Blog

Organized secure metal key storage vault with labeled brass keys in individual protected compartments

<h2>Why These Five Come First</h2><p>If you sat down with me for a coffee and asked where to even start with all this online safety stuff, I wouldn't hand you a fifty point checklist. I'd give you five things. In fifteen-odd years of watching people get caught out (and getting caught out myself once, years before I knew any better), it's always the same five gaps that let the scammers and the hackers in. Sort these five and you've shut the door on most of what's out there. Leave them and you're propping that door open with a brick.</p><p><br></p><p>I work with people right across Liverpool, from Aigburth to Anfield, Woolton to Walton, and the story is nearly always the same. Nobody thinks it'll happen to them until it does. So let's get ahead of it, properly, starting today. If you want the full story of how I ended up doing this work, you'll find it on my <a data-mce-href="../about" href="../about">About page</a>.</p><p><br></p><h2>Fix One: Get a Password Manager Sorted</h2><p><br></p><p>This is the one people roll their eyes at most, and it's the one that stops the most damage. If you're using the same two or three passwords for everything, your email, your bank, your Tesco Clubcard, one leaked password from some website you've long forgotten about becomes a master key to your entire life.</p><p><br></p><p>A password manager does the remembering for you. You set one strong master password, and it generates and stores a completely different, properly complicated password for every account you own. I use <a data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener">NordPass </a>myself and I point nearly every client toward it, mainly because it's simple enough that even my least tech-confident clients actually stick with it once it's set up. There's a free trial if you want to see whether it suits you before you commit to anything.</p><p><br></p><p>Ten minutes of setup. Then you never have to remember a password again, and neither does a scammer.</p><p><br></p><h2>Fix Two: Switch On Two-Factor Authentication</h2><p><br></p><p>Two-factor authentication is the second lock on your front door. Even if someone gets hold of your password, they still can't get in without the code that lands on your phone at the same moment they try. It's the single biggest thing I tell every client to switch on, no exceptions, and I'd start with your email and your banking app before anything else.</p><p><br></p><p>Most banks and email providers have this built in already and just need you to turn it on in your account settings. It adds about four seconds to your morning login routine. Compare that to the months of hassle a compromised bank account causes, and it's not really a decision.</p><p><br></p><p>If you want a full walkthrough on spotting the phishing messages that try to trick you into handing over these codes in the first place, I've written a separate piece on <a data-mce-href="../blog/the-phishing-scams-i-see-catching-liverpool-people-out" href="../blog/the-phishing-scams-i-see-catching-liverpool-people-out">the phishing scams I see catching Liverpool people out </a>that's worth a read alongside this one.</p><figure id="figure-e11o7yrx1cmtb3bosl"><img id="e11o7yrx1cmtb3bosl" src="https://rjdavx8ozyznxeyh.public.blob.vercel-storage.com/production/websites/infinite-images/c3385bf0-b80b-4b94-bb66-c74e7fe9d9a5-6ehX2NV2mKCNMx7GgSASykCXS16FTm.png" alt="Close-up macro saClose-up of a computer mouse and keyboard, representing the everyday login habits behind two-factor authentication and account securityhot of computer keyboard and mouse showing detailed textures and materials" title="Close-up macro saClose-up of a computer mouse and keyboard, representing the everyday login habits behind two-factor authentication and account securityhot of computer keyboard and mouse showing detailed textures and materials" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionX="undefined" data-positionY="undefined" data-fullWidth="false"/></figure><p><br></p><h2>Fix Three: Stop Ignoring Your Updates</h2><p><br></p><p>That little red notification badge on your phone or laptop telling you an update is available isn't nagging you for no reason. Most updates exist specifically to patch security holes that hackers already know about and are actively using. Every time you tap remind me tomorrow, you're leaving that hole open for one more day.</p><p><br></p><p>I know updates feel like they always arrive at the worst possible moment, usually right as you're trying to leave the house. Set your phone and computer to update overnight instead, and you'll barely notice it happening. It's one of the quietest, easiest fixes on this whole list, and one of the most skipped.</p><p><br></p><h2>Fix Four: Tighten Up Your Social Media Privacy</h2><p><br></p><p>Scammers don't need to hack you if you've already told them everything on Facebook. Your pet's name, your mum's maiden name, your kids' school, your holiday dates, all of it sits there in plain view for anyone doing their homework before a targeted scam or a bit of old-fashioned burglary planning.</p><p><br></p><p>Go into your privacy settings on whichever platforms you use and lock your profile down to friends only. Turn off public location tagging. And have a proper think about whether that quiz asking for your first pet's name is really just for fun, because that's a classic security question in disguise.</p><p><br></p><h2>Fix Five: Secure Your Wi-Fi and Any Public Connections You Use</h2><p><br></p><p>Your home Wi-Fi should have a strong password and the default router login changed from admin. If you've never touched your router settings since your provider installed it, that's worth an afternoon sorting. Which? has a solid<a data-mce-href="https://www.which.co.uk/reviews/wireless-routers/article/how-to-set-up-a-router-a2Yow4v0Bthy" href="https://www.which.co.uk/reviews/wireless-routers/article/how-to-set-up-a-router-a2Yow4v0Bthy" target="_blank" rel="noopener"> step-by-step guide</a> if you're not sure how.</p><p><br></p><p>Public Wi-Fi in Liverpool ONE, your local café, or the train down to Lime Street is a different matter entirely. Anyone on that same network can, with the right tools, see what you're doing. A VPN encrypts your connection so what you're browsing stays private even on networks you don't control. I use <a data-mce-href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" target="_blank" rel="noopener">NordVPN </a>when I'm out and about and recommend it to clients who travel a lot or work from cafés regularly.</p><p><br></p><h2>None of This Has to Happen Overnight</h2><p><br></p><p>Pick one fix this week. Then another next week. Within five weeks you'll have closed every major gap I see catching people out across this city, and you'll sleep a lot easier for it.</p><p><br></p><p>If you'd rather not do it alone, that's exactly what I'm here for. Have a browse through my <a data-mce-href="../safety-toolkit" href="../safety-toolkit">Safety Toolkit </a>for the tools I recommend, or <a data-mce-href="../contact" href="../contact">get in touch </a>and I'll walk through your specific situation with you, no jargon, no judgement, just straight answers from someone who's seen it all before.</p><p><br></p><p>And if you ever do get caught out despite everything, report it to <a data-mce-href="https://www.actionfraud.police.uk/" href="https://www.actionfraud.police.uk/" target="_blank" rel="noopener">Action Fraud </a>straight away. The sooner it's reported, the better the chance of stopping it happening to someone else too.</p>

The Five Security Fixes I'd Make First in Your Position

Overhead view of artfully arranged wrapped gifts and decorative items on retail display table with warm natural lighting

<p>Every December I watch the same pattern play out. People who are perfectly careful online for eleven months of the year suddenly relax their guard in the run up to Christmas, and the scammers know it better than anyone. They know you're tired, you're rushing, you've got a dozen people to buy for and only three weeks to do it in, and a "50% off, ends tonight" pop-up looks a lot more tempting when you're stood in the queue at Tesco trying to remember if your nephew already has that Lego set.</p><p>I'm not writing this to make you paranoid about your Christmas shopping. I'm writing it because a few small habits make the difference between a stress-free December and one spent on the phone to your bank on Boxing Day. I've covered <a data-mce-href="../blog/the-online-shopping-scams-i-warn-liverpool-shoppers-about" href="../blog/the-online-shopping-scams-i-warn-liverpool-shoppers-about">the broader range of shopping scams I see year-round </a>separately, this one's specifically about the ways December trips people up.</p><p><br data-mce-bogus="1"></p><h2>The Deals That Are Too Good to Be True</h2><p><br data-mce-bogus="1"></p><p>If you see a big-name gadget or the trainers everyone wants this year going for a third of the normal price on a website you've never heard of, that's not luck, that's bait. Genuine retailers rarely discount their most in-demand stock that heavily, especially close to Christmas when demand is at its peak.</p><p><br data-mce-bogus="1"></p><p>Before you buy from any site you don't already know, check the web address carefully, look for reviews outside the site itself since its own five-star reviews prove nothing, and search the company name alongside the word scam before you hand over your card details. Thirty seconds of checking has saved more than one of my clients a very unhappy Christmas morning.</p><p><br data-mce-bogus="1"></p><h2>Watch Out for Copycat Websites</h2><p><br data-mce-bogus="1"></p><p>Scammers build near-perfect copies of well-known shops, right down to the logo and the layout, and buy a web address that's one letter off the real thing. You place your order, get a confirmation email that looks legitimate, and then nothing arrives, because there was never any stock to send in the first place.</p><p><br data-mce-bogus="1"></p><p>The safest habit is to type the retailer's address in yourself rather than clicking through from an ad or a social media post. Citizens Advice has a good <a data-mce-href="https://www.citizensadvice.org.uk/consumer/scams/scams/spot-a-scam-website/" href="https://www.citizensadvice.org.uk/consumer/scams/scams/spot-a-scam-website/" target="_blank" rel="noopener">guide on spotting a fake online shop </a>if you want a second opinion before you buy.</p><p><br data-mce-bogus="1"></p><h2>Gift Cards Are the Scammer's Favourite Trick</h2><p><br data-mce-bogus="1"></p><p>If anyone, and I mean anyone, ever asks you to pay for something in gift cards, whether it's a shop, a delivery fee, a family member in trouble over text, or a prize you've supposedly won, stop immediately. No legitimate company or organisation asks to be paid in Amazon or iTunes vouchers. It's one of the clearest scam signals there is, and it works because gift card payments are almost impossible to trace or reverse once they're spent.</p><p><br data-mce-bogus="1"></p><h2>Keep Your Payments Safe While You're Out and About</h2><figure id="figure-715myoqvzmtb74hax"><img id="715myoqvzmtb74hax" src="https://rjdavx8ozyznxeyh.public.blob.vercel-storage.com/production/websites/infinite-images/fad250c4-dcc4-4435-8694-7947b2ccb71c-QyMOUXNbMWbfpVO0sRIzNvjV8tyepu.png" alt="Close-up of hands wrapping a bouquet with ribbon, representing the care worth taking when buying gifts safely this Christmas in Liverpool" title="Close-up of hands wrapping a bouquet with ribbon, representing the care worth taking when buying gifts safely this Christmas in Liverpool" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionX="undefined" data-positionY="undefined" data-fullWidth="false"/></figure><p>Christmas market stalls, the last-minute dash round Liverpool ONE, using the free wifi in a café while you finish an order on your lunch break, all of it adds up to more of your card details and browsing being exposed to networks you don't control than at any other time of year. A VPN encrypts your connection wherever you're shopping from, which matters more in December than any other month. I use <a data-mce-href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" target="_blank" rel="noopener">NordVPN </a>myself when I'm out shopping and recommend it to clients doing the same.</p><p><br data-mce-bogus="1"></p><p>It's also worth using a password manager for any new shopping accounts you set up this time of year rather than reusing an old password, since a breach at one retailer can otherwise open the door to everything else you own. I use <a data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener">NordPass </a>and it takes the thinking out of it completely.</p><p><br data-mce-bogus="1"></p><h2>My Own December Shopping Routine</h2><p><br data-mce-bogus="1"></p><p>I keep it simple. I shop from retailers I already know and trust wherever I can. I pay by card rather than bank transfer so I've got some protection if something goes wrong. I don't click links in unexpected delivery texts, not even the convincing ones, because that's a <a data-mce-href="../blog/the-phishing-scams-i-see-catching-liverpool-people-out" href="../blog/the-phishing-scams-i-see-catching-liverpool-people-out">scam I've written about separately </a>and it catches more people than almost anything else this time of year. And I check my bank statement more often in December than any other month, simply because there's more going through it.</p><p><br data-mce-bogus="1"></p><h2>If Something Does Go Wrong</h2><p><br data-mce-bogus="1"></p><p>If you've handed over card details to a fake site or paid for something that never arrived, contact your bank immediately. They can often stop or reverse a payment if you're quick. Report it to <a data-mce-href="https://www.actionfraud.police.uk/" href="https://www.actionfraud.police.uk/" target="_blank" rel="noopener">Action Fraud </a>too, so what happened to you doesn't happen to the next person.</p><p><br data-mce-bogus="1"></p><p>If you'd like a hand getting your accounts properly locked down before the Christmas rush starts, have a look at my <a data-mce-href="../safety-toolkit" href="../safety-toolkit">Safety Toolkit</a>, or <a data-mce-href="../contact" href="../contact">get in touch </a>and I'll talk you through it.</p>

The Christmas Shopping Scams I See Every December in Liverpool

Two business professionals in blazers shaking hands in office meeting setting

<h2>Why I Wanted to Tell These Stories</h2><p>I get asked a lot whether any of this cybersecurity advice actually works in the real world, or whether it just sounds good on a website. So instead of another list of tips, I want to tell you about a few Liverpool businesses I've worked with who put the basics into practice and it genuinely saved them. Names and a few details are changed for privacy, but the situations are real, and the lessons are exactly what happened.</p><p><br></p><h2>The Café That Caught a Scam Before It Cost Them a Penny</h2><p>A small café owner in the city centre got an email that looked like it came from her regular coffee supplier, asking her to update the bank details for the next invoice payment. It was well written, it used the supplier's actual logo, and it landed at a busy time on a Friday afternoon when she had every reason to just click through and get it done. She'd been through a short session with me a few months earlier where we talked about exactly this kind of scam, so instead of paying, she rang the supplier directly using the number on a previous paper invoice. The supplier had no idea what she was talking about. That thirty second phone call saved her over two thousand pounds. It wasn't clever software that caught it. It was one habit, done at the right moment.</p><p><br></p><h2>The Small Agency That Backed Up Everything (And Meant It)</h2><p>A small marketing agency I know got hit with ransomware through a compromised email attachment. Their screens locked up, a ransom note appeared, and for about ten minutes the owner told me his stomach dropped through the floor. But because they'd set up an automatic daily backup to a separate cloud account months earlier, and actually tested it (which most people skip), they didn't pay a penny. They wiped the affected machines, restored from that morning's backup, and were back working by the next day. The attackers had nothing to hold over them, because the thing they were threatening to destroy was already safely copied somewhere else.</p><figure id="figure-o4nhiniz1mtbbcwhx"><img id="o4nhiniz1mtbbcwhx" src="https://rjdavx8ozyznxeyh.public.blob.vercel-storage.com/production/websites/infinite-images/c44c738a-0f15-424e-a1cb-2c6115235a08-IwQVNObsFz7psbTqPZ7ttOiijeYzFK.png" alt="Close-up of a hand signing a business agreement document with a fountain pen, representing the kind of tested recovery plan that helped a Liverpool business bounce back after a ransomware attack" title="Close-up of a hand signing a business agreement document with a fountain pen, representing the kind of tested recovery plan that helped a Liverpool business bounce back after a ransomware attack" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: undefined undefined;" data-corners="default" data-aspect="16:9" data-caption="" data-positionX="undefined" data-positionY="undefined" data-fullWidth="false"/></figure><p><br></p><h2>What These Businesses Actually Have in Common</h2><p>Neither of these businesses had a dedicated IT department or a huge security budget. What they had was a habit they'd actually built into how they work, not just a policy sitting in a folder nobody reads. The café owner had practised the "verify before you pay" habit until it was automatic. The agency had tested their backups, not just switched them on and forgotten about them. In both cases, the thing that saved them wasn't expensive. It was consistent.</p><p><br></p><h2>What You Can Borrow From Their Playbook</h2><p>You don't need their exact setup to get the same protection. Start with a password manager like <a data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener">NordPass </a>so you're not reusing the same login across every account your business relies on, and pair it with two factor authentication wherever you can turn it on. If your team ever works from cafés, hotels, or shared offices, a VPN like <a data-mce-href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" target="_blank" rel="noopener">NordVPN </a>is worth having on every device that connects to public wifi. And if you want a fuller walkthrough of where to start, I've written a proper <a data-mce-href="../blog/cybersecurity-buyers-guide-for-liverpool-businesses" href="../blog/cybersecurity-buyers-guide-for-liverpool-businesses">buyer's guide to cybersecurity for Liverpool businesses </a>that goes through this step by step, alongside a separate piece on <a data-mce-href="../blog/protecting-small-businesses-in-liverpool--cybersecurity-strategies-and-tips" href="../blog/protecting-small-businesses-in-liverpool--cybersecurity-strategies-and-tips">protecting small businesses in Liverpool </a>that covers training your team without boring them senseless. If you'd rather talk it through than read another article, my <a data-mce-href="../safety-toolkit" href="../safety-toolkit">Safety Toolkit </a>has the tools I actually recommend, and you're always welcome to <a data-mce-href="../contact" href="../contact">get in touch </a>if you want a second pair of eyes on your setup.</p>

The Liverpool Businesses I've Seen Beat a Cyber Attack

Magnifying glass examining detailed financial documents and accounting figures

<h2>Why These Myths Refuse to Die</h2><p>I hear the same handful of myths again and again, from people who are switched on about most things and still repeat advice that stopped being true years ago, if it ever was. I've written before about the <a data-mce-href="../blog/cyber-safety-myths-liverpool" href="../blog/cyber-safety-myths-liverpool">classic myths around antivirus and passwords</a>, but this time I want to tackle a different batch, the ones that catch out otherwise careful people. None of these myths came from nowhere. They usually started as something reasonable, then got stretched past the point of being useful. The trouble is they make people feel safer than they actually are, and that gap is exactly where scammers do their best work.</p><p><br data-mce-bogus="1"></p><h2>Myth: Scammers Are Easy to Spot by Their Bad English</h2><p><br data-mce-bogus="1"></p><p>This one used to hold up. A lot of it doesn't any more. AI tools have sorted out the spelling mistakes and dodgy grammar that used to give a scam email away in the first line, so a badly written message is only one clue among many now, not proof either way on its own. I've seen phishing emails that read better than some of my own drafts, if I'm honest. What still gives them away is more subtle, an odd sense of urgency, a request that doesn't quite match how the organisation normally contacts you, a link that goes somewhere slightly off when you hover over it. I've written before about the <a data-mce-href="../blog/spot-phishing-emails-liverpool" href="../blog/spot-phishing-emails-liverpool">exact red flags I check </a>on every message that lands in my inbox.</p><p><br data-mce-bogus="1"></p><h2>Myth: My Bank Will Always Refund Me If I'm Scammed</h2><p><br data-mce-bogus="1"></p><p>Banks do refund a lot of fraud cases now under the newer reimbursement rules, and that's genuinely good news for anyone who gets caught out. But "always" is doing a lot of heavy lifting in that sentence. If you authorised the payment yourself, even because you were tricked into it, the bank can still investigate whether you took reasonable care before deciding to refund you, and that's a judgement call that doesn't always go your way. The <a data-mce-href="https://www.financial-ombudsman.org.uk/" href="https://www.financial-ombudsman.org.uk/" target="_blank" rel="noopener">Financial Ombudsman Service </a>publishes decisions on exactly this kind of dispute, and reading a few of them was enough to convince me I'd rather not find out the hard way where that line sits. I still treat every payment like it's final the second I send it.</p><figure id="figure-gh10she8nkmtbcfoar"><img id="gh10she8nkmtbcfoar" src="https://rjdavx8ozyznxeyh.public.blob.vercel-storage.com/production/websites/infinite-images/6485f4a0-c24d-4c88-bf80-ef0a84d97193-ugNSTru1OAP7roLjobnS9W6F2MRxep.png" alt="Vintage typewriter and stack of old papers, representing outdated online safety advice that still gets repeated today" title="Vintage typewriter and stack of old papers, representing outdated online safety advice that still gets repeated today" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionX="undefined" data-positionY="undefined" data-fullWidth="false"/></figure><p><br data-mce-bogus="1"></p><h2>Myth: iPhones and Macs Don't Get Hit by Scams</h2><p><br data-mce-bogus="1"></p><p>Apple devices are genuinely good at blocking traditional viruses, and that's where this myth comes from. But most of what catches people out now isn't a virus at all, it's a scam text, a fake login page, a phishing email asking you to verify your Apple ID. None of that cares what phone you're holding. I know several people on iPhones who've had their Apple ID phished in the last year alone, which is its own kind of expensive problem given how much banking and photo history usually lives behind it. <a data-mce-href="../blog/two-factor-authentication-liverpool" href="../blog/two-factor-authentication-liverpool">Two factor authentication </a>and a proper password manager close most of that gap regardless of which phone is in your pocket.</p><p><br data-mce-bogus="1"></p><h2>What Actually Keeps You Safer Than Any Myth</h2><p><br data-mce-bogus="1"></p><p>None of these myths are stupid, they're just out of date, and the fix isn't panic, it's a handful of boring habits done consistently. A password manager so you're not reusing the same password everywhere, I use <a data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener">NordPass </a>myself and recommend it to almost everyone I talk to. Two factor authentication switched on for anything that matters. And a healthy pause before you click, type, or pay anything you weren't expecting five minutes ago. If you want the fuller list I actually use myself, I've put it together on my <a data-mce-href="../toolkit" href="../toolkit">Safety Toolkit </a>page, and if something doesn't sit right, <a data-mce-href="../contact" href="../contact">get in touch </a>and I'll have a look with you.</p>

The Online Safety Myths I Wish Would Finally Disappear

Close-up of hand writing detailed notes on premium paper with course material visible on screen behind

<p>I get asked "how do I actually turn this on?" almost every week, so here's the honest walkthrough I'd give you if we were sat at your kitchen table with your phone in hand.</p><h2>Why I'm Writing This as an Actual Tutorial</h2><p><br data-mce-bogus="1"></p><p>I've written before about <a data-mce-href="https://kellssecurity.com/blog/two-factor-authentication-liverpool" href="https://kellssecurity.com/blog/two-factor-authentication-liverpool">why I treat two factor authentication as non-negotiable</a>, and I still stand by every word of that one. But knowing you should do something and knowing how to actually do it are two very different things, and I don't think enough people bridge that gap for their clients. This post skips the persuading and gets straight to the clicking. Grab your phone, get comfortable, and let's go through it properly, one account at a time.</p><p><br data-mce-bogus="1"></p><h2>Setting Up 2FA on Your Email Account</h2><p><br data-mce-bogus="1"></p><p>Your email is the master key to almost everything else you own online, so it's the first account I secure for every client I work with. In Gmail, go to your Google Account, select Security, then look for 2-Step Verification and follow the prompts. It'll ask for your phone number first, then offer you the option to switch to an authenticator app, which I always recommend over text messages since texts can be intercepted. Outlook works almost the same way: Account, Security, Advanced security options, then Two-step verification. The whole thing takes about three minutes and you only have to do it once.</p><p><br data-mce-bogus="1"></p><h2>Setting Up 2FA on Your Banking App</h2><p><br data-mce-bogus="1"></p><p>Most UK banking apps have this built in already and switch it on automatically the moment you install them, which is one of the few times I'll happily say the bank knows best. If yours doesn't, open the app, head to Settings or Security, and look for anything called two factor, two step, or biometric login. Turn on Face ID or fingerprint login too if it's offered, it's another layer that costs you nothing and takes half a second each time you log in.</p><p><br data-mce-bogus="1"></p><h2>Setting Up 2FA on Social Media</h2><p><br data-mce-bogus="1"></p><p>Facebook, Instagram, and X all bury this setting in slightly different places, but the route is roughly the same: Settings, then Security and Login (or Privacy and Security), then Two-Factor Authentication. Pick the authenticator app option where you can, it's more reliable than SMS and doesn't rely on you having signal. I switched every one of my own accounts over years ago and honestly forgot it was even switched on until a login attempt from somewhere I'd never been got blocked without me lifting a finger.</p><figure id="figure-3ir9hrnou5mtbgero0"><img id="3ir9hrnou5mtbgero0" src="https://rjdavx8ozyznxeyh.public.blob.vercel-storage.com/production/websites/infinite-images/6297dcc4-bc9a-4bbf-b255-75207bbd7a29-m2xRoouG2kMdKK25kObLQx4IAqK4V3.png" alt="Hand filing a labelled binder of backup codes on a shelf, representing the printed backup codes worth keeping safe in case you lose your phone" title="Hand filing a labelled binder of backup codes on a shelf, representing the printed backup codes worth keeping safe in case you lose your phone" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionX="undefined" data-positionY="undefined" data-fullWidth="false"/></figure><p><br data-mce-bogus="1"></p><h2>What to Do If You Lose Your Phone</h2><p><br data-mce-bogus="1"></p><p>This is the bit people worry about most, and fair enough. Before you switch anything on, write down or print the backup codes every service gives you during setup and keep them somewhere safe, not in your phone's notes app. I keep mine in <a data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener">NordPass</a>, the password manager I use and recommend to every client, since it works even if my phone is at the bottom of the Mersey. If you do lose your phone, most services let you verify a new device through your email or by answering a security question, so having that email account locked down properly matters more here than anywhere else.</p><p><br data-mce-bogus="1"></p><p>If any of this feels fiddly the first time, that's completely normal, and I'd rather you found it fiddly for five minutes than found out the hard way why it matters. The <a data-mce-href="https://www.ncsc.gov.uk/" href="https://www.ncsc.gov.uk/" target="_blank" rel="noopener">National Cyber Security Centre</a> backs up everything I've said here too, if you fancy the official version alongside mine. For a proper hand held walkthrough of everything on your accounts,<a data-mce-href="https://kellssecurity.com/blog/digital-safety-checkup-liverpool" href="https://kellssecurity.com/blog/digital-safety-checkup-liverpool"> my digital safety check-up </a>is a good place to start, and I've put together a full <a data-mce-href="https://kellssecurity.com/safety-toolkit" href="https://kellssecurity.com/safety-toolkit">safety toolkit</a> with the password manager and VPN I actually use myself. If you'd rather just ask me directly, <a data-mce-href="https://kellssecurity.com/contact" href="https://kellssecurity.com/contact">get in touch</a> and I'll talk you through it.</p>

The Step-By-Step Way I Set Up Two-Factor Authentication for Clients

Overhead view of writing desk with fountain pens, ink bottle, quality papers, and open notebook arranged artfully in natural light

<p>Every week someone in Liverpool tells me they know they should be using a password manager, and then asks me which one to get. It is a fair question, and it is usually where people stall. There are dozens of them, the marketing all sounds the same, and a lot of the "best password manager" lists online are written by people paid per click rather than people who have set these things up for real families. So rather than hand you a ranked list, I want to show you how I actually decide. Once you understand the criteria, you can choose the right one for your life and stop worrying that you have picked wrong.</p><h2>Start With How You Actually Live Online</h2><p>Before looking at a single product, I ask people three questions. How many devices do you use in a normal week? Does anyone else need access to some of your logins? And what happens to your accounts if something happens to you?</p><p>The answers change the recommendation completely. A retired gentleman in Aigburth who uses one iPad and nothing else needs something very different from a couple in Woolton juggling two phones, a shared laptop, a work machine and a teenager who keeps borrowing the tablet. If you and your partner both need the electricity account login, sharing matters more than any feature on the box. If you are the only person who knows how to get into the family email, emergency access matters more than price.</p><p>Write your answers down before you start comparing. Most people end up with the wrong tool because they compared features before anyone asked them about their own situation.</p><h2>The Five Things I Check Before Anything Else</h2><p>When I look at a password manager, I check the same five things every time.</p><figure id="figure-xhxrzzgpvemtc1fpf6"><img id="xhxrzzgpvemtc1fpf6" src="https://rjdavx8ozyznxeyh.public.blob.vercel-storage.com/production/websites/infinite-images/619718a2-0d6e-4ba1-954d-db933dec4d5d-jmGVOeukvvs6iD2qS3axBy4NEsXdtu.png" alt="Bank of secure deposit boxes representing a password manager vault for Liverpool households" title="Bank of secure deposit boxes representing a password manager vault for Liverpool households" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://rjdavx8ozyznxeyh.public.blob.vercel-storage.com/production/websites/infinite-images/619718a2-0d6e-4ba1-954d-db933dec4d5d-jmGVOeukvvs6iD2qS3axBy4NEsXdtu.png" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><p>First, does it work everywhere you are? If it does not have a proper app on your phone and an extension in the browser you actually use, you will stop using it within a fortnight. Convenience is not a luxury here, it is the whole point.</p><p>Second, is the encryption done on your device rather than on their servers? The phrase to look for is zero knowledge. It means the company cannot read your passwords even if they wanted to, and it means a breach of their systems does not hand a criminal your bank login.</p><p>Third, can you get your data back out? Any manager worth using lets you export everything to a plain file. If a company makes leaving difficult, that tells you something about how they see you.</p><p>Fourth, is there proper emergency or family access? This is the feature people never think about and always end up needing. Being able to nominate someone who can reach your accounts after a set delay has saved more than one family I have worked with a great deal of grief.</p><p>Fifth, has the company been independently audited, and did they say anything when they had a problem? Every large provider will eventually have an incident. What matters is whether they published it quickly and in plain English. I have looked closely at <a data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener">NordPass </a>on this front and it holds up well, which is why it sits in my toolkit rather than a dozen alternatives.</p><h2>What I Ignore in the Marketing</h2><p>Plenty of what gets shouted about on pricing pages makes no practical difference to an ordinary household.</p><p>Military grade encryption is a phrase with no technical meaning. Almost everything reputable uses the same underlying standard, so it tells you nothing about which product is better.</p><p>Unlimited password storage sounds generous until you realise nobody has ever hit a sensible limit. The average person I sit down with has somewhere between eighty and two hundred logins.</p><p>Dark web monitoring is the one I get asked about most. It is a nice extra, not a reason to choose. Being told your email turned up in a breach is only useful if you then change the password, and a good manager helps you do that whether or not it sent you the alert.</p><p>Bundled VPNs thrown into a password subscription are usually the weakest version of that company's product. If you want a VPN, choose one on its own merits. That is why I point people to <a data-mce-href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" target="_blank" rel="noopener">NordVPN </a>separately rather than treating it as a freebie.</p><h2>Free, Paid, or the One Built Into Your Browser</h2><p>The managers built into Chrome, Safari and Edge have improved enormously, and if the honest choice is between using one of those and carrying on with the <a data-mce-href="https://kellssecurity.com/blog/password-manager-vs-memory-liverpool" href="https://kellssecurity.com/blog/password-manager-vs-memory-liverpool">same password everywhere</a>, use the browser one today. It is a genuine improvement over what most people are doing.</p><p>The catch is that they tie you to one ecosystem. Move from an iPhone to an Android handset, or use Chrome at home and Edge at work, and things get awkward fast. They also tend to have thin sharing and recovery options, which brings us back to those questions at the start.</p><p>Free standalone plans are a reasonable middle step, but read what is limited. Some cap the number of devices, which quietly defeats the purpose. Paid plans usually run somewhere between two and four pounds a month, and family plans covering five or six people often cost barely more than a single licence. If more than one person in the house needs this, the family plan is almost always the better value.</p><h2>How to Move In Without Losing a Weekend</h2><p>The biggest reason people abandon this is that they try to fix all two hundred logins in one sitting, get halfway, and give up.</p><p>Do it the slow way instead. Install the manager and set a long master password you can actually remember. A short phrase of three or four unrelated words beats a jumble of symbols, and the <a data-mce-href="https://www.ncsc.gov.uk" href="https://www.ncsc.gov.uk" target="_blank" rel="noopener">National Cyber Security Centre </a>has said as much for years. Turn on two factor authentication for the manager itself before you put anything in it, because that vault is now the most valuable thing you own online.</p><p>Then change nothing. Just let it save logins as you use them over the next month. Once it has captured your regular accounts, sit down for twenty minutes and update the important handful properly: email first, then banking, then anything holding a saved card. Email comes first because whoever controls your inbox can reset everything else.</p><p>That is the whole method. Answer the three questions, check the five things, ignore the noise, and move in gradually. If you would rather talk it through with someone before you commit to anything, <a data-mce-href="https://kellssecurity.com/contact" href="https://kellssecurity.com/contact" data-mce-selected="inline-boundary">get in touch</a> and I will happily walk you through it.</p>

Blog

The Five Security Fixes I'd Make First in Your Position

The Christmas Shopping Scams I See Every December in Live...

The Liverpool Businesses I've Seen Beat a Cyber Attack

The Online Safety Myths I Wish Would Finally Disappear

The Step-By-Step Way I Set Up Two-Factor Authentication f...

How I'd Choose a Password Manager If I Were Starting Today