer trying to break into an account isn't sitting there guessing "Password1!" and variations on it, it's running through enormous numbers of combinations automatically, and what slows that process down more than anything else is simply length. A long password made of ordinary words takes dramatically longer to crack than a short one stuffed with symbols, even though the short one looks more "secure" at a glance. Once I understood that, I stopped trying to make my passwords look complicated and started just making them longer. Sixteen characters minimum is where I sit now for anything that matters, and honestly getting there is easier than squeezing in symbols ever was.</p><p><br></p><h2>The Passphrase Method I Actually Use</h2><p><br></p><p>My actual method is embarrassingly simple once you know it, I string together several unrelated words into one long passphrase rather than trying to construct something dense and cryptic. Something like four random, unconnected words gives you a password that's both far longer and far easier to actually remember than a shorter jumble of characters, because your brain holds onto words better than it holds onto arbitrary strings. The key word there is unrelated, the words can't form a phrase or sentence that makes obvious sense together, since that predictability is exactly what makes a passphrase weaker. I'll throw in a number or a bit of unusual capitalisation somewhere in the mix too, more out of habit than necessity, but the length and randomness of the words themselves is doing almost all the actual work.</p><p><br></p><h2>What I Deliberately Leave Out</h2><p><br></p><p>Just as important as what goes into a password is what I make sure never goes anywhere near one. Names of family members, pets, birthdays, the street I grew up on, anything that shows up in a social media bio or that someone could piece together after ten minutes of looking at my public profile, all of that is off limits completely. This matters more than people think, because a huge number of successful account break-ins don't come from brute-force guessing at all, they come from someone using publicly available personal details to guess or narrow down a password directly. I also avoid any keyboard pattern, anything like a run of adjacent keys, because those get caught by cracking tools just as fast as "password123" does. If a detail is something I'd happily share at a dinner party, it doesn't belong anywhere near a password.</p><p><br></p><figure id="figure-irslhyf386mtj3caf0"><img id="irslhyf386mtj3caf0" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: undefined undefined;" title="Hands typing a password on a laptop keyboard, How I Build a Password Worth Trusting" src="https://cdn.durable.co/covers/11PCbQdJ5YR0KkHpq6N0pKU5PQzrsp1PeimAK6HRNuvSxOJepuJaApoNN98jCFam.jpg" alt="Hands typing a password on a laptop keyboard, How I Build a Password Worth Trusting" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/11PCbQdJ5YR0KkHpq6N0pKU5PQzrsp1PeimAK6HRNuvSxOJepuJaApoNN98jCFam.jpg" data-mce-style="aspect-ratio: 16/9; object-position: undefined undefined;"></figure><h2>Every Account Gets Its Own, No Exceptions</h2><p><br></p><p>This is the rule I was worst at following for years, and it's the one that actually matters most. Reusing even a strong password across multiple accounts means that a single breach anywhere, and it doesn't even have to be your fault, turns into a breach everywhere that password was used. I only really started taking this seriously once I accepted that memorising a genuinely unique passphrase for every single account I own simply isn't realistic, which is what finally pushed me toward using a password manager rather than my own memory as the storage system. <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass </a>generates and stores a properly unique passphrase for every account automatically, which means the "every account gets its own" rule stops being a discipline problem and just becomes the default. I've written separately about <a href="https://kellssecurity.com/blog/how-id-choose-a-password-manager-if-i-were-starting-today" data-mce-href="https://kellssecurity.com/blog/how-id-choose-a-password-manager-if-i-were-starting-today">what I actually look for when choosing a password manager</a>, which covers how I picked the one I use now.</p><p><br></p><h2>How I Check a Password Actually Holds Up</h2><p><br></p><p>Once I've built a password I'm happy with, I don't just trust that it's strong and move on, I actually check it. Most password managers, including the one I use, will flag a password as weak, reused, or old the moment you create or update it, which catches mistakes before they ever become a real problem. I also periodically check whether any of my existing passwords have <a href="https://kellssecurity.com/blog/the-safety-check-in-i-run-on-my-own-accounts-every-few-months" data-mce-href="https://kellssecurity.com/blog/the-safety-check-in-i-run-on-my-own-accounts-every-few-months">shown up in a known data breach</a>, since a password can be perfectly strong and still become compromised if the service holding it gets breached, at which point strength stops mattering entirely and changing it becomes urgent. Treating password strength as something to check rather than something to assume has caught more than one password I thought was fine but genuinely wasn't.</p><p><br></p><p>None of this requires remembering complicated rules or forcing yourself to type out a string of symbols you'll immediately forget, four unrelated words strung together, nothing personal or guessable mixed in, a unique one for every single account, and an occasional check to make sure it's actually holding up. That's the whole method, and it's held up far better for me than anything I was doing under the old capital-letter-and-symbol advice. The <a href="https://www.ncsc.gov.uk/cyberaware/home" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/cyberaware/home">NCSC </a>actually recommends this exact three-random-words approach as official UK guidance now, which is reassuring if you're wondering whether "just use ordinary words" can really be the secure option. If you want help putting the rest of your account security in order once your passwords are sorted, my<a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit"> free Safety Toolkit </a>covers what I'd recommend next.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

How I Build a Password Worth Trusting

<h2>The Safety Check-In I Run on My Own Accounts Every Few Months</h2><p>I don't believe in a one-time cybersecurity setup that you configure once and then forget about forever. Threats change, apps you signed up for years ago quietly keep access you forgot you gave them, and breach databases grow every week whether you're paying attention or not. So every few months I sit down and run the same short check-in on my own accounts, not because I think something's wrong, but because catching a small problem early is a lot less painful than discovering it after it's already caused damage. Here's exactly what that check-in looks like.</p><h2>Checking Have I Been Pwned and Other Breach Trackers</h2><p>The first thing I do is run my main email addresses through Have I Been Pwned, a free service that tracks which known data breaches have exposed which email addresses. It takes about thirty seconds per address and tells me immediately if any account tied to that email showed up in a breach I might not have heard about. Most of the time nothing new comes up, and that's fine, the point isn't to expect bad news every time, it's to make sure I'd actually know if there was any. When something does show up, I immediately change the password on whichever account was breached, and I check whether I reused that password anywhere else, which is exactly the kind of thing a periodic check catches that you'd otherwise miss for months. I'd rather spend thirty seconds finding out on my own schedule than find out because something's already gone wrong.</p><h2>Reviewing Which Apps Still Have Access to My Accounts</h2><p>Every time you click "Sign in with Google" or "Continue with Facebook" on some app or website, you're granting that third party ongoing access to parts of your account, and most people never look at that list again after the day they granted it. I go into my Google, Microsoft, and social media account settings every few months and look specifically at the connected apps and third-party access lists. It's genuinely surprising how many things accumulate there, a fitness app from three years ago, a one-time event registration tool, a browser extension I installed for a single project and never uninstalled. I revoke access for anything I don't actively recognise or use, because every one of those connections is a potential way into my account that has nothing to do with how strong my actual password is. This is one of the parts of digital housekeeping that genuinely nobody thinks to do until they're specifically prompted to, which is exactly why I've built it into a recurring check rather than relying on remembering.</p><h2>Making Sure My Recovery Details Are Actually Up to Date</h2><p>Recovery phone numbers and backup email addresses are the thing that saves you when you're locked out of an account, and they're also the thing people update least often, because you only think about them in the moment you desperately need them to already be correct. I check that the phone number and backup email on my most important accounts, email, banking, password manager, are still ones I actually have access to, not an old number tied to a contract I cancelled two years ago or an email address I stopped checking. I've heard from more than one person who got locked out of an account permanently because their recovery phone number belonged to someone else by the time they needed it, since old numbers get recycled and reassigned. This is a boring five-minute check that has an outsized effect on how bad a worst-case scenario actually turns out to be.</p><figure id="figure-xj1us9udyamtj123li"><img id="xj1us9udyamtj123li" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: undefined undefined;" title="Man working at a desk with online safety in mind, The Safety Check-In I Run on My Accounts" src="https://cdn.durable.co/covers/4IoZLwzEazYn5vx7hOa2BVriIWr70ma5OwxhttLbWrDsOynBuSFRKZ3fDy3HrhLt.jpg" alt="Man working at a desk with online safety in mind, The Safety Check-In I Run on My Accounts" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/4IoZLwzEazYn5vx7hOa2BVriIWr70ma5OwxhttLbWrDsOynBuSFRKZ3fDy3HrhLt.jpg" data-mce-style="aspect-ratio: 16/9; object-position: undefined undefined;"></figure><h2>Looking at What's Logged Into My Accounts From Where</h2><p>Most major platforms, email providers, banking apps, social media, have a section showing active sessions or logged-in devices, and I make a point of actually looking at it during my check-in rather than assuming it would look normal if I glanced at it. What I'm looking for is anything I don't recognise, a login location I've never been to, a device type I don't own, a session that's been active for far longer than makes sense. Finding nothing unusual is the expected and hoped-for outcome, but the value of the check is that if something IS there, I catch it during a routine look rather than by accident weeks later. I sign out of anything I don't recognise immediately and change the password on that account as a precaution, treating an unfamiliar session as a real signal rather than something to shrug off.</p><h2>Deciding What's Worth Fixing Now vs Later</h2><p>Not everything this check-in surfaces needs to be fixed immediately, and I've learned to actually triage rather than either ignoring everything or panicking about all of it equally. An old app with account access I don't recognise gets revoked straight away, it costs nothing to remove and there's no reason to leave it. A password that showed up in a breach gets changed immediately, no exceptions. But something like updating my recovery phone number on a low-priority account I barely use might genuinely wait until my next check-in a few months later, because not every finding carries the same urgency, and treating minor housekeeping with the same alarm as an active breach just trains you to tune the whole process out over time. The goal of this check-in isn't perfection, it's making sure nothing sits unnoticed indefinitely.</p><p>None of this takes more than about twenty minutes every few months, and it's genuinely one of the habits I'd recommend most, precisely because it catches the kind of slow, quiet problems that never announce themselves, an old app with access you forgot about, a breached password you never changed, a recovery number that's gone stale. I've written separately about<a href="https://kellssecurity.com/blog/the-order-id-actually-fix-my-digital-security-in" data-mce-href="https://kellssecurity.com/blog/the-order-id-actually-fix-my-digital-security-in"> the order I'd actually work through fixing your wider digital security in </a>if you're starting from scratch, which pairs well with this as an ongoing maintenance habit once the initial setup is done. If you want a reliable way to make sure your passwords are also getting checked against new breaches automatically rather than only when you remember to look, <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass </a>has built-in breach monitoring that does a version of this first step continuously in the background, and my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">free Safety Toolkit </a>covers the rest of what I'd recommend if you want to build the whole habit properly. The <a href="https://www.ncsc.gov.uk/" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/">NCSC </a>publishes its own guidance on keeping accounts secure that's worth reading alongside whatever check-in routine you settle on.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The Safety Check-In I Run on My Accounts

Kells Security Solutions

I teach people around the world how to spot online scams and stay safe on the internet, explained in plain English with no jargon. I cover phishing emails, two-factor authentication, password managers, VPNs and antivirus software, written for people who are not tech experts and want to protect themselves and their families.