Banner grid

Scams are getting harder to spot, even for people who use the internet every day. I'm a Liverpool-based online safety educator who'd rather explain a dodgy text in plain English than bury you in jargon, so you and the people you love can browse, bank, and shop online with confidence.

You Don't Need to be a Tech Expert to Stay Safe Online

Friendly Liverpool online safety educator explaining scam protection to a local resident over tea

List

Our Top Online Safety Tips

<p>Criminals who steal one password often try it everywhere else. Give every account its own, using three random words (like "PurpleGardenBiscuit") or a password manager to remember them for you.<br /><br /></p>

Professional typing on keyboard with password security interface visible on laptop screen in modern workspace

Hands typing a strong unique password on a laptop keyboard

Use a Strong, Unique Password for Every Account

<p>Those "update available" notifications aren't just for new features. They often close doors that hackers use to get in. Update as soon as you can, rather than putting it off.<br /><br /><br /></p>

Computer monitor displaying software update progress bar at 85% with security shield icon

Computer screen showing a security software update in progress

Keep your Phone and Computer Updated

<p>This means a code is sent to your phone as a second check when you log in somewhere new. Even if someone gets hold of your password, they still can't get in without your phone.</p>

Concept of cyber security, information security and encryption. Man hand typing on a keyboard with login and password on-screen display. login, password, data protection and secured internet access.

Hand entering a login and password with a two-factor authentication lock icon on screen

Turn on Two-Factor Authentication Where You Can

<p>Real banks, HMRC, and delivery companies won't rush you, threaten you, or ask for your password by phone or text. If a message creates urgency or fear, that's the warning sign itself. Slow down and check.<br /><br /></p>

Mature woman at home desk noticing suspicious warning on smartphone, recognizing potential phishing attempt

Woman looking concerned at a scam security alert on her phone

Know the Signs of a Scam

<p>Photos, documents, important messages! Copy them somewhere separate (a cloud service or an external drive) so a lost phone, a virus, or a hack can't take them from you for good.</p>

User's hands interacting with laptop keyboard in bright home office with cloud storage interface displayed on screen

Person backing up photos and files to cloud storage on a laptop

Back up Anything You'd Hate to Lose

<p>If you have an older relative, a neighbour, or a friend who's less confident online, a five-minute conversation about what scams look like can matter more than any software.</p>

Mexican Family Entertained Using the Laptop, Fun Moment, Modern Life, Technology

Mum showing her children how to stay safe online together on a laptop

Look Out for Someone Else, Too

Image

Hands typing on a laptop with a security login screen, symbolising safe online habits

Feeling lost in the online jungle? We make online safety easy, so you can use the internet care-free!

Online Security Made Simple!

<p class="large">Easy-to-follow advice for staying safe online.</p>

Top view woman working on computer laptop. Protection network security computer and safe your data concept. Digital crime by an anonymous hacker

Overhead view of someone typing on a laptop surrounded by online security icons

Simple Tips for Online Safety

<p class="large"> My personal stories and mistakes, so you can learn from them.<br /><br /></p>

Warning alert appearing on a phone while browsing, illustrating a real-life scam moment

Real-Life Lessons

<p class="large">Learn how to spot online scams and protect your online identity.<br /><br /></p>

Know Your Customer (KYC) Concept. A person works on a laptop, displaying digital icons representing Know Your Customer (KYC) processes, including security, identification, and financial compliance.

Hand typing on a laptop with digital identity verification icons, representing step-by-step security guides

Simple Step-by-Step Guides

Call to action

The internet should work for you, not against you, no matter which part of Liverpool you're logging in from. Grab the free checklist, or get in touch any time something feels off. There's no such thing as a silly question here, only silly scammers.

Take Five Minutes To Protect Yourself

Cybersecurity and privacy concepts to protect data. Lock icon and internet network security technology. Businesswomen protecting personal data on smartphone virtual interfaces.

Recent blog posts

Recent Online Safety Tips...

A father and son are smiling at each other in a warm kitchen with wooden cabinets, potted plants, and a coffee maker.

<p>A client rang me last month convinced she had just spoken to her son. Same voice, same habit of trailing off at the end of his sentences, same slightly impatient tone he gets when he needs something. He was in trouble, he said, and needed money moving that afternoon. It was not him. It was roughly thirty seconds of audio lifted from a video he had posted, run through software that costs less than a takeaway. She did not send anything, and the reason she did not is the whole point of this post.</p><h2>Why Trying to Spot AI Scams Stopped Working</h2><p>For years the advice was to look for the tells. Bad spelling, clumsy phrasing, a logo in slightly the wrong shade of blue. That advice worked when scams were churned out by people rushing through hundreds of messages a day. It does not work now. The spelling is perfect. The phrasing reads like a real person because real people's writing trained the thing that wrote it. The voice on the phone is your daughter's voice, because it was built from your daughter's voice.</p><p>I have written before about <a data-mce-href="https://kellssecurity.com/blog/ai-scams-evolving-liverpool" href="https://kellssecurity.com/blog/ai-scams-evolving-liverpool">how AI scams keep getting harder to spot</a>, and the short version is that the tells people were taught to look for have quietly disappeared. So I stopped teaching people to spot scams a while back and I have not gone back. Detection puts all the pressure on you being sharp at exactly the wrong moment, usually when you are tired, distracted or frightened. Verification does the opposite. It assumes you will be fooled at some point and gives you something to do anyway.</p><h2>The Safe Word Every Family Should Have</h2><p>This is the one I push hardest and it costs nothing at all. Pick a word or a short phrase that your immediate family knows and that would never come up in ordinary conversation. Not a pet's name, not a street you used to live on, nothing that is sitting in a Facebook post somewhere. Something daft works best, because daft is memorable and nobody can guess it.</p><p>The rule is simple. If someone claiming to be family asks for money, or asks for something urgent and out of character, you ask for the word. A real relative will either know it or laugh at you for asking. A cloned voice will stall, get irritated, or try to talk you past it. That reaction is the tell, and it is far more reliable than anything you might think you can hear in the voice itself.</p><p>I have set this up with families where the grandparents felt a bit silly about the whole idea. Two of them have since used it for real. Neither felt silly at the time.</p><h2>Why I Always Hang Up and Call Back</h2><p>The second habit is even simpler. Whoever rings you, whatever they say, you end the call and you ring back on a number you already had. Not the number that just called you. Not a number the caller reads out to you. The one saved in your phone, or printed on the back of your bank card, or on a letter you were sent months ago.</p><figure id="figure-k1bwyvw06qmtbsp3g5"><img id="k1bwyvw06qmtbsp3g5" src="https://rjdavx8ozyznxeyh.public.blob.vercel-storage.com/production/websites/infinite-images/13c71e87-ef12-4973-92ed-a11f8611f9d1-MkYsSs4XBHgQZYaBuh6annQvAjBKMP.png" alt="Gold and black wall clock, representing the habit of pausing and calling back on a number you already trust before acting on an urgent request" title="Gold and black wall clock, representing the habit of pausing and calling back on a number you already trust before acting on an urgent request" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionX="undefined" data-positionY="undefined" data-fullWidth="false"/></figure><p>This works because it breaks the one thing every scam of this kind depends on, which is keeping you inside a conversation they control. A <a data-mce-href="https://kellssecurity.com/blog/the-phishing-scams-i-see-catching-liverpool-people-out" href="https://kellssecurity.com/blog/the-phishing-scams-i-see-catching-liverpool-people-out">fake bank fraud team</a> cannot follow you onto a line you dialled yourself. Neither can a cloned voice. Leave a minute or two before you dial as well, because older landlines could sometimes be held open by the caller, and a short wait costs you nothing.</p><p>Real organisations are completely relaxed about this. I have never known a bank, a utility company or the police to object to being called back. Anyone who does object, who tells you there is no time or that the line has to stay open, has just told you exactly what they are.</p><h2>Video Calls Are Harder Than People Expect</h2><p>Voice cloning gets the headlines, but faked video is now good enough to fool people on a short call, particularly on a phone screen with a patchy connection. The old advice about asking someone to turn their head or wave a hand in front of their face is getting less reliable every year, and I would not want anyone betting a house deposit on it.</p><p>So I treat video exactly the same as voice. If a video call is asking me to do something that moves money or hands over access, the call itself is not the verification. I go and check through a different channel entirely, which usually means a text to a number I already have, or a phone call I place myself. The point is not which channel you pick. The point is that the person on the screen does not get to choose it for you.</p><h2>What to Do When You Simply Cannot Check</h2><p>Sometimes there is genuinely no way to verify in the moment. A relative is abroad, it is the middle of the night, the one person who could confirm it is unreachable. This is the situation scammers engineer on purpose, because urgency plus isolation is where people make the decision they later cannot explain to themselves.</p><p>My rule for that gap is that nothing irreversible happens inside it. No transfers, no card details, no codes read out loud, no remote access software installed because someone talked you through it. Waiting an hour has never once cost one of my clients anything real. Acting inside that hour has cost people their savings.</p><p>Two things worth having in place long before you ever need them. Turn on two factor authentication for your email and your banking, so that a scammer holding your password still cannot get in. And use a password manager, so one leaked login does not quietly open everything else you own. I use <a data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener">NordPass </a>for exactly that reason and it takes an evening to set up properly.</p><p>If you want the official version of all this sitting alongside mine, <a data-mce-href="https://www.takefive-stopfraud.org.uk/" href="https://www.takefive-stopfraud.org.uk/" target="_blank" rel="noopener">Take Five</a> is the national campaign built around the same idea and it is worth ten minutes of anyone's time. And if you would rather just talk it through with a real person, <a data-mce-href="https://kellssecurity.com/contact" href="https://kellssecurity.com/contact">get in touch</a> and I will help you set a family safe word up properly.</p>

The Simple Checks I Use to Stop AI Scams

Glowing blue padlock icon symbolizing digital security and financial data protection on dark background

<h2>Liverpool Is Finally Taking Cyber Safety Seriously</h2><p>For years I've watched people write off scams and hacking as something that happens to someone else, somewhere else. Not any more. I'm hearing from more Liverpudlians every month who've had a scam text, a dodgy email, or a mate who's lost money to a fake delivery link. The good news is that awareness is finally catching up with the threat, and that's half the battle won.</p><h2>Community Workshops Are Making a Real Difference</h2><p>Libraries, community centres and local groups across the city are running free sessions on staying safe online, and I love seeing it. These aren't dry lectures either. They're practical, hands on, and aimed at real problems: spotting a phishing email, setting a password you will actually remember, and understanding what your social media privacy settings are quietly sharing with the world. If you've never been to one, it's worth a look. And if you can't make it, that's exactly why I write this blog, so you get the same advice without leaving the sofa.</p><figure id="figure-s3klb32i15mt94tnnj"><img id="s3klb32i15mt94tnnj" src="https://rjdavx8ozyznxeyh.public.blob.vercel-storage.com/production/websites/infinite-images/f7560ae3-299d-46ad-b2c9-f1d38cc332c7-ZckZxGDw0hWr8JkEjKDU1YcUgynFuH.png" alt="Community group taking part in an online safety workshop in Liverpool" title="Community group taking part in an online safety workshop in Liverpool" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionX="undefined" data-positionY="undefined" data-fullWidth="false"/></figure><h2>Schools Are Teaching the Next Generation</h2><p>I'm genuinely encouraged by how many Liverpool schools now build online safety into the curriculum rather than treating it as an afterthought. Kids are growing up online from primary school onwards, so teaching them to spot a scam or think before they click matters just as much as teaching them to cross the road safely. It sets habits that last a lifetime, and honestly, some of what they're learning would do half the adults I know some good too.</p><h2>Small Businesses Are Stepping Up Too</h2><p>It's not just individuals either. More small businesses across Liverpool are taking cybersecurity seriously, and not before time, because a single phishing email can cost a small firm thousands and take months to recover from. I've written a full guide on <a data-mce-href="https://kellssecurity.com/blog/protecting-small-businesses-in-liverpool--cybersecurity-strategies-and-tips" href="https://kellssecurity.com/blog/protecting-small-businesses-in-liverpool--cybersecurity-strategies-and-tips">protecting small businesses in Liverpool</a> if that's you, covering the basics you need without the jargon or the eye watering price tag.</p><h2>How You Can Be Part of It</h2><p>You don't need to run a workshop or rewrite your company's IT policy to make a difference. Start small. Use a proper password manager instead of reusing the same password everywhere, <a data-mce-href="https://kellssecurity.com/blog/how-to-identify-email-phishing--tips-for-liverpool-residents" href="https://kellssecurity.com/blog/how-to-identify-email-phishing--tips-for-liverpool-residents">learn to spot the signs of a phishing email</a>, and report scams when you see them rather than just deleting and moving on, <a data-mce-href="https://www.actionfraud.police.uk/" href="https://www.actionfraud.police.uk/" target="_blank" rel="noopener">Action Fraud</a> makes it painless. Have a browse of my <a data-mce-href="https://kellssecurity.com/toolkit" href="https://kellssecurity.com/toolkit">Safety Toolkit</a> for the tools I actually use myself, or <a data-mce-href="https://kellssecurity.com/contact" href="https://kellssecurity.com/contact">get in touch </a>if you'd like some straight talking advice tailored to you or your business.</p>

Cyber Safety in Liverpool: What's Actually Working

High-definition close-up of photorealistic AI avatar face showing detailed skin texture and natural facial expressions

<h2>What AI Scams Actually Look Like</h2><p>AI has made scammers far better at their job, and that's not an exaggeration. Deepfake voice calls, chatbots that sound eerily human, and messages written to sound exactly like your bank or a family member. I've seen scam texts so convincing that switched on, careful people have nearly been caught out. Understanding how these scams work is the first step to spotting them before they cost you.</p><h2>The Myths That Get People Caught Out</h2><p>I hear the same handful of myths again and again, so let's clear them up. Myth one, antivirus software has you covered. It helps, but it was never built to catch a scammer pretending to be your grandson on the phone. Myth two, AI scams only target older or less tech savvy people. Rubbish. I've had messages from friends in their twenties who nearly fell for a fake delivery text. Myth three, a strong password solves everything. A strong password is one brick in the wall, not the whole wall. <a data-mce-href="https://kellssecurity.com/blog/how-to-set-up-two-factor-authentication" href="https://kellssecurity.com/blog/how-to-set-up-two-factor-authentication">Turn on two factor authentication</a> too, it takes five minutes.</p><h2>How to Spot One Before It Spots You</h2><p>A few signs crop up again and again once you know what to look for. A request for personal details out of nowhere, whether that's by email, text or social media. Pressure to act immediately, because scammers know that panic switches off your judgement. Links or attachments from someone you don't recognise, or from someone you do recognise but who's messaging oddly, these carry a lot of <a data-mce-href="https://kellssecurity.com/blog/how-to-identify-email-phishing--tips-for-liverpool-residents" href="https://kellssecurity.com/blog/how-to-identify-email-phishing--tips-for-liverpool-residents">the same warning signs as phishing emails</a>. If something feels off, it usually is, trust that instinct.</p><h2>Why Education Beats Panic</h2><p>The businesses and families who cope best with AI scams aren't the ones with the most expensive software, they're the ones who talk about it openly. If you run a small business, get your team talking about what a scam attempt looks like, it costs nothing and it works. If you want a proper primer on the wider landscape, <a data-mce-href="https://www.ncsc.gov.uk/" href="https://www.ncsc.gov.uk/" target="_blank" rel="noopener">the National Cyber Security Centre </a>publishes excellent free guidance, it's worth a bookmark. Stay curious, stay a little bit sceptical, and you'll be miles ahead of most scammers.</p><figure id="figure-md9b2rr848mt95cduw"><img id="md9b2rr848mt95cduw" src="https://rjdavx8ozyznxeyh.public.blob.vercel-storage.com/production/websites/infinite-images/77f18ac9-f4ec-4d5d-a8a1-2e626ae5ee9e-3BP7sPFidApJ1JZk7dBQAsvFvp2xQH.png" alt="Phone screen showing a security threat alert after an AI scam attempt" title="Phone screen showing a security threat alert after an AI scam attempt" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionX="undefined" data-positionY="undefined" data-fullWidth="false"/></figure>

AI Scams: The Cybersecurity Myths I Keep Hearing

Diverse team reviewing business dashboards and financial reports on laptops during collaborative meeting in modern conference room

<h2>What I Look at Before Recommending Anything</h2><p>Every business that asks me about cybersecurity thinks it needs the biggest, priciest package on the market. It usually doesn't. A five person accountancy firm in the city centre has completely different risks to a warehouse team handling stock for a national retailer. The first thing I do with any Liverpool business is work out what data you actually hold, who might want it, and what would genuinely hurt if it went missing. Get that right and the rest of the buying decision gets a lot simpler.</p><h2>The Non-Negotiables, Whatever Your Budget</h2><p>Some things aren't optional, no matter how small you are. A proper firewall, endpoint protection that actually updates itself, and backups that are tested, not just switched on and forgotten. I've seen businesses pay for expensive software and never once check whether their backup would actually restore anything. Set a calendar reminder and test it, it takes twenty minutes and can save you a very bad week. I've written before about <a data-mce-href="https://kellssecurity.com/blog/protecting-small-businesses-in-liverpool--cybersecurity-strategies-and-tips" href="https://kellssecurity.com/blog/protecting-small-businesses-in-liverpool--cybersecurity-strategies-and-tips">protecting small businesses in Liverpool </a>if you want the fuller version of this advice.</p><h2>Two Tools Worth Paying For</h2><p>Beyond the basics, the two upgrades I recommend most often are a proper password manager and a VPN for anyone working off site or on public wifi. If your team is still sharing logins on a spreadsheet, a tool like <a data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener">NordPass</a> sorts that out in an afternoon. <a data-mce-href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" target="_blank" rel="noopener">NordVPN</a> is worth having too if anyone on your team works from cafes, client sites, or home broadband you don't control. Neither costs much against what a breach would.</p><h2>Red Flags When You're Being Sold To</h2><p>Watch out for fear based sales pitches, generic package deals that ignore what you actually told them about your business, and contracts that lock you in for years with no way out. A good provider asks questions before they pitch anything. If a salesperson's first move is frightening you with ransomware headlines, that's a sign they're selling fear, not a solution built for you.</p><h2>Getting Started</h2><p>If you want a second opinion before you sign anything, my <a data-mce-href="https://kellssecurity.com/toolkit" href="https://kellssecurity.com/toolkit">Safety Toolkit</a> page lists the tools I actually use and recommend myself, and you're always welcome to <a data-mce-href="https://kellssecurity.com/contact" href="https://kellssecurity.com/contact">get in touch</a>. I'll give you my honest take, free of charge, no obligation.</p><figure id="figure-ug24nlms3cmt95qqo3"><img id="ug24nlms3cmt95qqo3" src="https://rjdavx8ozyznxeyh.public.blob.vercel-storage.com/production/websites/infinite-images/edc03490-ed72-4daa-8a11-0b3d261e10d3-Wf66mSYdxRliOQDchKeVCv2GvYvTcg.png" alt="Liverpool business team reviewing a cybersecurity dashboard in a meeting" title="Liverpool business team reviewing a cybersecurity dashboard in a meeting" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionX="undefined" data-positionY="undefined" data-fullWidth="false"/></figure>

My Buyer's Guide to Cybersecurity for Liverpool Businesses

Glowing digital nodes and connecting lines in blue and purple light, representing data analytics.

<h2>What's Actually Changing</h2><p>I read a lot of cybersecurity coverage that makes everything sound apocalyptic. Most of it isn't. What I'm actually seeing, working with people across Liverpool, is a shift in who gets targeted and how. It used to be mostly big companies. Now it's just as often an ordinary person checking their phone on the bus. The tools scammers use have got cheaper and easier, so the volume of low effort attacks has gone up even if the sophisticated ones haven't changed much.</p><h2>AI Is Changing Both Sides</h2><p>Scammers are using AI to write more convincing messages and clone voices, and I've covered some of<a data-mce-href="https://kellssecurity.com/blog/ai-scams-the-cybersecurity-myths-i-keep-hearing" href="https://kellssecurity.com/blog/ai-scams-the-cybersecurity-myths-i-keep-hearing"> the cybersecurity myths I keep hearing</a> about that. But the same technology is helping the good side too, spam filters and fraud detection have got noticeably better at catching things before they reach you. It's an arms race, and right now neither side is winning outright.</p><h2>Phishing Emails Are Getting Harder to Spot</h2><p>The obvious spelling mistakes and dodgy logos are mostly gone. Today's phishing emails often look identical to the real thing, right down to the footer. If you want the full detail on what to look for, I've written a guide on<a data-mce-href="https://kellssecurity.com/blog/how-to-identify-email-phishing--tips-for-liverpool-residents" href="https://kellssecurity.com/blog/how-to-identify-email-phishing--tips-for-liverpool-residents"> how to identify email phishing</a> that goes through it step by step. The short version is to check the sender's actual email address, not just the display name, before you click anything.</p><h2>The Basics Still Work</h2><p>With all this change, it's easy to think you need something complicated to stay safe. You mostly don't. Turning on<a data-mce-href="https://kellssecurity.com/blog/how-to-set-up-two-factor-authentication" href="https://kellssecurity.com/blog/how-to-set-up-two-factor-authentication"> two factor authentication</a> is still one of the single best things you can do, and a password manager like <a data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener">NordPass</a> takes away the temptation to reuse the same password everywhere. Neither takes more than a few minutes to set up.</p><h2>What I'd Focus On If I Were You</h2><p>If you only do three things this year, make it these. Turn on two factor authentication everywhere it's offered, get a password manager, and use a VPN like <a data-mce-href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" target="_blank" rel="noopener">NordVPN</a> whenever you're on public wifi. None of it is exciting, but it's the difference between being an easy target and not being worth a scammer's time. Have a browse of my<a data-mce-href="https://kellssecurity.com/toolkit" href="https://kellssecurity.com/toolkit"> Safety Toolkit </a>for the full list of what I actually use myself.</p><figure id="figure-zohy00qm9vmt965d8t"><img id="zohy00qm9vmt965d8t" src="https://rjdavx8ozyznxeyh.public.blob.vercel-storage.com/production/websites/infinite-images/3417f35f-9335-44f9-8dbf-b888f32cf9bd-vasG5njLPIxleZUm0fs7BRoapen3ht.png" alt="Laptop screen showing a secured system icon representing cybersecurity protection" title="Laptop screen showing a secured system icon representing cybersecurity protection" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionX="undefined" data-positionY="undefined" data-fullWidth="false"/></figure>

The Cybersecurity Trends I'm Actually Seeing in Liverpool

Sealed envelope with wax seal glowing under studio lighting against soft blurred background

<h2>Why Phishing Emails Work So Well</h2><p>Phishing isn't a technical attack, it's a psychological one. The email is designed to make you react before you think, using urgency, fear, or the promise of something good to short circuit your usual caution. That's why it catches out careful, switched on people just as often as anyone else. I've seen it happen to solicitors, accountants, people who spot scams for a living in every other part of their day. Knowing it's designed to rush you is half the defence.</p><figure id="figure-b9zao9h817mt9j0w8g"><img id="b9zao9h817mt9j0w8g" src="https://rjdavx8ozyznxeyh.public.blob.vercel-storage.com/production/websites/infinite-images/f03bf8e0-01bb-49ba-a409-b7b6816e10d4-w3YQja3emCHasEoPLCVFsQhfwCfaL4.png" alt="Close-up of laptopaLaptop screen showing a phishing email analysis with flagged sender and domain warnings screen showing advanced threat detection interface with phishing email analysis and authentication data" title="Close-up of laptopaLaptop screen showing a phishing email analysis with flagged sender and domain warnings screen showing advanced threat detection interface with phishing email analysis and authentication data" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionX="undefined" data-positionY="undefined" data-fullWidth="false"/></figure><h2>The Red Flags I Always Check First</h2><p>Before I do anything else with a suspicious email, I check three things. First, the sender's actual email address, not the display name, by tapping or hovering on it. Second, whether the message is creating pressure to act right now, a locked account, a missed delivery, a suspicious payment. Third, where the links actually point, which you can usually see by hovering without clicking. If any of these feel off, the email goes straight in the bin.</p><h2>What a Convincing Fake Actually Looks Like Now</h2><p>Forget the old advice about spotting bad grammar and broken logos. Today's phishing emails are often pixel perfect copies of a real bank or delivery company's template, sometimes pulled directly from the real thing. The only reliable tell left is the sender address and the destination of the links, everything else can be faked convincingly. This is one of<a data-mce-href="https://kellssecurity.com/blog/cybersecurity-trends-im-actually-seeing-in-liverpool" href="https://kellssecurity.com/blog/cybersecurity-trends-im-actually-seeing-in-liverpool"> the cybersecurity trends I've </a>written about that's changed the most in the last couple of years.</p><h2>What to Do If You've Already Clicked</h2><p>Don't panic, and don't beat yourself up, it happens to careful people. Change the password for that account straight away, and for any other account using the same password, which is exactly why a password manager like <a data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener">NordPass </a>earns its keep. <a data-mce-href="https://kellssecurity.com/blog/how-to-set-up-two-factor-authentication" href="https://kellssecurity.com/blog/how-to-set-up-two-factor-authentication">Turn on two factor authentication</a> if you haven't already. If you entered card details, ring your bank immediately. And if it's a work account, tell your IT contact even if it feels embarrassing, they would rather know.</p><h2>Building the Habit</h2><p>None of this needs to become a full time job. A five second pause before clicking anything, checking the sender, and having two factor authentication switched on everywhere it's offered will stop the vast majority of phishing attempts cold. If you want to report a phishing email you've received, <a data-mce-href="https://www.actionfraud.police.uk/" href="https://www.actionfraud.police.uk/" target="_blank" rel="noopener">Action Fraud </a>is the place to do it. And if you're not sure where to start, my <a data-mce-href="https://kellssecurity.com/toolkit" href="https://kellssecurity.com/toolkit">Safety Toolkit </a>has the tools I use and recommend myself.</p>