Blog

<h2>The Red Flags I Check For No Matter What Kind of Scam I'm Looking At</h2><p>People often ask me to list every scam doing the rounds right now, as if memorising the current crop is what actually keeps you safe. It isn't, because the specific story changes constantly, a courier text this month, a fake investment opportunity the next, a cloned voice call after that. What doesn't change nearly as much is the small set of underlying signals that show up across almost all of them. I've stopped trying to keep a mental list of every scam format and started checking for these five things instead, whatever the message claims to be about.</p><h2>Urgency Is Almost Always the First Tell</h2><p>Genuine organisations very rarely need you to act in the next ten minutes. Banks, delivery companies, government departments, they all have processes that unfold over hours or days, not immediate deadlines enforced through a single text or call. Scams lean on urgency specifically because it short-circuits the part of your brain that would otherwise stop and check things properly. The moment I notice a message pushing me to act right now, verify immediately, respond within the hour or lose the opportunity, that urgency itself becomes the red flag, regardless of what the message is actually asking me to do. I've trained myself to treat manufactured urgency as information rather than instruction, it's telling me to slow down, not speed up.</p><h2>A Request to Move Off the Original Platform</h2><p>A huge number of scams involve steering you away from wherever the conversation started, off a marketplace's messaging system and onto WhatsApp, off a company's official app and onto a phone call, off a social platform and onto email. Legitimate businesses generally want you to stay inside their own systems, partly for their own record-keeping and partly because it's safer for everyone. When something tries to move the conversation somewhere less monitored, less traceable, or somewhere I can't easily verify who I'm actually talking to, that's a deliberate choice on the scammer's part, not an innocent inconvenience. I've started treating any unprompted request to switch platforms mid-conversation as a reason to pause and reconsider the whole interaction, not just the platform switch itself.</p><h2>Being Asked to Pay in a Way That Can't Be Reversed</h2><p>This is possibly the single most reliable signal I've found, and it cuts across almost every scam category I've come across. Bank transfers, gift cards, cryptocurrency, these payment methods all share one property that makes them attractive to scammers specifically, once the money's gone, it's essentially gone. Legitimate transactions overwhelmingly happen through cards or established payment processors that come with dispute processes and buyer protections built in. If I'm ever asked to pay through a method that offers no way back once I've sent it, particularly gift cards, which have become a strangely common request across totally unrelated scam types, I treat that as close to a guarantee that something's wrong. I've written separately about <a href="https://kellssecurity.com/blog/the-checkout-red-flags-i-check-before-i-enter-my-card-details" data-mce-href="https://kellssecurity.com/blog/the-checkout-red-flags-i-check-before-i-enter-my-card-details">the checkout-specific red flags I look for </a>when I'm actually buying something, which goes into more detail on the payment side specifically.</p><figure id="figure-s6f8uv540gmtj093j3"><img id="s6f8uv540gmtj093j3" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Phone showing a fake text message beside a laptop, The Red Flags I Check For in Every Kind of Scam" src="https://cdn.durable.co/covers/8inEPs1ne1Ks8XrRvFgnfPrJTIoYpVFysQ3peVkoGOzFYNE3VZMLp5SH7If8XZ3g.jpg" alt="Phone showing a fake text message beside a laptop, The Red Flags I Check For in Every Kind of Scam" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/8inEPs1ne1Ks8XrRvFgnfPrJTIoYpVFysQ3peVkoGOzFYNE3VZMLp5SH7If8XZ3g.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>Details That Are Almost Right But Not Quite</h2><p>Scammers have gotten considerably better at getting the broad strokes right, a bank's actual logo, a courier company's actual branding, even a colleague's actual name. Where things still tend to slip is in the specifics, a sender address that's close to but not quite the real domain, a reference number that doesn't match the format your actual bank uses, a name spelled slightly differently than the person you know spells it. I've stopped assuming that a professional-looking message is automatically legitimate, because professional-looking is now trivially easy to fake. What I actually check is whether the small, specific details line up with what I already know to be true, not whether the overall impression feels convincing. A scam can look completely polished and still fall apart the moment you check one concrete detail against something you can independently verify.</p><h2>Why I Still Pause Even When Something Passes Every Check</h2><p>Here's the part I think matters most and gets skipped most often, even when a message passes all four checks above, I still give myself a moment before acting on anything involving money, personal details, or account access. Scammers adapt to whatever checklist becomes common knowledge, which means a list like this one has a shelf life, and something sophisticated enough might eventually get past all five signals I've just described. The actual habit that protects me isn't the checklist itself, it's the pause it forces, the deliberate gap between receiving a message and acting on it, during which I can verify independently, contact the organisation through a channel I looked up myself rather than one they provided, or simply sleep on it. I've found that pause does more work than any individual red flag, because it gives every other check a chance to actually happen instead of getting skipped under pressure.</p><p>None of these signals are complicated, and none of them require any technical knowledge to spot, urgency that doesn't match how the real organisation actually operates, a push to move off the original platform, a payment method that can't be reversed, details that are almost but not quite right, and giving myself a pause before acting regardless of how convincing everything else seems. I'd rather rely on five patterns that hold up across almost any scam than try to memorise the specific story doing the rounds this week, because the story will have changed again by the time I've learned it. I also keep <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass </a>running across every account I have, so if one of these checks somehow fails, a single compromised login doesn't cascade into everything else I own. If you want a second, independent source on what to watch for, <a href="https://www.actionfraud.police.uk/" target="_blank" rel="noopener" data-mce-href="https://www.actionfraud.police.uk/">Action Fraud</a> tracks current scam patterns across the UK, and my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">free Safety Toolkit</a> covers the rest of what I'd recommend if you want to get your own defences properly in order.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The Red Flags I Check For in Every Kind of Scam

<h2>How I Actually Decide What Cybersecurity Setup Someone Needs</h2><p>People ask me constantly what the best cybersecurity setup is, and they usually want one answer that applies to everyone. There isn't one. A retired couple checking email twice a day needs something completely different from a freelancer juggling five client logins, and both need something different again from a small business handling customer payment details. The mistake I see most often isn't using bad tools, it's using the wrong tools for the actual situation. Here's how I actually work through that decision when someone asks me for a recommendation.</p><p><br></p><h2>Start With What You're Actually Protecting</h2><p><br></p><p>Before I recommend anything, I ask what's actually at stake if something goes wrong. Personal email and social media accounts carry a different risk than a laptop full of client contracts, which carries a different risk again than a business handling other people's payment data. This isn't about being dramatic, it's about proportionality. Someone whose biggest exposure is a compromised Instagram account doesn't need the same setup as someone who'd be legally and financially on the hook for a customer data breach. I've had people ask me for the best security software when what they actually needed was a password manager and two-factor authentication turned on, nothing more elaborate than that. Matching the response to the actual exposure is the first decision, and it's the one people skip most often because it's more interesting to talk about tools than to think about what you're actually defending.</p><p><br></p><h2>The Difference Between a DIY Toolkit and a Managed Service</h2><p><br></p><p>Once I know what's at stake, the next question is whether someone wants to manage their own security or have someone else handle it. A DIY toolkit means picking your own pieces, a password manager like <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass</a>, a VPN like <a href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" target="_blank" rel="noopener" data-mce-href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902">NordVPN</a>, antivirus software like <a href="https://www.bitdefender.com/en-us/consumer/?irclickid=WxSzmdWRXxyZWsOzKNx6sWZFUkrxGHQpm0ekVY0&amp;im_rewards=&amp;irgwc=1&amp;afsrc=1&amp;MPid=6273270&amp;cid=aff|c|IR|Cyber%20Jay" target="_blank" rel="noopener" data-mce-href="https://www.bitdefender.com/en-us/consumer/?irclickid=WxSzmdWRXxyZWsOzKNx6sWZFUkrxGHQpm0ekVY0&amp;im_rewards=&amp;irgwc=1&amp;afsrc=1&amp;MPid=6273270&amp;cid=aff|c|IR|Cyber%20Jay">Bitdefender</a>, and knowing how to keep them updated and configured properly yourself. It's cheaper and gives you more control, but it only works if you'll actually maintain it. I've written separately about <a href="https://kellssecurity.com/blog/how-i-actually-compare-antivirus-software" data-mce-href="https://kellssecurity.com/blog/how-i-actually-compare-antivirus-software">how I actually compare antivirus software </a>if you're building this route yourself and want to know what to look for beyond the marketing claims. A managed service means paying someone, whether that's an IT provider or a dedicated security company, to handle monitoring and updates for you. It costs more but removes the maintenance burden entirely. Neither option is inherently better, they solve different problems, and the honest answer to which one you need usually comes down to whether you'll actually keep a DIY setup maintained or whether it'll quietly go stale within a few months.</p><p><br></p><h2>How Much Technical Comfort You Actually Have Matters</h2><p><br></p><p>I try to be honest with people about this one, because it's the factor that gets glossed over the most. If the idea of configuring a firewall or reading a software update changelog makes your eyes glaze over, recommending a fully DIY toolkit isn't doing you any favours, even if it's technically the cheaper option. A setup you won't maintain properly is worse than a simpler setup you'll actually keep up with. I've seen people buy genuinely excellent security software and then never update it, never check its settings, and effectively get none of the protection they paid for. If that sounds familiar, the honest recommendation is usually something closer to a managed service or at minimum tools with strong default settings and minimal ongoing configuration, rather than a stack of individually excellent tools that need constant attention to actually work.</p><p><br></p><figure id="figure-58zkj0itwpmtiz5vuh"><img id="58zkj0itwpmtiz5vuh" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Man smiling as he uses his phone safely, How I Decide What Cybersecurity Setup You Need" src="https://cdn.durable.co/covers/22JGHvhqAR5zn3MLuxQlQkBE0erI5OO5GkH1wdZLu1DaA6xHoKImht9cHhDDTgyq.jpg" alt="Man smiling as he uses his phone safely, How I Decide What Cybersecurity Setup You Need" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/22JGHvhqAR5zn3MLuxQlQkBE0erI5OO5GkH1wdZLu1DaA6xHoKImht9cHhDDTgyq.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>Free Tools Are a Starting Point, Not the Whole Answer</h2><p><br></p><p>A lot of people ask me whether free security tools are good enough, and the honest answer is that they're a reasonable starting point but rarely the complete answer. Free antivirus, free VPN tiers, and built-in browser protections cover real ground and are genuinely better than nothing. Where they tend to fall short is in the details, weaker encryption standards on free VPNs, limited device coverage on free password managers, and slower response to new threats on free antivirus compared to paid tiers that fund more active threat research. I don't think everyone needs to pay for everything, but I do think it's worth being honest about where the free version stops being enough for what you're actually protecting. If you're just browsing casually with nothing sensitive at stake, free tools might genuinely be fine. If you're handling financial logins or client data, the gap between free and paid starts to matter more than the price difference suggests.</p><p><br></p><h2>When It's Worth Paying for a Managed Provider</h2><p><br></p><p>The point where I usually recommend bringing in outside help is when the complexity outgrows what one person can reasonably keep on top of alone, multiple staff members, several devices, sensitive customer data, or simply not having the time to stay on top of updates and monitoring yourself. That's not a failure of the DIY approach, it's just a different scale of problem. If you're at that point, I've written separately about the <a href="https://kellssecurity.com/blog/the-questions-i-d-ask-before-hiring-any-cybersecurity-company" data-mce-href="https://kellssecurity.com/blog/the-questions-i-d-ask-before-hiring-any-cybersecurity-company">questions I'd ask before hiring any cybersecurity compan</a>y, which covers how to actually vet a provider rather than just picking whoever pitches the hardest. The goal either way is the same, proportional protection for what you're actually defending, not the most impressive-sounding setup you can find.</p><p><br></p><p>There's no universal best cybersecurity solution, only the one that actually matches what you're protecting, how hands-on you want to be, and how reliably you'll keep it maintained. Get honest about those three things first, and the right setup usually becomes obvious rather than something you need to research endlessly. If you want a second, independent source on getting the basics right before deciding on any of this, the <a href="https://www.ncsc.gov.uk/cyberaware/home" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/cyberaware/home">NCSC </a>publishes its own guidance for individuals and small businesses, and my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">free Safety Toolkit </a>covers the rest of what I'd recommend if you want to work through your own setup properly.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

How I Decide What Cybersecurity Setup You Need

<h2>The Phishing Report Habit I Never Skip</h2><p>I used to think reporting a phishing email was optional, something worth doing if I had a spare minute, but mostly a step I could skip once I'd deleted the thing and moved on. I don't think that anymore. Reporting is the one part of dealing with a phishing email that actually helps anyone beyond me, and it takes under a minute once it's a habit rather than a decision. Here's exactly what I do, every time, and why each step matters more than it looks. If you want the whole routine in one place, I've written up <a href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything" data-mce-href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything">how to spot a phishing email</a> before you click anything.</p><p><br></p><h2>Why I Report Even When I Didn't Click Anything</h2><p><br></p><p>The instinct to just delete a phishing email and move on makes sense, nothing happened to me, so why bother. But reporting isn't really about protecting yourself after the fact, it's about the next person who gets the same email and isn't as quick to spot it. When enough people report the same phishing campaign, email providers and blocklist services can identify and block it faster for everyone else still receiving it, sometimes within hours of a campaign first going out. I think of reporting as roughly equivalent to picking up litter, it doesn't undo anything that's already happened, but it stops the next person from stepping in it. Deleting alone protects nobody but me for the five seconds it takes, and it leaves the exact same message sitting in someone else's inbox with nothing standing between them and whatever it's trying to get them to do.</p><p><br></p><h2>The Exact Button I Use in My Email Client</h2><p><br></p><p>Most major email providers now have a dedicated "Report phishing" option, separate from the regular spam button, and it makes a real difference which one you use. In Gmail it's under the three-dot menu on an open email, labelled specifically "Report phishing" rather than just "Report spam". Outlook has an equivalent "Report" button in the ribbon with a phishing-specific option. The distinction matters because reporting something as phishing feeds it into a different, more urgent review process than a generic spam report, since phishing carries actual fraud risk rather than just being unwanted marketing. I make a habit of using the specific phishing option whenever it's available rather than defaulting to the general spam button out of convenience. It usually takes one extra click over just hitting delete, and that single click is the difference between a message that vanishes from my inbox and one that actively feeds a system built to catch the next copy of it before it lands somewhere else.</p><p><br></p><h2>Forwarding to the UK's Reporting Service</h2><p><br></p><p>Beyond my email provider's own button, I also forward genuinely suspicious phishing emails to <a href="mailto:report@phishing.gov.uk" data-mce-href="mailto:report@phishing.gov.uk">report@phishing.gov.uk</a>, the UK's <a href="https://www.ncsc.gov.uk/cyberaware/home" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/cyberaware/home">National Cyber Security Centre</a>'s dedicated reporting address, run in partnership with the police. It takes seconds, just forward the email as an attachment where possible rather than as a plain forward, since that preserves the original headers investigators actually need. This is separate from your email provider's own systems and feeds a different pool of intelligence used to get phishing sites taken down and flagged more broadly. I treat this as the one extra step worth taking for anything that looks like a genuinely convincing attempt, rather than an obvious low-effort spam blast that any filter would have caught anyway.</p><p><br></p><figure id="figure-hsjxstq7vdmtiybp51"><img id="hsjxstq7vdmtiybp51" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: undefined undefined;" title="Phone showing a fake text message beside a laptop, The Phishing Report Habit I Never Skip" src="https://cdn.durable.co/covers/8inEPs1ne1Ks8XrRvFgnfPrJTIoYpVFysQ3peVkoGOzFYNE3VZMLp5SH7If8XZ3g.jpg" alt="Phone showing a fake text message beside a laptop, The Phishing Report Habit I Never Skip" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/8inEPs1ne1Ks8XrRvFgnfPrJTIoYpVFysQ3peVkoGOzFYNE3VZMLp5SH7If8XZ3g.jpg" data-mce-style="aspect-ratio: 16/9; object-position: undefined undefined;"></figure><h2>What I Do Beyond Just Reporting</h2><p><br></p><p>Reporting through the proper channels is the most useful step, but I also do two smaller things immediately afterward. First, I block the sender, which stops that specific address from reaching me again even if the message somehow slipped past filters once. Second, if the email impersonated someone I actually know, a colleague, a family member, a company I use, I mention it to them directly, since it means their name or brand is being used in an active campaign they might not know about. I've had a couple of instances where mentioning this to a small business owner whose brand was being spoofed was genuinely new information to them, and worth the thirty seconds it took to flag it. In both cases they hadn't heard a word about it until I mentioned it, which tells me plenty of impersonated senders never find out at all unless someone specifically tells them.</p><p><br></p><h2>When Reporting Isn't Enough</h2><p><br></p><p>Reporting handles the message itself, but if you've actually clicked a link, entered any details, or opened an attachment, reporting the email is only the first of several steps rather than the whole response. That situation needs its own separate response, changing any passwords that might be affected, checking account activity, and potentially reporting the incident itself rather than just the email that started it. I've written separately about <a href="https://kellssecurity.com/blog/what-actually-happens-when-you-report-a-scam" data-mce-href="https://kellssecurity.com/blog/what-actually-happens-when-you-report-a-scam">what actually happens once you report an incident like that </a>and why I still bother even when it feels like nothing will come of it, which covers what comes after this stage if you've gone beyond just receiving a suspicious message.</p><p><br></p><p>None of these steps take long individually, and together they take less time than most people spend deciding whether an email is worth worrying about in the first place. Using the specific phishing report option in your email client, forwarding genuinely convincing attempts to the NCSC's reporting address, blocking the sender, warning anyone being impersonated, and knowing when reporting the email is just the first step rather than the whole response, that's the full habit, and it costs almost nothing once it's automatic. I run <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass </a>across my accounts specifically so a phishing attempt that does slip through doesn't cascade into every login I own, and my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">free Safety Toolkit </a>covers the rest of what I'd recommend if you want to build up the rest of your defences properly.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The Phishing Report Habit I Never Skip

<h2>The Questions I'd Ask Before Hiring Any Cybersecurity Company</h2><p>I get asked fairly often how a business owner with no technical background is supposed to tell a genuinely good cybersecurity provider from one that's mostly good at selling. It's a fair question, because the marketing on both sides tends to look identical, confident language, impressive-sounding certifications, a slide with a padlock on it. What actually separates a provider worth paying from one that isn't shows up in how they answer a handful of specific questions, not in how polished their pitch is. These are the five I'd ask before signing anything. If you're at the choosing stage, I've written a full guide on <a href="https://kellssecurity.com/blog/how-id-choose-a-cybersecurity-company" data-mce-href="https://kellssecurity.com/blog/how-id-choose-a-cybersecurity-company">how to choose a cybersecurity company</a>.</p><h2>Do They Explain Things in Plain English or Just Sell Fear</h2><p>The first thing I pay attention to isn't what a provider says, it's how they say it. A good one can explain your actual exposure in terms you'd understand without a technical background, this is the risk, here's roughly what it would cost you if it happened, here's what we'd do about it. A provider leaning on fear alone, vague warnings about hackers, scary statistics with no context, urgency to sign today, is usually selling a feeling rather than a service. I've sat in enough of these conversations to notice that the providers who are actually good at the work tend to be the calmest in the room, because they don't need drama to make their case. If a pitch leaves you more frightened than informed, that's telling you something about the provider, not about your actual risk level.</p><h2>What Happens After the Contract Is Signed</h2><p>This is the question that separates a genuine ongoing partner from a one-off vendor, and it's the one people forget to ask until it's too late. Some providers do a single audit, hand you a report, and disappear until renewal time. Others treat the relationship as continuous, monitoring, regular check-ins, updates as your business and the threat landscape both change. Neither model is automatically wrong, but you need to know which one you're buying before you sign, because a business that assumed ongoing support and got a one-time report is going to be badly caught out the first time something goes wrong six months later. I ask providers directly to walk me through what a normal month looks like after onboarding, not just what the initial engagement includes.</p><h2>Can They Show Me Real Client Outcomes, Not Just Logos</h2><p>Almost every provider's website has a row of client logos, and almost none of them tell you anything useful. What I actually want to hear is a specific, if necessarily anonymised, example, we caught this kind of attempt for a client in your sector, here's roughly what we found in an audit, here's how we responded when something did get through. A provider who can only speak in generalities about their own track record, "we help businesses stay secure", without ever getting concrete, hasn't necessarily done anything wrong, but it makes it much harder to judge whether their experience actually matches your situation. I'd rather hear one detailed, honest example of something that didn't go perfectly than a wall of logos and five-star testimonials that could belong to any provider in the industry.</p><figure id="figure-zbjn179ynmtixl58d"><img id="zbjn179ynmtixl58d" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Man working at a desk with online safety in mind, Questions I'd Ask Before Hiring a Cybersecurity Company" src="https://cdn.durable.co/covers/4IoZLwzEazYn5vx7hOa2BVriIWr70ma5OwxhttLbWrDsOynBuSFRKZ3fDy3HrhLt.jpg" alt="Man working at a desk with online safety in mind, Questions I'd Ask Before Hiring a Cybersecurity Company" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/4IoZLwzEazYn5vx7hOa2BVriIWr70ma5OwxhttLbWrDsOynBuSFRKZ3fDy3HrhLt.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>Do They Push One Product or Actually Assess My Risk First</h2><p>This is the one I consider closest to a genuine red flag. A provider who recommends a specific product or package before they've properly understood your business, what data you hold, how your team actually works, what your existing setup looks like, is selling you something off a shelf rather than solving your actual problem. The better ones start with an assessment, sometimes a paid one, before recommending anything specific, because a ten-person accountancy firm and a fifty-person logistics company have almost nothing in common in terms of what they actually need protecting. If a sales call moves straight to pricing tiers without any real questions about your business first, that's usually the pattern repeating itself, and it's worth being cautious about what you're actually being sold.</p><h2>What's Included When Something Goes Wrong</h2><p>No provider can promise nothing will ever happen, and I'm always slightly more wary of one that implies otherwise. What matters more is what's actually included in your contract if something does get through, incident response, who you can call and how quickly, what the escalation process looks like, and whether that's part of your existing fee or a separate cost you'll be quoted for under pressure at the worst possible moment. I ask this question directly and expect a direct answer, not a vague reassurance that they'll "be there for you." A provider who's thought this through in advance, and can tell you plainly what's covered, is showing you they've actually planned for the scenario they're being hired to prevent.</p><p>None of these five questions require any technical knowledge to ask, and the answers you get back tell you far more than any brochure or sales pitch will. How they explain risk, what ongoing support actually looks like, whether they can speak concretely about real outcomes, whether they assess before they sell, and what's covered when something goes wrong, that's the real picture of what you're buying, well before you get anywhere near a contract. I've written separately about <a href="https://kellssecurity.com/blog/the-five-security-fixes-i-d-make-first-in-your-position" data-mce-href="https://kellssecurity.com/blog/the-five-security-fixes-i-d-make-first-in-your-position">the five security fixes I'd make first </a>regardless of which provider you end up choosing, and about <a href="https://www.bitdefender.com/en-us/consumer/?irclickid=WxSzmdWRXxyZWsOzKNx6sWZFUkrxGHQpm0ekVY0&amp;im_rewards=&amp;irgwc=1&amp;afsrc=1&amp;MPid=6273270&amp;cid=aff|c|IR|Cyber%20Jay" target="_blank" rel="noopener" data-mce-href="https://www.bitdefender.com/en-us/consumer/?irclickid=WxSzmdWRXxyZWsOzKNx6sWZFUkrxGHQpm0ekVY0&amp;im_rewards=&amp;irgwc=1&amp;afsrc=1&amp;MPid=6273270&amp;cid=aff|c|IR|Cyber%20Jay">the antivirus software I've actually ended up trusting on my own devices </a>if you're comparing options at the product level too. If you want a second, independent source on vetting a provider, the <a href="https://www.ncsc.gov.uk/cyberaware/home" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/cyberaware/home">NCSC </a>publishes its own guidance for small businesses, and my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">free Safety Toolkit </a>covers the rest of what I'd recommend if you want to get your own basics in order first.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

Questions I'd Ask Before Hiring a Cybersecurity Company

<h2>The Cybersecurity Assumptions I Still Have to Talk People Out Of</h2><p>Most of the cybersecurity myths I hear these days aren't the obvious ones anymore. People have generally caught up on "don't click suspicious links" and "use a password manager." What I still run into constantly are quieter assumptions, ideas that sound reasonable enough that nobody thinks to question them, right up until they cause a real problem. These five are the ones I find myself talking people out of most often, and each one is more load-bearing than it looks. I've also rounded up <a href="https://kellssecurity.com/blog/the-online-safety-myths-i-wish-would-finally-disappear" data-mce-href="https://kellssecurity.com/blog/the-online-safety-myths-i-wish-would-finally-disappear">the online safety myths I wish would finally disappear</a> in one place, if you want the full list.</p><h2>I'm Too Small a Target for Anyone to Bother With</h2><p>This is the assumption I hear most from individuals and small business owners alike, and it comes from picturing a hacker as someone deliberately choosing to target you personally. That's not how most attacks work. The vast majority are automated, scanning huge ranges of addresses and accounts for known weaknesses, with no idea or interest in who's on the other end until something responds. Your data has value regardless of how interesting you think your life is, an email account can be used to reset other accounts, a small business's customer list can be sold, a home network's processing power can be quietly borrowed for something else entirely. I've seen this assumption do real damage precisely because it stops people from taking basic precautions they'd otherwise consider obvious. Scale doesn't protect you here, it just means you're one target among millions rather than one target among thousands, and the automation doesn't care about the difference.</p><h2>A Strong Password Alone Is All the Protection I Need</h2><p>A genuinely strong, unique password is a good foundation, but I still meet people who treat it as the entire security strategy rather than one layer of it. The problem is that a password can be compromised in ways that have nothing to do with how strong it is, through a data breach at a company you trusted, through a phishing page convincing enough that you typed it in yourself, through malware quietly logging your keystrokes. None of those scenarios care how many symbols or how much length your password had. Two-factor authentication is what actually catches you when the password itself fails, because it means a stolen password alone isn't enough to get in. I treat a strong password as step one of two, never as the whole job, and I'd rather have a slightly weaker password with 2FA turned on than a brilliant password without it.</p><figure id="figure-om67j0c16dmtiwx2cv"><img id="om67j0c16dmtiwx2cv" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Laptop on a desk being kept up to date, The Cybersecurity Assumptions I Talk People Out Of" src="https://cdn.durable.co/covers/1eIcH0PYPPse9y9EvviBdOBAWMXawnR1P7ap30fM6N8xpR3gsZOa6lpCYxOXYe7d.jpg" alt="Laptop on a desk being kept up to date, The Cybersecurity Assumptions I Talk People Out Of" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/1eIcH0PYPPse9y9EvviBdOBAWMXawnR1P7ap30fM6N8xpR3gsZOa6lpCYxOXYe7d.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>I'd Notice Straight Away If I'd Been Hacked</h2><p>This one comes from imagining a hack the way it's shown in films, a locked screen, a ransom note, something dramatic and immediate. Most real compromises are quiet on purpose. Someone who gains access to an account often wants to stay unnoticed for as long as possible, reading emails, watching for anything financially useful, waiting rather than announcing themselves. A compromised account can sit there being monitored for weeks before anything visibly changes. This is exactly why I check my accounts' recent login activity periodically rather than waiting for something to feel obviously wrong, and why breach notification services that tell you when your email turns up in a leaked database are worth actually signing up for rather than ignoring. Silence isn't the same as safety, it's often just the attacker being patient.</p><h2>Incognito Mode Keeps My Browsing Actually Private</h2><p>I understand exactly where this one comes from, because incognito or private browsing genuinely does something useful, it stops your browser from saving history, cookies, and form data locally on your device once you close the window. What it doesn't do is hide your activity from your internet provider, your employer if you're on a work network, or the websites you actually visit, all of whom can still see exactly what you're doing in real time. I think of incognito mode as a local privacy tool, useful for not leaving a trail on a shared device, rather than an actual privacy tool in the wider sense. If what you actually want is to stop your browsing being visible to your network or provider, that's what a VPN like <a href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" target="_blank" rel="noopener" data-mce-href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902">NordVPN </a>is for, and the two aren't interchangeable even though people often assume they do the same job.</p><h2>Deleting an App Removes Its Access to My Data</h2><p>I used to assume this myself, that removing an app from my phone was the same as cutting off whatever access I'd granted it. It isn't, necessarily. Deleting an app removes it from your device, but any permissions or connections it set up elsewhere, a linked account, an API connection, a granted data-sharing agreement, can still exist entirely independently of whether the app itself is still installed. I now make a habit of checking the connected apps and third-party access lists inside accounts like my email and social media every so often, rather than assuming a deleted app took its access with it when it left my phone. It's a five minute check that's turned up more forgotten connections than I expected the first time I actually looked.</p><p>None of these five assumptions are unreasonable on their face, which is exactly why they're worth naming directly rather than assuming everyone's already past them. Believing you're too small to matter, treating a password as the whole defence, expecting a hack to announce itself, mistaking incognito mode for real privacy, or thinking deletion equals disconnection, each one quietly removes a step that would otherwise catch a problem earlier. I run NordVPN across my own devices specifically because it closes the gap that incognito mode leaves open, and I've written separately about the <a href="https://kellssecurity.com/blog/the-antivirus-software-myths-i-keep-correcting" data-mce-href="https://kellssecurity.com/blog/the-antivirus-software-myths-i-keep-correcting">antivirus-specific myths I hear just as often</a>, along with the <a href="https://kellssecurity.com/blog/the-one-security-step-id-tell-a-complete-beginner-to-start-with" data-mce-href="https://kellssecurity.com/blog/the-one-security-step-id-tell-a-complete-beginner-to-start-with">small handful of habits I'd actually tell a beginner to start with firs</a>t. If you want a second, independent source on any of this, the <a href="https://www.ncsc.gov.uk/cyberaware/home" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/cyberaware/home">NCSC </a>publishes its own guidance for individuals and small businesses, and my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">free Safety Toolkit </a>covers the rest of what I'd recommend if you want to work through your own setup properly.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The Cybersecurity Assumptions I Talk People Out Of

<p><strong>The short answer:</strong> the scams people ask me about most are fake delivery texts, bank impersonation calls asking you to move money to a "safe account", romance scams, investment tips from strangers, prize notifications for competitions you never entered, "Hi Mum" messages from new numbers, and AI voice clone calls. Every one of them relies on rushing you. Pause and check through a number or app you already trust, and almost all of them fall apart.</p><h2>The Scams People Ask Me About Most Often</h2><p>I get asked about a lot of specific incidents, a strange text, an odd phone call, a message from someone who claims to know a relative. But underneath the specifics, most of what people bring me falls into a small handful of repeating patterns. Scammers don't need a thousand different tricks, they just need five or six that work often enough, dressed up slightly differently each time. Once I started noticing the patterns instead of the surface details, spotting a new variation got a lot easier. Here are the five I'm asked about most, and what actually gives each one away.</p><h2>The Courier Text About a Parcel I'm Not Expecting</h2><p>This is the single most common one people forward me, a text claiming a delivery couldn't be completed, with a link to "reschedule" or pay a small redelivery fee. The trick works because most of us are expecting a parcel from somewhere at any given time, so the message lands as plausible rather than suspicious. The tell isn't usually the spelling or the logo, both can look convincing now, it's the link itself. Real couriers direct you to track a parcel using a tracking number you already have, through their own app or the retailer's order page, not through a fresh link texted to you out of nowhere. If I'm not sure, I go directly to the retailer's own order history or the courier's official app rather than tapping anything in the message, and nine times out of ten there's simply no delivery in progress to check on.</p><figure id="figure-8g0dpq1swemtiw0u4x"><img id="8g0dpq1swemtiw0u4x" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Worried older man on a suspicious phone call, The Scams People Ask Me About Most Often" src="https://cdn.durable.co/covers/53TSLRnp03hV6RbE3sAyBIrtLB7DB0QpFBjOkVjCSmt9lTxV8mwEZUb7Zr3Wxekr.jpg" alt="Worried older man on a suspicious phone call, The Scams People Ask Me About Most Often" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/53TSLRnp03hV6RbE3sAyBIrtLB7DB0QpFBjOkVjCSmt9lTxV8mwEZUb7Zr3Wxekr.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>The "Bank Security Team" Call That Won't Let Me Hang Up and Check</h2><p>This one worries people more than any other, because it comes with a voice on the line applying pressure in real time rather than a message you can sit with. Someone calls claiming to be from your bank's fraud team, tells you your account has been compromised, and needs to "verify" you or move your money to a "safe account" right now. The number can even show up as your real bank's on caller ID, since that detail is trivial to fake. The one thing every genuine bank will always let you do is hang up and call them back on the number printed on your card, and a legitimate fraud team will never object to that or rush you past it. I tell people to treat any resistance to hanging up and calling back independently as the clearest signal in the entire call, more telling than anything the caller actually says.</p><h2>The Romance That Escalates to a Money Request Within Weeks</h2><p>I hear about this one less often than the others, mostly because people are understandably reluctant to bring it up, but it's one of the most financially damaging when it does happen. Someone connects on a dating app or social media, the conversation moves fast and feels genuinely warm, and then within weeks there's a reason money needs to move, a medical emergency, a stuck shipment, a visa fee to finally meet in person. The relationship itself can feel completely real to the person experiencing it, which is exactly what makes this pattern so effective and so hard to raise with someone from the outside. A person you've never met in real life asking for money, in almost any circumstance they describe, is the signal to pause and talk to someone you trust before sending anything, no matter how genuine the connection has felt up to that point.</p><h2>The Investment Tip From Someone I've Never Met</h2><p>This one's grown a lot recently, usually starting as an unsolicited message on social media or a messaging app, often from someone who seems to have accidentally messaged the wrong number and strikes up a friendly conversation before mentioning how well their investments are doing. It can also arrive as a slicker version, a fake trading platform showing impressive returns that you can watch grow, right up until you try to withdraw anything. Genuine investment opportunities don't arrive as unsolicited messages from strangers, and any platform that makes withdrawing difficult or asks for extra fees before you can access your own money has already told you what it actually is. I treat any investment introduced through a personal message from someone I've never met, however friendly or patient they seem, as something to walk away from entirely rather than research further.</p><h2>The Prize Notification for a Competition I Never Entered</h2><p>This is the oldest pattern on this list and it still works constantly, a message announcing you've won a prize, a gift card, a competition you don't remember entering, with a small fee or your card details required to release it. The logic should be obvious once you say it out loud, a genuine prize doesn't need payment or your card number to be handed over, but the excitement of "winning" something short-circuits that logic for a lot of people in the moment. I ask myself one simple question with these, did I actually enter anything recently, and if the honest answer is no, there's nothing further to consider regardless of how official the message looks.</p><h2>The "Hi Mum" Message From a New Number</h2><p>This one comes up with parents and grandparents all the time. A WhatsApp or text arrives from an unknown number saying something like "Hi Mum, I've dropped my phone down the toilet, this is my new number". A few messages later there's a bill that needs paying urgently, and a reason it has to go to someone else's account. It works because it feels like helping your own child. The fix is simple: ring your son or daughter on the number you already have, or ask a question only they would know the answer to. If they're genuinely stuck, they'll understand why you checked.</p><h2>The Call That Sounds Exactly Like Someone You Love</h2><p>Scammers can now copy a person's voice from a few seconds of video posted online, then ring a relative sounding distressed and asking for money. I nearly fell for one of these myself, and I've written up <a href="https://kellssecurity.com/blog/the-voice-clone-call-that-almost-had-me-fooled" data-mce-href="https://kellssecurity.com/blog/the-voice-clone-call-that-almost-had-me-fooled">the voice clone call that almost had me fooled</a> so you know what it sounds like. A family code word that only you know, and hanging up to call back on a number you trust, stops it dead.</p><h2>Scam Questions I Get Asked</h2><h3>What should I do if I think I've been scammed?</h3><p>Ring your bank straight away on the number on your card, or dial 159, which connects you to many of the major UK banks. Then change any passwords you've shared and report it to Action Fraud. I've written up <a href="https://kellssecurity.com/blog/the-first-things-i-do-the-moment-i-suspect-a-scam" data-mce-href="https://kellssecurity.com/blog/the-first-things-i-do-the-moment-i-suspect-a-scam">the first things I do the moment I suspect a scam</a> as a step-by-step.</p><h3>How do I report a scam text?</h3><p>Forward it to 7726, which spells SPAM on a keypad. It's free, and it helps your mobile network block the sender for everyone else.</p><h3>Will my bank refund me if I'm scammed?</h3><p>Since October 2024, UK banks have had to reimburse most victims of scams where you were tricked into sending money yourself, up to a limit. They can still refuse if they think you ignored clear warnings, so report it as quickly as you can.</p><h3>How can I protect an older relative from scams?</h3><p>Set up the basics together and agree a simple rule: nobody ever needs to rush you into paying. I've written a guide on <a href="https://kellssecurity.com/blog/helping-an-older-parent-stay-safe-online" data-mce-href="https://kellssecurity.com/blog/helping-an-older-parent-stay-safe-online">helping an older parent stay safe online</a> without taking over.</p><p>Seven very different situations, and the same thread running through every one of them, someone creating urgency or excitement specifically to stop you from pausing and checking independently. A courier link you didn't ask for, a caller who won't let you hang up, a stranger asking for money, an investment you can't withdraw from, a prize you never entered, none of these survive a moment's independent verification, which is exactly why the pressure to skip that step is always the actual point. I run my own passwords through <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass </a>so a compromised login on one of these fronts doesn't cascade into every account I own, and I've written separately about the <a href="https://kellssecurity.com/blog/the-online-safety-mistakes-i-see-people-make-again-and-again" data-mce-href="https://kellssecurity.com/blog/the-online-safety-mistakes-i-see-people-make-again-and-again">ordinary mistakes that make people more exposed </a>to all five of these in the first place, along with <a href="https://kellssecurity.com/blog/why-bad-grammar-doesnt-give-scam-messages-away" data-mce-href="https://kellssecurity.com/blog/why-bad-grammar-doesnt-give-scam-messages-away">why bad grammar stopped being a reliable warning sign </a>on its own. If you want to report something that's already happened, <a href="https://www.actionfraud.police.uk" target="_blank" rel="noopener" data-mce-href="https://www.actionfraud.police.uk">Action Fraud </a>is the right place to start, and my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">free Safety Toolkit </a>covers the rest of what I'd recommend if you want to build up your defences properly.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The Scams People Ask Me About Most Often

Kells Security Solutions

I teach people around the world how to spot online scams and stay safe on the internet, explained in plain English with no jargon. I cover phishing emails, two-factor authentication, password managers, VPNs and antivirus software, written for people who are not tech experts and want to protect themselves and their families.