Blog

Renovated Victorian terraced house with fresh exterior, new windows, and manicured garden in afternoon sunlight

<p>People ask me what the cyber threat landscape looks like in Liverpool as if there is one answer. There is not. What lands in your inbox depends almost entirely on who the criminal thinks you are. A second year student in Kensington and a retired couple in Formby get approached in completely different ways, by different people, with different bait. So instead of another list of scary statistics, here is what I actually see happening to four different groups of Liverpool people, and what tends to stop it.</p><h2>Students and Young Renters</h2><p>The student population here is enormous, and criminals know exactly when term starts.</p><figure id="figure-hvbzfwu9z6mtc20dpd"><img id="hvbzfwu9z6mtc20dpd" src="https://rjdavx8ozyznxeyh.public.blob.vercel-storage.com/production/websites/infinite-images/3b9916d9-e4dc-447a-a113-847574552495-UxT3ZRxf4fZC5UoCwq1SkqSj8yATXa.png" alt="Group of Liverpool residents of different ages talking around a table about online scam awareness" title="Group of Liverpool residents of different ages talking around a table about online scam awareness" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://rjdavx8ozyznxeyh.public.blob.vercel-storage.com/production/websites/infinite-images/3b9916d9-e4dc-447a-a113-847574552495-UxT3ZRxf4fZC5UoCwq1SkqSj8yATXa.png" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><p>The two I see constantly are the accommodation deposit scam and the fake part time job. The accommodation one runs on urgency. A flat appears on a listings page or a housing group at a suspiciously good price, the landlord is away and cannot do viewings, and there are three other people interested, so send the deposit today. The money goes and the flat never existed.</p><p>The job version is quieter and more damaging. An easy remote role, a friendly interview over a messaging app, and then a request for bank details for payroll before any work happens. Sometimes the account is then used to move other people's stolen money, which turns a victim into a suspect.</p><p>The other thing that catches this group is public wifi. Cafes, libraries, the university buildings, the train. Most of it is fine now, but if you are logging into banking from a network you did not set up, a VPN is a sensible habit rather than paranoia. It is one of the reasons I keep <a data-mce-href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" target="_blank" rel="noopener">NordVPN </a>in my own kit.</p><h2>Parents Running a Household</h2><p>If you are the person who sorts the bills, the school payments, the online shop and the family phone contracts, you are handling more accounts than anyone else in the house, and that is exactly why you get hit.</p><p>The dominant one right now is the <a data-mce-href="https://kellssecurity.com/blog/delivery-scams-liverpool" href="https://kellssecurity.com/blog/delivery-scams-liverpool">delivery message</a>. You genuinely are expecting three parcels, so a text about a missed delivery and a small redelivery fee does not feel absurd. The fee is not the point. The card details are.</p><p>Close behind is the school or club payment message. Someone spoofs a name you recognise, mentions a trip or a kit order, and asks you to pay by bank transfer instead of the usual portal. The tell is always the same. A change to how you normally pay is the single most reliable warning sign in any scam, and it applies whether the message claims to be from a school, a builder, or your own bank.</p><p>The habit that fixes most of this is not a piece of software. It is a rule that you never pay anyone from a link in a message. You go to the app or the website you already use.</p><h2>Retired People, and Why the Stereotype Is Wrong</h2><p>I want to be careful here, because the assumption that older people are hopeless with technology does more harm than the scams do. Plenty of my sharpest clients are in their seventies. The difference is not skill. It is that criminals put far more effort into this group, because that is where the savings are.</p><p>The approaches are more personal. A phone call rather than a text. A conversation that builds over days. Someone claiming to be from the bank's fraud team, who already knows your name and the last four digits of your card, asking you to move money to a safe account. No bank will ever ask you to do that, and anyone who does is stealing from you.</p><p>The strongest protection I have found is social rather than technical. Agree with your family that any request involving money gets a second opinion before anything moves, and that nobody will ever be annoyed at being asked. Scammers rely on isolation and embarrassment. A household that talks openly about this is a genuinely hard target.</p><h2>Small Traders and Sole Directors</h2><p>Liverpool runs on small operations. One van, one salon, one consultancy, one person doing everything including the invoicing.</p><p>The one that costs the most is invoice interception. Someone gets into an email account, watches quietly for a while, then sends a real customer a real invoice with changed bank details. The customer pays in good faith, the money is gone, and both sides think they have been robbed by the other. It is not exotic and it is not rare.</p><p>The fix is dull and it works. Two factor authentication on the business email account, and a stated policy that bank details are confirmed by phone on a number you already had. Two minutes on a call beats four thousand pounds down the drain.</p><p>The second one is the fake supplier or directory invoice. Official looking, modest amount, plausible reference number. Sole traders pay these because they are busy and it is easier than querying it. If you do not recognise it, do not pay it.</p><h2>What All Four Groups Have in Common</h2><p>Look at those four lists and the same shape appears every time.</p><p>There is always time pressure. There is always a reason you cannot check through your normal channel. There is always a payment method that is unusual for you. And there is always a story that explains why this time is different.</p><p>Which means the defence is the same for everyone regardless of age or job. Slow down, verify through a route you chose rather than one you were handed, and turn on <a data-mce-href="https://kellssecurity.com/blog/the-step-by-step-way-i-set-up-two-factor-authentication-for-clients" href="https://kellssecurity.com/blog/the-step-by-step-way-i-set-up-two-factor-authentication-for-clients">two factor authentication</a> for your email before anything else, because email is the master key to everything.</p><p>If you want the specific tools I actually recommend rather than a general list, they are all on my <a data-mce-href="https://kellssecurity.com/toolkit" href="https://kellssecurity.com/toolkit">Safety Toolkit </a>page. And if something has already happened to you, report it to <a data-mce-href="https://www.actionfraud.police.uk" href="https://www.actionfraud.police.uk" target="_blank" rel="noopener" data-mce-selected="inline-boundary">Action Fraud</a> rather than staying quiet about it. Reporting is what turns one person's bad afternoon into a pattern the police can actually act on.</p>

Who Actually Gets Targeted in Liverpool, and With What

Close-up overhead view of a moving conveyor belt system showing precise mechanical rollers and industrial components in a modern facility

<p>Almost every week now, someone tells me they are getting far more scam messages than they used to, and that the messages are much better than they used to be. They are not imagining it and they are not being singled out. Something genuinely changed in the last couple of years, and it is worth understanding why, because once you know what is driving it you stop taking it personally and start dealing with it properly.</p><figure id="figure-ekfnsahmqfmtc2oaei"><img id="ekfnsahmqfmtc2oaei" src="https://rjdavx8ozyznxeyh.public.blob.vercel-storage.com/production/websites/infinite-images/9b7cafeb-d0a9-4511-af7d-aabc45bd234d-bExN9h2I0u7XShoYgGGwBwAWfhAv5j.png" alt="Stormy wave hitting rocks, representing the rising volume of scam messages reaching UK inboxes" title="Stormy wave hitting rocks, representing the rising volume of scam messages reaching UK inboxes" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://rjdavx8ozyznxeyh.public.blob.vercel-storage.com/production/websites/infinite-images/9b7cafeb-d0a9-4511-af7d-aabc45bd234d-bExN9h2I0u7XShoYgGGwBwAWfhAv5j.png" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>Scams Used to Be Expensive to Run</h2><p>For a long time, the thing that limited fraud was effort.</p><p>Someone had to write the message. Someone had to translate it, badly, into a language they did not speak. Someone had to sit on the phone for hours getting hung up on. Every single attempt cost the criminal time, and time is the one thing that stopped this being a bigger industry than it was.</p><p>That is why the old scams were so scattergun. The famous foreign prince email was sent to millions of people at once because the sender could not afford to write anything tailored. It was a wide net with big holes in it, and most of us learned to spot it.</p><h2>What Actually Changed</h2><p>The tools that write text and generate speech got good, and they got cheap.</p><p>A person who could once produce twenty crude emails an hour can now produce two thousand, each one different, each one in fluent English, each one written in whatever tone the target is likely to respond to. The cost per attempt collapsed. When the cost of trying drops to almost nothing, the rational thing for a criminal to do is try far more often.</p><p>That is the whole story of why your inbox got busier. It is not that you have been added to some list. It is that the economics tipped, and the volume went up for everybody.</p><p>Voice is the part that unsettles people most, and fairly so. A short clip of someone speaking, taken from a video anyone has posted publicly, is enough to produce a convincing imitation of that voice saying something they never said. I have sat with people who were certain they had spoken to their own son. That is not gullibility. It is a fair reaction to hearing a voice you have known for thirty years.</p><h2>Why the Spelling Mistakes Disappeared</h2><p>For years the standard advice was to look for bad grammar and odd phrasing. That advice is now close to useless, and I would rather tell you that plainly than let you rely on it.</p><p>There is an old theory that scammers wrote badly on purpose to filter out anyone too alert to be worth their time. There is something in it, but it does not matter any more, because writing well now costs nothing. The messages I get shown are clean, correctly punctuated, and often better written than the real ones from the same company.</p><p>So the tell has moved. It is no longer in the spelling. It is in the shape of the request. Is someone creating urgency? Are they steering you away from your normal way of doing things? Are they asking you to do something you cannot easily undo? Those three questions still catch almost everything, and they will keep working long after the surface polish gets even better. If you want the practical version of this, it is what I set out in <a data-mce-href="https://kellssecurity.com/blog/the-simple-checks-i-use-to-stop-ai-scams" href="https://kellssecurity.com/blog/the-simple-checks-i-use-to-stop-ai-scams">the simple checks I use</a>.</p><h2>Why It Feels So Personal Now</h2><p>The other half of the change is data.</p><p>Every breach of a company you have dealt with adds a little more to what is publicly known about you. Your email address, an old password, a phone number, the town you live in, where you shop. On its own each fragment is dull. Combined and fed into a system that writes messages, it produces something that sounds like it knows you, because in a limited way it does.</p><p>This is why the message about a delivery arrives when you actually are waiting for one, and why the caller knows which bank you use. It is not surveillance in the dramatic sense. It is old leaked data being used efficiently for the first time.</p><p>There is a practical consequence. Reused passwords used to be a slow risk. Now they are an immediate one, because matching an old leaked password to your current accounts is trivial to automate. A password manager like <a data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener">NordPass </a>is not a luxury purchase any more, it is the single cheapest way to make all that leaked data useless.</p><h2>What Still Works Against All of It</h2><p>None of this means you are helpless. It means the defences that rely on spotting a fake have got weaker, and the defences that rely on process have got stronger. So lean on process.</p><p>Verify on a channel you chose. If a message or a call asks for anything that matters, close it and go to the app, the website, or the number on the back of your card. A criminal can imitate a voice, a face and a writing style, but they cannot answer the phone when you dial your bank yourself.</p><p>Agree a family question. Something ordinary that only your family would know the answer to, and that is not written down anywhere online. It costs nothing and it defeats a cloned voice in about four seconds.</p><p>Turn on two factor authentication on your email first, then your bank, then everything else. This is still the highest value hour you will ever spend on your own security.</p><p>Slow down when you are being hurried. Every version of this, old and new, depends on you acting before you think. Urgency is the constant. <a data-mce-href="https://www.takefive-stopfraud.org.uk" href="https://www.takefive-stopfraud.org.uk" target="_blank" rel="noopener" data-mce-selected="inline-boundary">Take Five to Stop Fraud</a> has said the same thing for years and it has not stopped being true.</p><p>That is the honest picture. More attempts, better written, better targeted, and a set of defences that still hold if you use them. If you would like a hand setting any of it up, get in touch and I will walk you through it in plain English.</p>

Why You Are Getting More Scams Than You Used To

Notary public using magnifying glass to carefully examine and verify document signatures and details

<h2>The Email I Am Going to Pick Apart</h2><p>A client forwarded me a phishing email last month and asked if it was safe to click. It was not, and it was also a near perfect teaching example, so I want to walk you through it piece by piece rather than just tell you the general rules again. Once you have seen how one of these is actually built, the general rules make a lot more sense.</p><p>I am not going to reproduce the exact email here, both because it named a real company and because scammers do read blogs like this one and adjust. Instead I am describing the structure, which barely changes even when the wording does. If you understand the structure, you can spot the next one regardless of which brand it is wearing.</p><h2>The Sender Line Tells You More Than You Think</h2><p>Most people glance at the display name and stop there. The email said it was from a parcel courier, and the display name matched. The actual address behind that display name was a string of random letters at a domain that had nothing to do with the courier.</p><p>This is the single most useful five second check you can do, and almost nobody does it. On a phone, you usually need to tap the sender name to reveal the full address. On a laptop, hovering over it is enough. If the visible name and the underlying address do not match the company they claim to be from, you are done, you already have your answer.</p><p>Some scammers now use domains that are close but not exact, swapping a letter or adding a word. That is worth a second look too, but the mismatched display name is the more common tell, because it costs the scammer nothing to fake and most people never check it.</p><figure id="figure-xrbwhwgt7tmtcsoi7d"><img id="xrbwhwgt7tmtcsoi7d" src="https://rjdavx8ozyznxeyh.public.blob.vercel-storage.com/production/websites/infinite-images/e19e5823-6725-4f4e-8077-0802b9eb8264-wE3g2sOtbs3mir6TSVFVjOGhlnjKuW.png" alt="Open letter on antique desk with morning light, surrounded by previous correspondence and period details" title="Open letter on antique desk with morning light, surrounded by previous correspondence and period details" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: undefined undefined;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://rjdavx8ozyznxeyh.public.blob.vercel-storage.com/production/websites/infinite-images/e19e5823-6725-4f4e-8077-0802b9eb8264-wE3g2sOtbs3mir6TSVFVjOGhlnjKuW.png" data-mce-style="aspect-ratio: 16/9; object-position: undefined undefined;"></figure><h2>The Subject Line Is Built to Short-Circuit Thinking</h2><p>The subject said a delivery had failed and action was needed within twenty four hours. That is not an accident. Every convincing phishing email I have seen leans on the same two ingredients, a problem you did not cause and a clock that is already running.</p><p>The combination matters more than either part alone. A problem without urgency gives you time to think it through. Urgency without a problem has nothing to hook you with. Put them together and a lot of sensible people will click first and question it second, which is exactly the order the scammer wants.</p><p>When I read a subject line like that now, I treat the urgency itself as the red flag rather than something to react to. Genuine delivery problems can usually be checked by going to the courier's own app or website directly, not through a link in an email.</p><h2>The Body Copy Follows a Formula</h2><p>The message body had three parts, and I see this same shape constantly. First, a brief statement of the problem, kept vague on purpose so it could apply to almost anyone. Second, a consequence if you do not act, in this case the parcel being returned to sender. Third, a single button to fix it.</p><p>Notice what is missing. No parcel number that matches anything I could check independently. No specific date. No named person. Genuine companies tend to over include this kind of detail because it reduces their own support queries. Scam emails tend to under include it because specific, checkable detail is exactly what would let you catch them out.</p><p>The tone is also flatter than a real company's marketing usually is. Real courier emails often have a house style, a bit of personality, maybe an offer or a link to their app. This one read like it had been generated to be as universally applicable as possible, which is another way of saying it read like it had been generated for a mass send.</p><h2>What I Do With the Link Itself</h2><p>I never click the button in an email like this, but I am sometimes curious enough to check where it leads, and there is a safe way to do that. On a laptop, hovering over a link shows you the destination URL at the bottom of the browser window without visiting it. On most phones, a long press does something similar.</p><p>In this case the link went to a domain that had nothing to do with the courier, similar to the sender address problem. If you ever do this check and the destination looks even slightly off, close the email and go to the company's real website by typing the address yourself, or through their official app if you have it installed.</p><p>I would also point out that good antivirus software catches a meaningful share of these before you even get to the reasoning stage. I run <a data-mce-href="https://www.bitdefender.com/en-us/consumer/?irclickid=WxSzmdWRXxyZWsOzKNx6sWZFUkrxGHQpm0ekVY0&amp;im_rewards=&amp;irgwc=1&amp;afsrc=1&amp;MPid=6273270&amp;cid=aff|c|IR|Cyber%20Jay" href="https://www.bitdefender.com/en-us/consumer/?irclickid=WxSzmdWRXxyZWsOzKNx6sWZFUkrxGHQpm0ekVY0&amp;im_rewards=&amp;irgwc=1&amp;afsrc=1&amp;MPid=6273270&amp;cid=aff|c|IR|Cyber%20Jay" target="_blank" rel="noopener" data-mce-selected="inline-boundary">Bitdefender </a>on my own devices, and its anti-phishing filtering has flagged links like this one automatically, which is a useful second layer on days when you are tired, rushed, or simply not looking closely.</p><p>If you want the fuller picture of what protects an inbox beyond spotting one email, I have written about that in <a data-mce-href="../blog/the-simple-checks-i-use-to-stop-ai-scams" href="../blog/the-simple-checks-i-use-to-stop-ai-scams">the simple checks I use</a>, and if passwords are part of what is at risk here, my thoughts on <a data-mce-href="../blog/password-manager-vs-memory-liverpool" href="../blog/password-manager-vs-memory-liverpool">password manager vs memory</a> are worth a look too. For anyone in Liverpool who wants a second pair of eyes on something that has landed in their inbox, my <a data-mce-href="../safety-toolkit" href="../safety-toolkit">safety toolkit</a> has the free checklist I mentioned, and you are always welcome to get in touch directly.</p><p>None of this requires technical skill. It requires slowing down for the five seconds it takes to check a sender address and a link destination, which is exactly what these emails are designed to stop you from doing. If you report anything suspicious, the <a data-mce-href="https://www.ncsc.gov.uk/collection/phishing-scams/report-scam-email" href="https://www.ncsc.gov.uk/collection/phishing-scams/report-scam-email" target="_blank" rel="noopener">National Cyber Security Centre's reporting service</a> is worth using, since it helps get malicious sites taken down faster for everyone else too.</p>

What a Real Phishing Email Looks Like, Line by Line

Flat lay arrangement of functional bags including tote, backpack, and crossbody styles with coordinating accessories on neutral linen background

<h2>Why I Still Get Nervous at Checkout</h2><p>I have bought things online for years and I still slow down at the checkout page every single time. Not because I think every shop is a scam, but because this is the exact moment a fake store is designed to catch you. You have already decided you want the item, you are focused on getting a good price, and your guard is naturally lower than it was when you first landed on the site. Scammers know this, which is why so many fake shopping sites put real effort into the browsing experience and cut corners on the parts most people never scrutinise, like the payment page itself. A few seconds of attention here has saved me more than once, and it is the habit I would want every Liverpool shopper to pick up before the next big sale event, not after something has already gone wrong. I have seen how quickly a good mood about finding a bargain turns into a bad afternoon spent on the phone to a bank, and almost all of it was avoidable with a bit more care at exactly this stage.</p><p><br></p><h2>The Web Address I Look at Before Anything Else</h2><p><br></p><p>Before I type a single card digit, I look at the address bar. I am checking for the padlock, but more importantly I am checking that the domain matches the shop I think I am on. Fake checkout pages are often bolted onto a domain that looks close to the real one, with an extra word, a different ending, or a string of random characters tacked on. If I searched for a product and landed on a site through an advert, I am even more careful, because scam ads have a way of slipping past moderation and pointing to lookalike stores built purely to harvest card details. If anything about the web address looks even slightly wrong, I close the tab and go to the retailer directly by typing the address myself or using their official app. I do the same check again right before I submit payment, because some fake pages redirect partway through the process, after the browsing already felt convincing enough to lower my guard.</p><p><br></p><h2>The Payment Methods That Protect Me If Something Goes Wrong</h2><p><br></p><p>How I pay matters almost as much as who I am paying. I use a credit card for anything above a small amount because of the extra protection it gives me if a purchase turns out to be fraudulent, and I avoid bank transfers entirely for anything bought from a stranger or an unfamiliar site, since that money is very hard to get back once it is gone. I am also careful about which sites I let store my card details for next time. This is one of the areas where a password manager earns its keep, because it can fill in payment details only on the genuine saved site rather than a lookalike, which is one more reason I have written before about the choice between a <a data-mce-href="../blog/password-manager-vs-memory-liverpool" href="../blog/password-manager-vs-memory-liverpool">password manager and just memorising everything</a>. Good antivirus software plays a part here too. I run <a data-mce-href="https://www.bitdefender.com/en-us/consumer/?irclickid=WxSzmdWRXxyZWsOzKNx6sWZFUkrxGHQpm0ekVY0&amp;im_rewards=&amp;irgwc=1&amp;afsrc=1&amp;MPid=6273270&amp;cid=aff|c|IR|Cyber%20Jay" href="https://www.bitdefender.com/en-us/consumer/?irclickid=WxSzmdWRXxyZWsOzKNx6sWZFUkrxGHQpm0ekVY0&amp;im_rewards=&amp;irgwc=1&amp;afsrc=1&amp;MPid=6273270&amp;cid=aff|c|IR|Cyber%20Jay" target="_blank" rel="noopener">Bitdefender </a>on my own devices, and its web protection has quietly blocked checkout pages before I ever got the chance to enter anything, which is exactly the kind of second layer I want when I am moving fast and not reading every detail as closely as I should.</p><p><br></p><figure id="figure-vcj8hraanqmtct9re3"><img id="vcj8hraanqmtct9re3" src="https://rjdavx8ozyznxeyh.public.blob.vercel-storage.com/production/websites/infinite-images/93322d29-1f69-436e-8354-b0c7dc3386f2-xYRqDeRy3coTxwqbL9arXEU5hmiER4.png" alt="Stacked cardboard boxes with silver security padlock and green leaf on white surface, calm overhead view." title="Stacked cardboard boxes with silver security padlock and green leaf on white surface, calm overhead view." class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://rjdavx8ozyznxeyh.public.blob.vercel-storage.com/production/websites/infinite-images/93322d29-1f69-436e-8354-b0c7dc3386f2-xYRqDeRy3coTxwqbL9arXEU5hmiER4.png" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>The Site Details That Tell Me a Shop Is Real</h2><p><br></p><p>Beyond the address bar, I look for the boring, unglamorous details that scam sites rarely bother getting right. A proper returns policy, a real contact address rather than just a contact form, and reviews that exist somewhere other than the shop's own website are all good signs. I also check how long the site has existed if something feels off, since a domain registered a few weeks ago selling designer goods at half price is a pattern I have seen too many times to ignore. Spelling and grammar across the site is another small tell, not because a genuine shop never makes a typo, but because a whole site full of slightly-off phrasing usually means it was thrown together quickly with no real business behind it. None of this takes long once it becomes habit, and I would rather spend thirty seconds checking than spend weeks trying to claim money back from my bank.</p><p><br></p><h2>What I Do When a Deal Looks Too Good</h2><p><br></p><p>The oldest rule in online shopping is still the most useful one. If a deal looks too good to be true, I treat that as a reason to slow down rather than speed up. Scammers rely on excitement overriding caution, especially around big sale periods when genuine discounts make it harder to tell real bargains from bait. I will often search the product and shop name together along with the word scam before I buy from somewhere unfamiliar, just to see what comes up. If I do get caught out, or even just suspect I have been, I report it through <a data-mce-href="https://www.actionfraud.police.uk" href="https://www.actionfraud.police.uk" target="_blank" rel="noopener">Action Fraud</a>, which is the UK's national reporting centre for fraud and cyber crime, because reporting helps get fraudulent sites taken down faster for everyone else too. For anyone in Liverpool who wants a simple checklist to run through before they buy from a new site, my <a data-mce-href="../safety-toolkit" href="../safety-toolkit" data-mce-selected="inline-boundary">safety toolkit </a>has the free download I mention to clients, and it covers this alongside the wider checks I recommend for staying safe online in general.</p><p><br></p><p>None of this requires any special technical skill. It is a handful of habits that take seconds once you know what you are looking for, and they are exactly the kind of checks that stop most online shopping scams before they cost you anything.</p>

The Checkout Red Flags I Check Before I Enter My Card Details

dad talking to kid in the kitchen with relaxed look on his face

<h2>The Call That Sounded Exactly Like My Nephew</h2><p>My phone rang on a Tuesday evening and the voice on the other end was unmistakably my nephew. Same pitch, same way he rushes his words when he's stressed, even the little laugh he does halfway through a sentence when he's nervous. He said he'd been in a car accident, that he needed money transferred straight away to cover a tow truck and an excess payment, and that he didn't want his mum finding out yet. Every instinct told me this was him. It wasn't. It was an AI-generated clone of his voice, built from clips of him talking on social media, and I came within a few taps of sending money before something made me pause.</p><p>I'm writing this because I nearly got caught, and because I think a lot of people assume <a data-mce-href="https://kellssecurity.com/blog/the-simple-checks-i-use-to-stop-ai-scams" href="https://kellssecurity.com/blog/the-simple-checks-i-use-to-stop-ai-scams">voice cloning scams </a>are still clumsy or rare. They aren't. The technology has moved fast, and the calls now sound close enough to a real family member that "I'd know my own nephew's voice" isn't the safety net it used to be.</p><h2>How AI Voice Cloning Works With Just Seconds of Audio</h2><p>What shook me afterwards was learning how little material a scammer actually needs. A short video posted online, a voicemail greeting, even a few seconds of someone talking in the background of a clip, is enough for modern voice cloning tools to build a convincing copy. The software analyses tone, pitch, pacing and accent, then generates new sentences in that same voice that the person never actually said.</p><p>This is why the old advice of "listen for anything that sounds off" doesn't hold up as well as it used to. The audio quality on these calls can be excellent, and scammers often add background noise, a shaky signal, or claim the person is in a stressful situation, which conveniently explains away any small imperfections in the voice. The panic in the story does a lot of the scammer's work for them, because it discourages the kind of calm, careful listening that might otherwise catch something wrong.</p><figure id="figure-bl3lytaxzwmtd01rl0"><img id="bl3lytaxzwmtd01rl0" src="https://rjdavx8ozyznxeyh.public.blob.vercel-storage.com/production/websites/infinite-images/a829f0b2-4625-41d3-b45f-da95e988de07-Muerup4qIAED6iLGIjERXWIjH0S5n8.png" alt="Parent and child having an engaged conversation on a living room sofa with warm natural light and genuine emotional connection." title="Parent and child having an engaged conversation on a living room sofa with warm natural light and genuine emotional connection." class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://rjdavx8ozyznxeyh.public.blob.vercel-storage.com/production/websites/infinite-images/a829f0b2-4625-41d3-b45f-da95e988de07-Muerup4qIAED6iLGIjERXWIjH0S5n8.png" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>The Family Codeword That Stops This Cold</h2><p>After that call, the first thing I did was set up a family codeword with my nephew, my sister, and my parents. It's a simple word or short phrase that has nothing to do with any of us personally, so it can't be guessed from a social media profile, and everyone in the family knows to ask for it if a call involves money, an emergency, or anything urgent.</p><p>The logic is straightforward. A cloned voice can copy how someone sounds, but it can't know a private codeword unless the real person has shared it, and a scammer working from a script has no way to supply it convincingly under pressure. If the person on the phone can't give the word, or hesitates and tries to change the subject, that's the moment to hang up and call them back directly on a number you already have saved, not one they've just given you.</p><p>I'd genuinely recommend this to anyone reading, whatever your family setup looks like. It takes about two minutes to agree on, and it turns an impossible question, does this voice sound right, into a simple one, did they say the word.</p><h2>Other Signs the Call Isn't Who It Claims to Be</h2><p>Beyond the codeword, I've picked up a few habits that help me stay steady when a call like this comes in. Urgency is the biggest tell. Real emergencies rarely require an instant bank transfer with no other option, and a genuine request from a family member can almost always wait the few minutes it takes to call them back on a known number.</p><p>I'm also wary of any call that asks for payment in an unusual form, such as gift cards, cryptocurrency, or a transfer to an account I don't recognise. Legitimate emergencies, like a tow truck or a hospital fee, don't typically require that kind of payment method, and a scammer will often push for something fast and hard to trace.</p><p>Another habit I've built is simply not confirming details the caller should already know. If someone claims to be my nephew but seems to be fishing for his own middle name or his mum's address, that's backwards, and it's worth noticing. A real family member calling in a panic wouldn't need me to remind them who they are.</p><h2>What I Do the Moment Something Feels Off</h2><p>These days, if I get a call like that one again, I don't try to reason it out on the spot. I tell the caller I need to check something and I'll call them straight back, then I hang up and ring my nephew directly, using the number already saved in my phone rather than anything given to me during the call. Nine times out of ten that alone reveals the truth within seconds.</p><p>I've also started talking about this openly with the wider family, including the older relatives I support, because the <a data-mce-href="https://kellssecurity.com/blog/who-gets-targeted-in-liverpool" href="https://kellssecurity.com/blog/who-gets-targeted-in-liverpool">people scammers target hardest</a> are usually the ones least likely to have heard that voice cloning is even possible. A quick conversation over a cup of tea about "if I ever ring you sounding panicked about money, ask me the word first" has done more for our family's safety than any piece of software could.</p><p>I've tightened up the basics too, since a scammer who's already studied one part of your life will happily use anything else they can find. My accounts now run on strong, unique passwords through <a data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener">NordPass</a>, so if one login was ever exposed somewhere, it couldn't be reused to unlock everything else.</p><p>None of this requires any special technical skill, just a shared plan agreed in a calm moment, before you ever need it. That's the part that actually would have stopped me on that Tuesday evening, and it's the part I'd urge anyone reading this to sort out with their own family today.</p><p>If you want more practical steps like this one gathered in a single place, I've put together a free <a data-mce-href="https://kellssecurity.com/toolkit" href="https://kellssecurity.com/toolkit">Safety Toolkit</a> with checklists you can run through with your own family. For the official UK guidance on scam calls and messages, the <a data-mce-href="https://www.ncsc.gov.uk" href="https://www.ncsc.gov.uk" target="_blank" rel="noopener" data-mce-selected="inline-boundary">NCSC </a>also has clear advice worth bookmarking.</p>

The Voice Clone Call That Almost Had Me Fooled

Business professional's hands carefully holding important document at modern workspace desk with laptop and fax software interface visible

<h2>How I Actually Compare Antivirus Software Before Recommending One</h2><p>People ask me which antivirus is best more often than almost anything else I get asked, and my honest answer usually disappoints them slightly, because there isn't a single one. What actually works best depends on the device you're protecting, how you use it, and what you're already running alongside it. What I can give instead is the process I actually use to compare products, the same one whether I'm choosing for myself or advising someone else, and it looks nothing like scrolling a list of names and picking whichever one has the flashiest badge on the box.</p><p><br></p><h2>Why I Don't Just Recommend One Antivirus to Everyone</h2><p><br></p><p>The honest reason I resist giving a single answer is that the right choice genuinely changes depending on who's asking. Someone running an older laptop that already struggles to keep up needs something lightweight far more than they need the product with the most features. A household with kids needs parental controls that a single professional living alone has no use for. Someone who already pays for a VPN and a password manager separately doesn't need a bundled suite duplicating tools they've already sorted, while someone starting from nothing might genuinely benefit from getting everything in one place. Treating antivirus as a single ranked list, with one winner everyone should install, ignores all of that, and it's part of why so much of the advice out there feels generic even when it's technically accurate.</p><p><br></p><h2>The Test Results I Actually Trust Over Marketing Claims</h2><p><br></p><p>Every antivirus company claims to catch nearly everything, and on their own marketing pages that claim is basically meaningless, since nobody's going to publish a number that makes them look bad. What I actually look at instead is independent lab testing, specifically the ongoing results from AV-Test and AV-Comparatives, which run the same products through repeated real-world detection tests every few months rather than accepting a vendor's own figures. What I care about isn't just the headline detection percentage, since most serious products now cluster close together there. It's the false positive rate, how often something legitimate gets flagged or blocked, because a product that's overly aggressive causes its own kind of disruption, and it's consistency across multiple testing rounds rather than one standout result, since a single good month doesn't tell me much about how a product performs over time.</p><p><br></p><h2>What System Impact Actually Feels Like Day to Day</h2><p><br></p><p>This is the part that gets ignored in most comparisons and is honestly one of the biggest reasons people abandon security software entirely. A product that scores brilliantly on detection but grinds a laptop to a crawl during a background scan doesn't stay installed for long, because people switch it off the first time it slows down something they're trying to do, and an antivirus that's been switched off protects nobody. I look specifically at the independent performance scores the same testing labs publish alongside detection results, covering things like how much a scan slows down everyday tasks, file copying, launching applications, browsing, rather than just trusting a vendor's claim of being "lightweight." A product that's genuinely fast and quiet in the background is one people actually keep running, which matters more than a marginally higher detection score on paper.</p><p><br></p><h2>The Extra Features That Actually Change My Recommendation</h2><p><br></p><p>Beyond the core scanning engine, the bundled extras are where products start to genuinely differ from each other, and where the right choice depends heavily on what you already have. Ransomware-specific protection, which watches for the exact behaviour pattern of files being encrypted in bulk rather than relying on signature detection alone, is one I now treat as close to essential rather than a nice extra. A bundled VPN is useful if you don't already run one, though I'd note <a data-mce-href="https://kellssecurity.com/blog/why-i-run-a-vpn-on-every-device-i-own" href="https://kellssecurity.com/blog/why-i-run-a-vpn-on-every-device-i-own">I already run a VPN on every device I own </a>separately, so for me it's not the deciding factor it might be for someone starting from scratch. <a data-mce-href="https://www.bitdefender.com/en-us/consumer/?irclickid=WxSzmdWRXxyZWsOzKNx6sWZFUkrxGHQpm0ekVY0&amp;im_rewards=&amp;irgwc=1&amp;afsrc=1&amp;MPid=6273270&amp;cid=aff|c|IR|Cyber%20Jay" href="https://www.bitdefender.com/en-us/consumer/?irclickid=WxSzmdWRXxyZWsOzKNx6sWZFUkrxGHQpm0ekVY0&amp;im_rewards=&amp;irgwc=1&amp;afsrc=1&amp;MPid=6273270&amp;cid=aff|c|IR|Cyber%20Jay" target="_blank" rel="noopener">Bitdefender </a>is <a data-mce-href="https://kellssecurity.com/blog/antivirus-i-actually-trust-bitdefender" href="https://kellssecurity.com/blog/antivirus-i-actually-trust-bitdefender">the one I've ended up using on my own devices</a>, largely because the bundle covers ransomware protection, a genuinely light system footprint, and the extras I actually use without needing three separate subscriptions doing overlapping jobs.</p><figure id="figure-cb74p4obyemtdy00nb"><img id="cb74p4obyemtdy00nb" src="https://rjdavx8ozyznxeyh.public.blob.vercel-storage.com/production/websites/infinite-images/6e2b181e-444a-4b4d-a9a8-276396fe94a1-4JUZdzMERMNwoBkXgi9R6fJJeBNXC0.png" alt="Stacked gold and silver coins in pyramid formation on dark marble with warm studio lighting and dust particles." title="Stacked gold and silver coins in pyramid formation on dark marble with warm studio lighting and dust particles." class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://rjdavx8ozyznxeyh.public.blob.vercel-storage.com/production/websites/infinite-images/6e2b181e-444a-4b4d-a9a8-276396fe94a1-4JUZdzMERMNwoBkXgi9R6fJJeBNXC0.png" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><p><br></p><h2>Free Versus Paid, and When Free Is Actually Enough</h2><p><br></p><p>I don't think everyone needs to pay for antivirus, and I'd rather say that honestly than pretend otherwise for the sake of a recommendation. Windows Defender, built into every current version of Windows, has genuinely closed the gap with paid products over the last few years and performs respectably in the same independent tests I mentioned earlier. For a well-maintained device with sensible browsing habits and updates installed promptly, it's a reasonable baseline on its own. Where I'd still recommend paying is for the extra layers, dedicated ransomware behaviour monitoring, better phishing and scam-site blocking, and the bundled extras that remove the need to manage several separate tools, especially for a household or a small business where one person can't realistically watch every device individually.</p><p><br></p><p>None of this is complicated once you know what to actually look for, and it's a lot less work than reading ten separate reviews trying to guess which one is being honest. I'd rather someone picked a product that matches how they actually use their devices than the one that happened to top a list this month. If you want the fuller version of what I check before recommending anything to a client, I've put it together in a <a data-mce-href="https://kellssecurity.com/toolkit" href="https://kellssecurity.com/toolkit">free Safety Toolkit</a>, and the <a data-mce-href="https://www.ncsc.gov.uk/cyberaware/home" href="https://www.ncsc.gov.uk/cyberaware/home" target="_blank" rel="noopener" data-mce-selected="inline-boundary">NCSC </a>has its own guidance on the basics of keeping a device protected if you want a second source to weigh mine against.</p>

Blog

Who Actually Gets Targeted in Liverpool, and With What

Why You Are Getting More Scams Than You Used To

What a Real Phishing Email Looks Like, Line by Line

The Checkout Red Flags I Check Before I Enter My Card Det...

The Voice Clone Call That Almost Had Me Fooled

How I Actually Compare Antivirus Software Before Recommen...