How much privacy do I want/need?

What a question! Total of course might be the first answer, but is it actually the right one. It’s an entirely personal choice, and you have to weigh up how much you want to share of yourself online, how much personal information you need to share online, and how to secure that which you have to provide online to obtain services. Yes – it’s not an easy question to answer! But first some highlights …

UK Government forces Apple to remove Advanced Data Protection for its users in UK

New rules to protect your rights and activity online in the EU

… and the UK’s GDPR post-Brexit

What goes on in the US Defense establishment?

Even IT experts can be duped!

Challenges for genealogy site

UK High Court forces Meta to consider a subscription model

Do you really need to do this to enter the US now?

The US CISA is seriously worried about protecting itself and its workers

How to avoid US-Based Digital Services—and Why You Might Want To

… and of course I couldn’t resist sharing this …

So where should we start. Well … I thought I’d just ask Perplexity and Claude to help me …

Perplexity advise me thus …

The amount of privacy you need or want depends on your personal values, lifestyle, and circumstances. Here are some considerations:

Factors Influencing Privacy Needs

1. Personal Boundaries: Privacy allows you to maintain control over sensitive information about yourself, such as financial, medical, or personal details.

2. Life Stage: Adolescents often need privacy to explore their identity and independence, while adults may seek it to protect personal data or maintain emotional boundaries.

3. Cultural and Social Context: In some environments, privacy can be a matter of safety (e.g., journalists in authoritarian regimes), while in others, it may be less critical.

Balancing Privacy and Openness
• Online Privacy: Use tools like password managers, VPNs, and privacy-conscious apps to protect your data.
• Relationships: Healthy relationships respect privacy but avoid secrecy that harms trust.
• Public Interactions: Avoid oversharing in public spaces or online forums to maintain control over your personal information.

Practical Steps
• Define what information you’re comfortable sharing.
• Use privacy tools to secure digital data.
• Communicate clearly about boundaries with others.
Ultimately, the right level of privacy is subjective and should align with your comfort level and values.

… whilst Claude “goes the extra mile” and provides me with a Comprehensive Personal Privacy Guide …

# Digital Privacy Mastery: Protecting Your Online Presence

## Digital Privacy Landscape

### Understanding Digital Privacy
Digital privacy is about controlling your personal information in the online world, protecting yourself from:
- Data collection and tracking
- Unauthorized access to personal information
- Potential misuse of your digital footprint
- Cybersecurity threats
- Online surveillance and profiling

### Digital Privacy Threat Landscape

#### Primary Digital Privacy Risks
1. **Data Harvesting**
- Corporate data collection
- Targeted advertising
- Behavioral tracking
- Comprehensive digital profiling

2. **Cybersecurity Vulnerabilities**
- Personal data breaches
- Identity theft
- Financial fraud
- Unauthorized account access

3. **Online Tracking Mechanisms**
- Cookies and tracking technologies
- Social media data mining
- Search engine tracking
- Cross-platform data sharing

### Digital Privacy Assessment Levels

#### Basic Digital Privacy (Beginner Level)
- Limited awareness of online tracking
- Minimal privacy settings
- Using default browser and app configurations
- Sharing personal information freely online

#### Intermediate Digital Privacy (Aware Level)
- Understanding basic tracking mechanisms
- Selective social media sharing
- Using some privacy tools
- Aware of potential online risks
- Implementing basic security measures

#### Advanced Digital Privacy (Expert Level)
- Comprehensive online protection strategy
- Minimal digital footprint
- Advanced encryption and anonymity tools
- Proactive threat monitoring
- Strategic online information management

### Comprehensive Digital Privacy Toolkit

#### 1. Personal Information Management
- Audit existing online accounts
- Minimize personal data sharing
- Use alternative/temporary contact information
- Create dedicated email addresses for different purposes

#### 2. Authentication and Access Control
1. **Password Management**
- Use complex, unique passwords
- Implement password manager
- Enable two-factor authentication
- Regularly update passwords

2. **Account Security**
- Review app and service permissions
- Disconnect unused accounts
- Use privacy-focused authentication methods
- Implement login alerts

#### 3. Browsing Privacy Techniques
1. **Anonymous Browsing**
- Use privacy-focused browsers
- Implement VPN services
- Utilize browser privacy extensions
- Enable do-not-track settings

2. **Tracking Prevention**
- Block third-party cookies
- Use anti-tracking browser extensions
- Disable location tracking
- Limit browser fingerprinting

#### 4. Social Media and Online Presence
1. **Platform Privacy Settings**
- Minimize public profile information
- Restrict personal data visibility
- Control tagging and sharing permissions
- Regularly audit connected applications

2. **Content Strategy**
- Be selective about online sharing
- Use pseudonyms when appropriate
- Understand platform data policies
- Implement content self-censorship

#### 5. Advanced Privacy Technologies
- Encrypted messaging apps
- Anonymous communication channels
- Decentralized network technologies
- Privacy-focused cloud services
- Secure file storage solutions

### Privacy Tools Recommendation

#### Essential Privacy Tools
1. **Browsers**
- Brave
- Mozilla Firefox (with privacy extensions)
- Tor Browser

2. **VPN Services**
- ProtonVPN
- Mullvad
- NordVPN

3. **Password Managers**
- Bitwarden
- 1Password
- LastPass

4. **Tracking Blockers**
- uBlock Origin
- Privacy Badger
- NoScript

5. **Encrypted Messaging**
- Signal
- Telegram (secret chats)
- Wire

### Psychological and Practical Considerations

#### Digital Privacy Mindset
- Treat personal data as valuable asset
- Develop critical thinking about online sharing
- Stay informed about privacy technologies
- Cultivate a proactive privacy approach

#### Continuous Privacy Improvement
1. Regular privacy audits
2. Stay updated on emerging threats
3. Adapt privacy strategies
4. Learn from privacy best practices
5. Invest in privacy education

### Legal and Ethical Dimensions
- Understand data protection regulations
- Know your digital rights
- Recognize ethical data use
- Support privacy-focused initiatives

### Conclusion: Your Digital Privacy Journey
Digital privacy is an ongoing process of:
- Awareness
- Strategic management
- Continuous learning
- Technological adaptation

**Key Takeaway**: Your digital privacy is a personal responsibility and a fundamental right in the digital age.

### Action Plan
1. Conduct immediate privacy audit
2. Implement basic protection tools
3. Develop privacy-conscious habits
4. Continuously educate yourself
5. Regularly reassess your digital privacy strategy

… so with that, I might as well stop and let AI take over!!!! Here’s Claude’s presentation …

# Securing Your Digital Privacy

## Table of Contents
1. Understanding Digital Privacy
2. Risks in the Digital Landscape
3. Protective Strategies
4. Essential Tools and Techniques
5. Best Practices for Everyday Protection

---

## 1. Understanding Digital Privacy

### What is Digital Privacy?
Digital privacy is the protection of personal information in the online world, encompassing:
- Personal data protection
- Control over personal information sharing
- Prevention of unauthorized access to digital identities
- Maintaining anonymity and security in digital interactions

### Why Does Digital Privacy Matter?
- Prevent identity theft
- Protect personal and financial information
- Maintain personal autonomy
- Avoid targeted manipulation
- Safeguard professional and personal reputation

---

## 2. Risks in the Digital Landscape

### Common Digital Privacy Threats
- Data breaches
- Phishing attacks
- Social engineering
- Tracking and profiling
- Unauthorized data collection
- Malware and ransomware

### Potential Consequences
- Financial fraud
- Personal information exposure
- Reputation damage
- Stalking and harassment
- Professional and personal discrimination

---

## 3. Protective Strategies

### Personal Information Management
- Minimize personal data sharing
- Use privacy settings on social media
- Be cautious about online forms and surveys
- Regularly audit online accounts and permissions

### Digital Footprint Reduction
- Use pseudonyms when possible
- Limit personal information in public profiles
- Be mindful of location sharing
- Regularly delete unnecessary online accounts

---

## 4. Essential Tools and Techniques

### Privacy-Enhancing Technologies
1. **Virtual Private Networks (VPNs)**
- Encrypt internet connection
- Mask IP address
- Recommended Services:
* ProtonVPN
* Mullvad VPN
* NordVPN

2. **Secure Messaging Apps**
- End-to-end encryption
- Recommended Apps:
* Signal
* WhatsApp
* Telegram (secret chats)

3. **Password Managers**
- Generate and store complex passwords
- Recommended Tools:
* BitWarden
* LastPass
* 1Password

4. **Browser Privacy Tools**
- Privacy-focused browsers
- Browser extensions
- Recommended Options:
* Brave Browser
* Firefox with privacy extensions
* DuckDuckGo Privacy Browser

---

## 5. Best Practices for Everyday Protection

### Practical Privacy Tips
- Use two-factor authentication
- Regularly update software and devices
- Be skeptical of unsolicited communications
- Use unique passwords for each account
- Enable encryption on devices
- Avoid public Wi-Fi without VPN protection

### Online Behavior
- Think before posting
- Limit personal information sharing
- Be aware of app permissions
- Regularly review privacy settings
- Use privacy-focused search engines

---

## Additional Resources

### Recommended Websites
- [Electronic Frontier Foundation (EFF)](https://www.eff.org/)
- [Privacy Tools](https://privacytools.io/)
- [Have I Been Pwned](https://haveibeenpwned.com/)

### Learning More
- Take online privacy courses
- Follow cybersecurity blogs
- Stay informed about latest privacy technologies

---

## Conclusion

### Your Digital Privacy is Your Right
- Be proactive
- Stay informed
- Continuously educate yourself
- Protect your digital identity

*Remember: Digital privacy is an ongoing process, not a one-time solution!*

… that’s just too much to take-in isn’t it, so I think I still have a place, and I’ll simplify things down to just a few points – but please take note of both of these AI contributions as a checklist to visit and re-visit on a regular basis.

So my plan is to cover the following:

Safeguarding

  • Cookies – Deny usually works (but you may need to temporarily switch off adblockers if the site is of particular value/importance to you – but remember to switch it back on afterwards. Alternatively – look for a different site that doesn’t impose that requirement. It’s nearly always imposed to get marketing information from you – what you’re doing, what you’re looking at, where you are, what you’re buying etc etc.
  • Adblockers – these protect you from yourself to some extent, as you won’t see adverts that you might be tempted to click on; but they also remove invasive ads from appearing on your screen and interrupting your reading. They should also prevent pop-ups (in small windows) appearing – but be aware that some websites have this facility hard-wired into their code, so the best solution is to avoid such websites as you can’t switch-off the pop-ups. Claude gives advice on the best ad blockers available …
Choosing the best ad blocker depends on your specific needs, such as browser compatibility, customization options, and additional features like privacy protection. Here are some of the top ad blockers for different scenarios:

## Top Ad Blockers for 2025

### 1. **AdGuard**
- **Best For:** System-wide ad blocking and broad compatibility across multiple browsers and devices.
- **Features:** Offers robust app coverage, parental controls, browsing security, and a VPN. It has a user-friendly interface and provides detailed statistics on blocked ads.
- **Compatibility:** Browsers, Windows, macOS, Android, and iOS.
- **MV3 Compliance:** Yes, with a compliant beta extension for Chrome.
- **Cost:** Starts at $29.88, with plans covering up to nine devices[1][2].

### 2. **uBlock Origin**
- **Best For:** Customization and Firefox users.
- **Features:** Highly customizable with the ability to add custom filters and scripts. It is free and open-source.
- **Compatibility:** Primarily for browsers.
- **MV3 Compliance:** No.
- **Cost:** Free[1][3].

### 3. **Total Adblock**
- **Best For:** Ease of use and YouTube/Facebook ad blocking.
- **Features:** Blocks third-party trackers, improves page load times, and offers a premium plan with antivirus software.
- **Compatibility:** Browsers.
- **MV3 Compliance:** Currently unaffected but lacks a clear transition plan.
- **Cost:** Free version available, with premium starting at $1.59/mo[2].

### 4. **Surfshark CleanWeb**
- **Best For:** Unlimited devices and VPN integration.
- **Features:** Blocks ads across multiple devices, including smart TVs, and offers VPN benefits like data encryption and phishing protection.
- **Compatibility:** Unlimited devices, including smart TVs.
- **MV3 Compliance:** Unaffected.
- **Cost:** Bundled with Surfshark VPN[2].

### 5. **Ghostery**
- **Best For:** Privacy-focused users.
- **Features:** Offers anti-tracking features and detailed ad-blocking statistics.
- **Compatibility:** Chromium-based browsers, Android, and iOS.
- **MV3 Compliance:** Yes.
- **Cost:** Free, with premium options available[1][3].

### 6. **Adblock Plus**
- **Best For:** General ad blocking with acceptable ads feature.
- **Features:** Allows acceptable ads to support websites, with a user-friendly interface.
- **Compatibility:** Chrome and other browsers.
- **MV3 Compliance:** Not specified.
- **Cost:** Free[8].

### Comparison Table

| Ad Blocker | Best For | Compatibility | MV3 Compliance | Cost |
|------------|---------|---------------|----------------|------|
| AdGuard | System-wide blocking | Browsers, Windows, macOS, Android, iOS | Yes | $29.88+ |
| uBlock Origin | Customization, Firefox | Browsers | No | Free |
| Total Adblock | Ease of use, YouTube/Facebook | Browsers | Unaffected | $1.59/mo+ |
| Surfshark CleanWeb | Unlimited devices, VPN | Unlimited devices | Unaffected | Bundled with VPN |
| Ghostery | Privacy features | Chromium-based browsers, Android, iOS | Yes | Free+ |
| Adblock Plus | General ad blocking | Chrome and other browsers | Not specified | Free |

Each of these ad blockers offers unique benefits depending on your priorities, whether it's customization, privacy, or ease of use.

Sources
[1] Best Ad Blockers of 2025 - Cookies https://www.aboutcookies.org.uk/ad-blockers
[2] Best Ad Blockers That Still Work in Chrome March 2025 https://allaboutcookies.org/best-ad-blockers-for-chrome
[3] The Best Ad Blockers for 2025 - PCMag https://www.pcmag.com/picks/best-ad-blockers
[4] What is the best AdBlocker for Chrome? (browser opinions aside) https://www.reddit.com/r/Adblock/comments/1ex5hyq/what_is_the_best_adblocker_for_chrome_browser/
[5] Best ad blockers of 2025 - TechRadar https://www.techradar.com/pro/best-ad-blockers
[6] AdBlock — block ads across the web - Chrome Web Store https://chromewebstore.google.com/detail/adblock-%E2%80%94-block-ads-acros/gighmmpiobklfepjocnamgkkbiglidom
[7] Best Ad Blocker 2025 | My top choices that REALLY work! - YouTube https://www.youtube.com/watch?v=92ITOpOxRcQ
[8] Adblock Plus | The world's #1 free ad blocker https://adblockplus.org

… add to this Magic Lasoo if you use Apple kit with the added benefit that it blocks ads on YouTube if you view through Safari [otherwise you’ll need to consider purchasing YouTube Premium at £12.99pm, which might be worth it if you’re a big YouTube watcher].

  • Password managers

A subject we’ve looked at before; recommended password managers would be one from this article, 1Password has my son’s recommendation; but as you know I rely on the less feature-rich but very effective – within a 100% Apple environment – Password app (using iCloud Keychain)

  • Two factor authentication (2FA)

You might care to look at this page from the BBC on 2FA as well – I would recommend using Authy, if you go down the third-party authenticator route

[A Postscript from Signal – 28/03/2025]

I don’t think I mentioned it yesterday but with an increasing number of apps, the two above included, you don’t need to provide login credentials, you can “Login with Apple” or Google, and I think Microsoft for some. This means the app account is tied to your Apple account (or whatever) and an anonymous userId is created which provides privacy as well as not needing to create a password as well.

Thus your Apple account (or whatever) provides a single sign on (SSO) option which provides increased privacy. This article – https://www.macworld.com/article/234043/sign-in-with-apple-faq-what-you-need-to-know-about-apples-single-sign-on.html – provides more information on the approach and makes the case for using SSO with Apple over other possibilities.

Having an Apple account (used to be called AppleID) is not restricted to having an Apple device either – https://macreports.com/what-you-can-do-with-an-apple-id-without-an-apple-device/ – so it might be worth considering getting one, if Privacy is important to you.

  • Don’t proceed with Free option, or 7-day trial if ads appear immediately you take your first step (eg I followed after research a link to the best recommended software for a particular purpose, but after I downloaded it – no problems, I was immediately bombarded by ads when I started the app up with the plea to pay for an ad-free version), and don’t take the 10% off next purchase offer – this is a particularly insidious “trick” often linked to travel websites, where you are offered 15% off your next purchase, only to find that by clicking on the link you have to provide information, or permission, to send personal information to other businesses.
  • Be mindful of links on purchase sites – similar to the above, but just be aware that the re-direction takes you away from the original website where you might have felt relatively safe. On that not, always use a Credit Card for online purchases (or Apple or Google Pay, or Paypal) as you’re provided with some protection against fraud.
  • Beware of location tracking – switch-off all that don’t need your location to work. In your apps just be aware that not all apps need to know where you are – maps … yes; weather – maybe; asda – not really!
  • Privacy settings in apps – Facebook, Google

Facebook (from Perplexity) …

To enhance your privacy on Facebook, here are key settings to adjust:

1. Control Who Sees Your Posts
Go to Settings & Privacy > Settings > Privacy.
Adjust the audience for your posts: choose "Friends," "Only Me," or customize it further. Avoid "Public" for maximum privacy.

2. Manage Profile Visibility
Edit your "About" section to limit shared details like work, education, and contact info. Set visibility to "Friends" or "Only Me".
Turn off search engine linking to your profile under Settings & Privacy > How People Find and Contact You.

3. Secure Your Account
Enable two-factor authentication and use a strong password.
Regularly review apps connected to your account and remove unnecessary ones.

4. Limit Old Posts
Use the "Limit Past Posts" option in Privacy Checkup to restrict visibility of older posts.

5. Control Tags and Posts on Your Profile
Under Profile and Tagging, decide who can post on your profile and who can see tagged posts. Set to "Friends" or stricter options.

6. Ad Preferences
Turn off personalized ads by reviewing ad preferences in Settings & Privacy > Ad Preferences.

Review these settings periodically for better privacy control!

… and remember my advice to logout from Facebook and Instagram after use. A belts and braces protection of your privacy.

Then for Google, start at accounts.google.com

Screenshot

Perplexity on Google Privacy settings gives me …

Google offers several privacy settings to help users control their data and online experience. Here are key privacy settings you should consider adjusting:

Web & App Activity
Turn off this master privacy control to limit Google's collection of your search history, location data, and app usage. To do this:
Go to any Google website
Click on your profile picture
Select "Google Account"
Navigate to "Data & Privacy"
Find "Web & App Activity" and turn it off

Location History
Disable location tracking by turning off both Web & App Activity and Timeline (formerly Location History). This prevents Google from storing detailed information about your movements.

Auto-Delete Options
If you prefer to keep some features enabled, set up auto-delete for your data:
Go to "Privacy & Personalization"
Select "Web & App Activity" or "Timeline"
Choose "Auto-delete" and set your preferred time period

Ad Personalization
Limit targeted advertising by adjusting these settings:
Go to "Privacy & Personalization"
Find "Ad Personalization"
Turn off personalized ads

Chrome Privacy Settings
For Chrome users, consider these adjustments:
Disable automatic sign-in: Settings > Sync and Google Services > Turn off "Allow Chrome Sign-In"
Sign out of Chrome: Click your profile picture > Sign out
Manage sync settings: Settings > Sync and Google Services > Manage What You Sync

Additional Controls
Review and limit data sharing with third-party apps and services
Use Google's Privacy Checkup tool to review and adjust your settings
Explore the "Data & Privacy" section in your Google Account for more options

Remember, while these settings can enhance your privacy, they may also affect some Google services' functionality. Regularly review and update your privacy settings to maintain your desired level of data protection.

Options you might consider …

  • Subscription rather than free – a hobby horse of mine! If it’s worth using, it’s worth paying for – especially if it prevents your information being sold on to other sites, or marketing organisations.
  • Privacy focussed solutions as a choiceProton vs Google;
  • Open source as a consideration – always investigate whether there is a FreeWare or DonationWare option, and then consider offering a subscription is requested – Wikipedia, Signal, Libre, etc etc
  • Wise choices when downloading – be sure of the website before you download software
Here are some of the best sites for downloading safe freeware:

1. **FileHippo**
- **Features**: Offers a wide range of current apps, categorized for easy navigation. Provides older versions of software, which can be useful if newer versions cause issues.
- **Benefits**: Properly labels any additional software offers, making it easy to avoid unwanted downloads[2].

2. **Softpedia**
- **Features**: Over 1 million software titles, regularly updated and checked for malware. Offers mirrors for previous versions of programs.
- **Benefits**: Detailed descriptions, user reviews, and editor ratings help ensure safe downloads[1][2].

3. **MajorGeeks**
- **Features**: Long-standing reputation for reliability, with a curated list of top freeware picks.
- **Benefits**: Known for its trustworthiness, despite a somewhat outdated interface[2].

4. **SnapFiles**
- **Features**: Highlights a "Freeware Pick" and a "Random Pick" to discover new apps. Includes user reviews and warnings about bundled software.
- **Benefits**: Offers a section for portable programs, ideal for running apps without installation[2].

5. **Ninite**
- **Features**: Allows downloading multiple apps at once, automatically rejecting toolbars and unwanted software.
- **Benefits**: Ideal for setting up new PCs or reinstalling software securely, with background updates[2].

6. **Tucows**
- **Features**: Established reputation with a wide range of software available.
- **Benefits**: Known for reliability and safety, though less frequently updated[1].

7. **Portable Freeware**
- **Features**: Curated directory focusing on portable freeware with comprehensive descriptions and user comments.
- **Benefits**: Ensures software runs without installation and leaves no traces on the host machine[3].

8. **Chip.de/Chip.eu**
- **Features**: Offers a variety of software with hints about potential toolbars or adware within the software itself.
- **Benefits**: Known for avoiding adware wrappers in downloads[1].

9. **Nonags**
- **Features**: Specializes in non-adware freeware, ensuring safe downloads.
- **Benefits**: Ideal for those seeking software without bundled unwanted programs[1].

10. **GitHub**
- **Features**: A platform primarily for open-source software development, offering a wide range of free and safe software.
- **Benefits**: Software is often reviewed and audited by the community, ensuring safety and quality[3].

Sources
[1] what's your trusted site for freeware? (sourceforge ect.) : r/software https://www.reddit.com/r/software/comments/1xwokn/whats_your_trusted_site_for_freeware_sourceforge/
[2] Safest Websites to Download Windows Software - Bug Zero https://blog.bugzero.io/safest-websites-to-download-windows-software-ffff6b2e152b
[3] Best Website for downloading Freeware Software? - Bogleheads.org https://www.bogleheads.org/forum/viewtopic.php?t=404839
[4] The best free software that's completely safe (we've checked) https://www.which.co.uk/news/article/the-best-free-safe-software-ajW7U4V3dBVU
[5] CNET Download: Free Software Downloads and Reviews for ... https://download.cnet.com
[6] The 10 Safest Free Software Download Sites for Windows in 2023 https://www.youtube.com/watch?v=KCaTww_6YcY
[7] Top 10 Sites to Download Free PC Games Completely Safe and Legit https://www.movavi.com/learning-portal/sites-to-download-free-pc-games.html
  • A VPN offers a degree of protection (even with a cell connection)
Using a VPN while connected to a cellular internet connection is not strictly necessary but is highly recommended for several reasons:

### **Why Use a VPN on Cellular Data?**
1. **Enhanced Privacy**:
- Cellular providers can track and log your online activity. A VPN encrypts your data, preventing your Internet Service Provider (ISP) from monitoring or selling your browsing habits[2][3][4].

2. **Increased Security**:
- While cellular networks are generally more secure than public Wi-Fi, they are not immune to threats like phishing or malicious attacks. A VPN adds an extra layer of encryption to protect sensitive information[1][2][3].

3. **Bypass Geo-Restrictions and Throttling**:
- A VPN allows you to spoof your IP address, enabling access to region-specific content or bypassing ISP throttling during high-bandwidth activities like streaming or gaming[2][3].

4. **Protection Against ISP Tampering**:
- Some ISPs compress or modify website content for mobile browsing. A VPN ensures you access unaltered content[1].

### **When You Might Not Need a VPN**
- If your primary concern is casual browsing or using apps like WhatsApp or Facebook, and you trust your cellular provider, a VPN might not feel essential[5].
- Using a VPN increases data usage (by 5–15%) and can drain your battery faster, so it may not be ideal if you're on a limited data plan or low battery[1][2][4].

### **Conclusion**
While cellular networks are safer than public Wi-Fi, using a VPN enhances privacy and security. It is particularly valuable if you frequently handle sensitive data, want to avoid ISP tracking, or access geo-restricted content. However, consider the trade-offs in terms of data usage and battery life.

Sources
[1] Does a VPN work on mobile data? - Surfshark https://surfshark.com/blog/does-vpn-work-on-cellular-data
[2] Should you use a VPN when connected to cellular data? | Tom's Guide https://www.tomsguide.com/computing/vpns/should-you-use-a-vpn-when-connected-to-cellular-data
[3] Does VPN work on mobile data? - Cybernews https://cybernews.com/what-is-vpn/does-a-vpn-work-on-mobile-data/
[4] Does a VPN work without Wi-Fi? - NordVPN https://nordvpn.com/blog/does-vpn-work-without-wifi/
[5] Who here uses VPN when on mobile data? - Reddit https://www.reddit.com/r/VPN/comments/n8x2kv/who_here_uses_vpn_when_on_mobile_data/
[6] Do you need a VPN on your phone? Here's the truth. - Mashable https://mashable.com/article/do-you-need-a-vpn-on-your-phone
[7] Why You Need a VPN on Your Smartphone | McAfee Blog https://www.mcafee.com/blogs/mobile-security/privacy-please-why-a-vpn-on-your-smartphone-may-be-a-smart-move-for-you/
[8] Do I Really Need a VPN at Home? - PCMag https://www.pcmag.com/how-to/do-i-need-a-vpn-at-home

So it’s up-to-you – how much privacy do you actually want; how much privacy do you need!

Prevention and protection from Scams

And so we turn to passwords and online security. I’ve dealt with this at some length previously in a post entitled “Keeping safe online” which I last updated in May 2023, and although much of it is still relevant and most, if not all, of the links are still working, I thought to write something from scratch, rather than do another edit/revision.

I’m going to skip to the content at the end of the article referred to above and pick-up the theme of Passwords, Passkeys and Two-Factor Authentication (TFA).

First-of-all – you want a fright? Try typing your favourite password(s) – you do have more than one, don’t you? – into this website.

Secondly, check to see just how vulnerable your email address might be, using …

Screenshot

… go to haveibeenpwned? – and if you want to know what pwned means, and how to pronounce it, look here. If a service you use is in this list, you seriously should change your password!

Another approach is to use a tool that looks at your “digital footprint” to examine where you might be exposed. Such a tool is this one from Malwarebytes.

So that’s got your attention, right? You really need to deploy/use a Password Manager to hold your passwords – preferably one that is usable/consistent across all your devices. Two such products are 1Password and Dashlane. Both of which get very good reviews.

The alternative to using a Password Manager application is to use the password security offered by your browser. In Apple’s case this is iCloud Keychain – which stores the passwords – with its associated Passwords app; in Google’s case this is Google Password Manager. Both of these now offer support from one ecosystem to the other – so multi-platform users can choose one or the other. Microsoft also offer a Password Manager using the Edge browser, but its features are possibly not as well developed as those of Apple or Google, nor of dedicated password manager applications such as 1Password or Dashlane which score best with users who have a mixture of Microsoft, Apple and Google devices and applications.

And now we have Passkeys. When assessing whether you want to move to a Password Manager, you MUST check that the chosen one supports Passkeys as defined in the FIDO Alliance …

… and the key to its success and inter-operability is its integration with biometric signatures. So Passkeys are the platform for increased and improved internet security and should be welcomed with open arms – for Apple, for Google and for Microsoft.

If a Passkey can’t be employed on your favourite website, or even if they are, you may be asked to use 2FA (two-factor authentication). Using this means that when you’ve typed in your username and password you’ll be challenged to provide a code from a mobile phone, an authenticator app such as Google Authenticator, or go to another app (particularly if its a Google app), and do that extra second step (hence 2FA) to authenticate you are who you are.

We’re entering the passwordless world. It’s long overdue!

Finally, some other links to help you navigate the digital security world.

7 phone apps you need to secure right away – if you value your privacy – this could have formed the basis of an article in itself. It’s important to just check you’re doing the best you can to secure your favourite apps.

Best antivirus: Which? Best Buys and expert buying advice – a review for both PCs and Macs of anti-virus software – of course you could just be relying and using Windows Defender (for Windows) or nothing at all (if on a Mac), both of which are acceptable decisions, which then leads into …

Everything you need to know about cybersecurity basics – an inventory of terms, some with links to free tests, and the option to purchase tools. The definitions of terms are good.

Online learning events from the u3a – especially a recurring event “Staying Safe Online – A u3a Presentation with Q&A”

Scams – Part 2

Almost exactly a year ago I posted on this site, and on the Cardiff u3a Digital Matters webpage, an account of one of our member’s encounter with the Windows Defender pop-up scam.

It was indeed pleasing to be able to report that the member resolved the problem and it didn’t re-occur – as far as I know – but pop-up scams are a concern and this short post just gives some illustration of what the issue is, plus some advice on how to resolve the problem if you find your machine has been “taken over”.

I like this US video from the FTC (Federal Trade Commission) which explains the issue really well …

… and their are many more videos on scams, identity theft and the like on their website.

Perhaps the most common scam is the Tech Support Scam – which is what the Windows Defender one mentioned above was. The objective of the scammer is to get complete control of your computer by persuading the user they have a problem which can be resolved by you letting them “repair” the problem remotely – so please let them have your userid and password. Quite the opposite of course – the result will be either you’re locked out of your computer whilst the scammer harvests your personal details (bank accounts, etc), or they are going to implant malware so that they can record what you’re doing online, or use your computer as a relay (an intermediary) for other attacks on other services. Not a happy place to be then!

So read this article carefully. It describes in far greater depth and detail what these scams are and how you can remove pop-ups.

A more extensive article which explains how to reduce and remove malware from a Windows PC is provided here.

Scams – Part 1

[A short series of posts that I aim to also put up on the Digital Matters page of the Cardiff u3a website]

If you watched Rip Off Britain on January 15th [Episode 35 of Series 15 at c. 29mins 45secs into the programme] you will see an expert describe the Scam that one of our members has experienced recently and which has led me to write this post which may well be the first of a number on the subject of Scams.

This scam manifests itself by your computer screen being taken over by a popup which also freezes your screen. You are instructed by a voice-over not to turn off your machine but instead to ring a telephone number where you will be “assisted” to unlock your computer which has been locked – in this case supposedly by Microsoft, but it could be any large tech company – for your protection.

This alarming message plus the fact that your screen has frozen may lead you into thinking you better click on the button to seemingly connect to Microsoft. This will lead to a telephone conversation where you will be requested to supply information that will undoubtedly lead to fraud.

Do nothing!

Note well: No tech company will approach you in this way. They will not be doing this form of online monitoring of your devices. In this case the scam is preying on the fact that you are being led to think that your Windows Defender Security package is not working properly. No tech company would readily admit to its users of a deficiency in their programs in this way – that could lead potentially to legal action being taken against them. For a genuine issue they might issue an alert on their webpages and a request to upgrade (or whatever), or they might be forced to send an email to registered users, but they would not send unsolicited messages in this way.

It is important to realise that with this scam, at this stage, the scammers know NOTHING about you. The scam works by malicious code having been added to a website you are visiting, or to an advert on the website you are visiting. The simple solution is to press F11 to unlock your screen, note the website address and make a note not to go to that site again. [I would probably also recommend clearing your internet cache and history from your browser before closing down your computer; waiting a few moments; and then re-booting it.]

The more long-term solution is to install an Ad Blocker such as AdBlock Plus as an extension to your browser. This would act in conjunction with your standard security software which on a Windows machine could well be Windows Defender.

Happy, safer surfing.

If you want to see the recording of the message that our Digital Matters member made of the scam, watch the video below …

Keeping safe online

The threats – real and perceived

[First posted 10 September 2020]
[minor changes 21 June 2021]
[Revised 24 May 2023]
[MINor changes 25 January 2025 – links checked]
Luckily, there’s plenty of advice and guidance available – often slanted particularly towards our demographic (ie oldies) …
Those two sites are particularly easy to follow and understand, but others are equally informative and targeted. Your bank probably has guidance which it publishes online and which is accessible to everyone, not just their customers …
I’ll return to further information, guidance and references at the end of this post, but first we need to look at a few issues, discuss some terminology that’s widely used and try and tease out what’s really important, and what’s just an inconvenience and then it’s up to you to judge where you find yourself on the scale of …

Terrified -> Apprehensive -> Sensibly Aware -> Relaxed -> Unconcerned

First let’s distinguish the difference between online security and online privacy. These are two different issues which are however linked. Sometimes you have to relinquish some privacy to receive a service – unless you choose to pay for it (and I’ve long been an advocate of paying for services if they do a job that is necessary); exactly how much privacy are you prepared to relinquish? Security on the other hand is an absolute – you should not be prepared to accept less than your very best efforts . We’ll deal with that in the third part of the post.

How do you relinquish your privacy, and how much of a loss of privacy is acceptable?

Some services could not be offered without income from adverts, or paid-for advertising – eg Facebook, Twitter and Instagram; and some eg Google and Amazon track and provide information to resellers if you don’t block them from doing so. As an example of how much value Google sees in getting knowledge of what you’re doing and where you’re doing it, they pay Apple up to $20bn annually to remain as the default search engine for any browser that’s running on an Apple device! Sometimes you may click on a link and have been asked whether you wanted to accept cookies – what exactly are they, and what do they do. This article from Norton explains what they do quite well … Essentially, they record what you do on a website so that when you return to it some of the settings are remembered and applied. Cookies do however also have a downside in that some can also act to track your activity once you’ve left the site. For that reason, you should disable in your browser the ability of third-parties to glean information from a cookie, and also to prevent them tracking your activity once you’ve left the site. You can at anytime, clear the cookies from your browser, and indeed on some internet browsers set them up to delete cookies when you leave (close the window) the site. If you use Firefox as your browser it will alert you the first time you go to a site that it is using a Fingerprinting cookie itself. For instance from the Norton site above … … this is a nice feature, and should not be confused with the rather more annoying GDPR pop-ups which almost force you to accept because you can’t be bothered to check the detail that some sites force you to go to in selecting which cookies you want to store. I often just stop using that site rather than read through the options, or alternatively just click “Accept” and hope for the best!! Not exactly the privacy control that was envisaged when the legislation was enacted! Another thing you should consider is whether you want adverts to be shown, or not. You might get a request to enable adverts when you visit a site, the answer you supply will be held in a cookie in the browser – that’s how cookies work. Firefox, Brave and Microsoft Edge, by default, block most, if not all, adverts. These are often annoying and having a browser that blocks adverts, or if you use Chrome – using an ad-blocker like AdBlock Plus often makes for a more “pleasurable browsing experience” by limiting the intrusion you might feel upon your privacy.

Which brings us to browsers and search engines

Search engines are not created equal! Whilst Google is often thought to be the same as the internet and is often mistaken to be an internet browser itself, it is in fact just one of a range of possible search engines that you can use to look for information on the internet. It uses a platform called Chromium to display the results of its searches to you through a browser called Chrome. However, other browsers – Microsoft’s Edge, Brave and Opera all use the same underlying Chromium technology – the difference being they don’t track what you’re doing “to present the content that most meets your needs” (Google’s philosophy) and in some cases (eg Brave) they can actually prevent tracking of your browsing history. I use Safari – which on Apple is my default browser choice, but otherwise I would use either Brave or Firefox as my internet browser. So what safe and private search engine could you use as an alternative to Google. I use DuckDuckGo
… but others I could have used might have been Ecosia, Bing, Yahoo or another one you might choose from this article or the list of other articles at the end of it …
There are many specialist search engines (as explained in the above article) that can give you much better, and more targeted results than a broad-spectrum Google search with the priority of results returned by relevance, not payment received by Google. Finally, no discussion of Privacy can ignore Social Media and Facebook in particular. These applications, if left to their own default settings, are effectively personal information mining engines. They grab what information they can from you, and sell it on to whoever is willing to pay for it; or are indeed the platform for data mining, vis the Cambridge Analytica affair. Recent enforcement of data privacy legislation by the EU on Meta has resulted in them being hit with massive fines for breaches of GDPR law by Facebook, Instagram and WhatsApp. Online retailers are not exempt from this and Amazon for instance has a wonderful record of your browsing history! Are you sure you know what it’s doing with that information? So look at this table taken from a recent Which? supplement – Staying Secure in a Digital World – and just check whether you need to change your settings if you use any Social Media apps …
So that’s Privacy dealt with.

Should you be frightened?

The take away message I want you to have is Frightened – no; cautious – yes! Online banking is very secure – a recent survey in Which? produced the following scores …
… plus you are protected and most of the banks are increasingly opting to adopt an online and mobile guarantee to refund you where you’ve been the innocent victim of a fraud. Here for instance is Barclay’s “Online and Mobile Banking Guarantee.” They really don’t want to shell out money, so they are trying to educate us to be wise to scams. So let’s take a scam test
Banks are also often supplying software free (or at reduced cost) for you to install to protect your machine, to protect you from fraud – and of course themselves from having to pay out! I was recently offered a piece of software called Malwarebytes by the NatWest and although I have an Apple Mac computer which are well known to be relatively secure from Viruses, Spyware, Trojans and other malware, I installed it. I was pleased to note that I didn’t have any malware on the machine. Surprisingly you might think … it’s safer to use the mobile app on your phone, or tablet to do online banking and retail purchases than a web browser. This is because the app on the mobile device has to be verified by Google for Android (Google Play Store) or Apple for iOS/iPadOS (Apple Store). Whereas a browser could be infected, or compromised with malware. [That’s something I’ve learnt whilst preparing this post!!!] When you’re out and about and NEED to do an online transaction from your mobile – use cellular rather than WiFi. The latter can be really open to “sniffers”. [I must admit I try to avoid doing online transactions when away from a domestic network.] Alternatively consider buying and installing Virtual Private Network (VPN) software, such as NordNet so that you can use the free public WiFi in a public area. You can find out a whole lot about the range of scams at the NatWest’s Security Centre. However the most scary scam I’ve been made aware of is one that befell a member of my family when they were distracted sufficiently to become the victim of SIM swapping.
I’ve discussed this with you before and you can  read the updated post here. I also covered this issue in another post which involved stealing a phone, to obtain access to your identity and commit fraud, and we covered the even more disturbing theft of a credit card with the complicity of the US Postal service to obtain a SIM in a recent meeting as well.

What should you do to protect yourself?

Some of these pieces of advice are really quite straightforward, but some require some intervention by yourselves.
  • Keep your operating software up to date. This is particularly true if you’re a Windows user, and even more true if you are still running an older version of Windows than Windows 10. If you’re using Windows XP, Windows Vista or even Windows 7 you should seriously consider disconnecting your machine from the internet because even if you’ve got anti-malware software running this is probably not protecting you against the latest threats.
  • Install anti-malware, or anti-virus software, particularly if you’re a Windows user. Don’t pay more than you need to. Windows Defender from Microsoft is Free and for our demographic relatively undemanding and unsophisticated users, more than sufficient. Keep it up-to-date as well! [As I said previously, your bank might be offering free software as well.]
  • Keep the software you use regularly up to date as well. Consider removing any software from your machine that you don’t use – this is because software vulnerabilities are discovered sometimes quite a while after the software was first released. It will also save you disc space!
  • Be cautious over installing extensions into your browser. These are often extremely useful and valuable tools, ie password managers, Dropbox, note taking, Google Back up and Sync, but if you don’t get them from the official sources then you might be importing vulnerabilities, eg spyware and trojans to your system.
  • Very seriously consider logging-out from social media and other retail sites when you’ve finished using them, especially Facebook, you just don’t know what tracking and logging of what you do, even where you are, if you leave yourself logged in on a mobile device.
  • Free software is both a boon and a curse. Only download open source software from a reputable site such as Softpedia, and never try and get proprietary software for free. Read this article about Free download sites if you want to know more.
  • Remember the golden rule 1 – if it seems too good to be true, it probably is, so steer clear!
  • Remember the golden rule 2 – don’t speak to strangers (an oldie but goldie that one); in other words if you don’t know where an email has come from – ignore it; if the website address looks a little strange – do an internet search on the company or organisation to check if the address you’re looking at is a spoof of the proper one.
  • Have more than one email address. Use one as your personal address, then use other ones that you can “throw away”when you need to register to a website, but you’re unlikely ever to go back to it again. Or have an email address (UserID) specifically for online purchases. Splitting things like this reduces the risk of you being the victim of fraud.
  • Seriously consider using an email service that is NOT connected to your Internet Service Provider (ISP). If you decide to change your ISP, and you should review them periodically, then you will have real problems if your email address is linked to their service!
  • You’ve got Spam filters running? Of course you have – but you better check! Probably your ISP, or email provider (eg Gmail, Yahoo, Microsoft Outlook or Hotmail) is filtering out what it thinks is spam, but occasionally some gets through. If that’s the case then you can always look at the real sender of your message. Take a look at the examples below …
You can also apply filters to divert incoming email into different folders in your email system. That reduces the amount of Junk that you need to review. [I’ve also advocated using the “native” email application for your device rather than rely on the web-based service the email provider has. Thus on a Windows device – use Windows Mail (or Outlook); on a Mac use Mail. You can then easily synchronise your email between devices from multiple email accounts. Tidy!]

So we come to Passwords …

… this is the point at which you need to consider intervention and changing your behaviour! You might also need to do a fair bit of work, but it’s worth it if you want to have a secure internet experience. Let’s just see what using an insecure Password can lay yourself open to. Type in the word Password, or ABC123 from the link above – frightening eh!?
The most common password I use – and I know I shouldn’t reuse the same password, but I am human – has not been discovered on any pwned site. Phew!
What about the combination of your email address with your password – has that been “pwned” (ie stolen through a data breach)? Try typing your email address into the link above.
Oh no! I’ve been pwned … but it was a long time ago and I’ve changed my password many times since then!
Ah! That’s better – my “throwaway” email and passwords are “safe”!
And if you want to see a list of which websites have been breached, it’s alarmingly long! So … use a unique password for everywhere you sign on. There’s lots of tricks to achieve this; some of which I wrote about in a post quite a long time ago …
… but the real change of behaviour is to use a Password Manager – again I wrote about this a little while ago and linked it to using Two Factor Authentication, which is also covered in the same post …

Password managers

I still use LastPass, but as a back-up and archive of my old passwords. I now use Keychain as I only have Apple devices (as do most of my family, and so it makes sense to use a system that is linked to the hardware I use. Other common password managers  are Dashlane and 1Password. Please make up your own minds after reading some Reviews and seriously consider using one.
An authoritative article on using Password Managers is provided by the National Cyber Security Research Centre. They also give an opinion on whether you should use the browser offered option to save your passwords.

However … the future is Passkeys

The major tech companies – Microsoft, Google and Apple amongst them, have been working in alliance on a project called FIDO that will mean the combination of UserID and Password can be consigned to the waste basket. This article explains what they are, and what it means for us really well. Although Apple stole a lead, announcing their implementation a year ago, Google has now launched it’s implementation, and this article describes how to set them up on your Google account. Microsoft also allow a password-less way forward, but I’m not clear on how to set it up – not being a M$ user. On Apple – here’s how you set up Passkeys on your iPhone, iPad and Mac. Another reason why I chose to move from LastPass to Keychain. Whilst if you’re a 1Password user, you can combine your legacy use of a Password Manager with Passkeys, and these will also work much better together on your iPhone. Watch out for an announcement shortly! [NB It is possible to move between password managers, ie from LastPass to 1Password.] And that’s about it for this year. We can look forward to much more about Passkeys in the coming 12 months; much more about GDPR and how the UK government’s online security legislation is reviewed (and hopefully revised) before implementation; much more about “big tech” and corporations re-acting to whether they are responsible for content, or are just a platform providing a service, rather than a publisher. Interesting times!

Slides from talk given to Bridgend U3A

Keeping safe online

Slides from talk given to Cardiff U3A

Staying safe online

References

These may not be available in your Public Library, hopefully that isn’t the case.
… but these are available … Which? webpages – Scams & older people I seriously do recommend signing up for the Which? Scam Alert Service – sign up for an email alert – and I seriously recommend you NOT broadcasting other people’s warnings to you about scams; they could be old, they could be inaccurate, they could be scams in themselves. Look on the Age UK webpages – Staying safe in your digital world and specifically How to stay safe online Your bank will undoubtedly have Internet Security webpages. Mine has a Security Centre web presence and particularly they provide a number of Fraud Guides I could give a million references to changing your privacy settings on Social Media, but here are a couple relating to Facebook, perhaps the most challenging service of the lot. First – what Facebook unchallenged will want to get from you. You are able to disable (prevent) all or some of these … Sign up for Facebook – this is not sign-up site, it’s just one to educate you on the privacy you might give up without realising before you sign up (but of course you can run the checklist at any time); then How to change settings on Facebook and finally Securing Facebook: Keep your data safe with these privacy settings.

Stolen phone & SIM locking

[Minor changes and an addendum 25th January 2024]

A rather disturbing incident involving a stolen phone and credit cards and the ability of a fraudster/thief being able to reset a user’s password/pass-number for a high-street bank occurred in September involving a journalist called Charlotte Morgan. She described what happened to her (and it transpired others) when her phone and credit cards were stolen from a locker in her local gym.

The incident was covered by the BBC https://bbc.in/3Vm8ylH and https://bbc.in/3CukHMS and also in the papers.

The incident was described by the FT Adviser in two reports – firstly the incident, and then (belatedly) Santander’s response.

Charlotte chose to broadcast her experiences on twitter and got a range of helpful and supportive pieces of advice.

So we start with the first piece of advice – keep your phone and your credit cards separate. Don’t store/keep them in the same place. Maybe, if you follow the advice that follows later you should just keep the credit card details only on your phone and dispense with using plastic. For Apple that involves storing the card information in your Wallet.

And this is the security loophole that the thief was exploiting. The default setting when you get your new phone, and insert the SIM is to leave the SIM unlocked. This means that the SIM can be taken out of the phone with your network details (and more), and inserted into another phone. Not really what you want, is it? So, lock the SIM to your phone, and by doing that, if the SIM is taken out – it is of no use in another phone. You will need to remember the new PIN you create which you will have to supply when you power-up your phone, or when you change it for a new/replacement. This is obviously an important piece of information to remember!!! There is no way you can recover the SIM PIN yourself if you forget it, you have to contact your carrier and get a new SIM and a PUK.

So what actually happened. This thread explains it well …

So what do you do? On an iPhone or Android …..

But what are the default SIM PINs that network operators use?

This link will be useful as it lists the default SIM PINs for the major network operators. These are the ones you need to change to your own personally chosen PIN.

It really is quite important. Change your SIM PIN and keep your credit cards separate from your phone.

Addendum: Remember – we had personal experience of SIM swapping and that’s written up in this post entitled “Identity theft”.

Stolen phone & SIM locking

A rather disturbing incident involving a stolen phone and credit cards and the ability of a fraudster/thief being able to reset a user’s password/pass-number for a high-street bank occurred in September involving a journalist called Charlotte Morgan. She described what happened to her (and it transpired others) when her phone and credit cards were stolen from a locker in her local gym.

The incident was covered by the BBC https://bbc.in/3Vm8ylH and https://bbc.in/3CukHMS and also in the papers.

The incident was described by the FT Adviser in two reports – firstly the incident, and then (belatedly) Santander’s response.

Charlotte chose to broadcast her experiences on twitter and got a range of helpful and supportive pieces of advice.

So we start with the first piece of advice – keep your phone and your credit cards separate. Don’t store/keep them in the same place. Maybe, if you follow the advice that follows later you should just keep the credit card details only on your phone and dispense with using plastic. For Apple that involves storing the card information in your Wallet.

And this is the security loophole that the thief was exploiting. The default setting when you get your new phone, and insert the SIM is to leave the SIM unlocked. This means that the SIM can be taken out of the phone with your network details (and more), and inserted into another phone. Not really what you want, is it? So, lock the SIM to your phone, and by doing that, if the SIM is taken out – it is of no use in another phone. You will need to remember the new PIN you create which you will have to supply when you power-up your phone, or when you change it for a new/replacement. This is obviously an important piece of information to remember!!! There is no way of recovering the SIM PIN if you forget it!!!

So what actually happened. This thread explains it well …

So what do you do? On an iPhone or Android …..

But what are the default SIM PINs that network operators use?

This link will be useful as it lists the default SIM PINs for the major network operators. These are the ones you need to change to your own personally chosen PIN.

It really is quite important. Change your SIM PIN and keep your credit cards separate from your phone.

Last pass

There is to  be a change to the free version of LastPass service.    At present, you  can use LastPass on as many devices as you like absolutely free. That’s changing on the 16th March.

You’ll have to choose whether you want to use LastPass on computers or mobile devices   You won’t be able to use it on both unless you pay for the premium version.

If you use it on both computers and mobile devices at the moment, choose which one to keep.  The first time you sign in to LastPass on or after the 16th, it’ll record which device you do it on.  That will become your free device type – so if you sign in first on your computer, you won’t be able to use the app any more (and vice versa).

To keep access to both, you need to sign up for the premium version. If you upgrade before the 16th March, a full year costs £22 or £30 after.

Identity Theft

This will probably be one of the most challenging posts I’ve ever attempted to write because in all truth, I don’t think we really still know what actually happened to my daughter’s online identity, let alone wholly knowing how it happened, but I’m going to try and explain the sequence of events as an alert to you all, and a reminder to us too!

Some background and a plausible explanation of why they got themselves into the situation they found themselves.

They’d been self-employed for a short while now, working as a freelancer, and had just submitted their first tax returns in that capacity.

They were working from home, with two young children with one under six months old, and both very demanding of their time.

The family is living in another family member’s house whilst they “do up” their new house.

They’re adept at multi-tasking (obviously too adept as it turns out) and is (as many of their age are able to do) capable of nestling their phone between chin and shoulder whilst doing other tasks!

What happened next!

She had a phone call purporting to come from HMRC (we’re presuming this was just a fortuitous coincidence from the fraudster’s point of view – they had no way of knowing the employment status of the family member) – saying that they had a refund owing. As explained above she thought this was quite possibly the case as she had just completed a tax return – again an unhappy coincidence! She was told to click on a link in a text message to complete the process of getting the refund. She had their youngest child on her hip, was preparing a meal and was “distracted”. She filled-in the required information from the link!!!!

Agh! No!

Shortly afterwards (the same day) she presented her credit card at a supermarket and payment was refused. She realised something was wrong. She found she didn’t have access to her online banking. She contacted the bank by phone. The bank “supposedly” froze the account there and then but it was apparent that at least two transfers of money had been made to someone who was a Payee in her account – why? That’s the clever bit of the scam, I’ll explain later!

More payments appeared to have been made … help!!!

How could this be? The account was frozen … wasn’t it?

Get the family involved!

Having a son who’s an IT expert comes in useful, especially if he lives on the other side of the world! He worked through the night (day) in securing as many of her accounts as he could. Changing passwords, which were admittedly rather weak and used more than once (should have listened to Dad) – but he had no idea just how much data had been downloaded, or indeed just how much they had to start with as a result of perhaps a previous “pwned” event.

Having another local son who’s also very practical and logical helps also. He suggested that she contact the payee and tell them about the payment and request it be refunded. What transpired next turns out to be the “clever” part of the scam, although on this occasion it wasn’t conducted very expertly because they attempted multiple payments to the same payee. The payee confirmed that they’d had this payment, wondered what it was and had been a bit puzzled as to why Mr X had contacted them and requested a refund to a bank account because “he’d made a mistake”.

This was obviously NOT the same account as that from which the payment had originated and turned out to be the way the scammers were hoping to transfer funds from the hi-jacked bank account to one of their own! Fortunately, my son’s suggestion alerted the payee and the payee advised their bank NOT to transfer the money.

Phew! How did this all happen when the bank account was supposed to be frozen?

The key to this scam was getting control of my daughter’s mobile phone number. She didn’t realise it immediately, but soon became aware that it had been “stolen” through a scam called SIM swapping. This usually is done by a seemingly distressed person going into a mobile phone shop and pleading for a new SIM with a phone number “because their phone has been stolen” and “it’s absolutely imperative they have their number back immediately as there’s something very important happening right now”.  This is described here.

Why do they want to do this? Because they can transfer calls made to the rightful owner of the phone to their own phone.

Why do they want to do this? Because they can then request the bank account to be unfrozen, and also use their access to the phone number for any number of authorisation features.

And what is more they can lock you out of your phone accounts.

How did they do this in this case? Well GiffGaff is an online service provider and they have stated that they did everything they were supposed to do to authenticate the request for a SIM swap – but it is evident that there are serious weaknesses in their processes. They have stated they are looking at this for the future. Just Google “GiffGaff SIM swap Fraud” to see what is returned – it’s frightening!

So what happened next, and was there a happy ending?

Well, believe it or not, even with a personal visit to the bank and assurances that no more payments would be made, the bank did allow the account to be unfrozen and transfers out of her account were attempted. A second visit to the bank resulted in heartfelt apologies being made and offered over the way their fraud department had handled the problem and a complaint being raised by the branch against their own department on my daughter’s behalf – I don’t know the outcome of that!

Well, there was a happy financial outcome. Thanks to the prompt action and thinking of my local son, the initial transfer was halted. It’s not conclusive whether my daughter could have received compensation (as detailed here) as she was the instigator of the problem through her own mistake (the HMRC phone call). All other attempted transfers were eventually trapped by the bank and refunded to her – so no financial loss.

However …

Much more significant than the potential financial loss was what it did to her confidence. She insisted on getting a new phone, because she wouldn’t accept any advice from any family member (especially me) that there wasn’t anything on her phone that wouldn’t continue to monitor her.

She also lost all confidence in using any online systems – which up until then she’d been very reliant upon.

She also lost a lot of confidence in herself as she realised just how gullible (but extremely unfortunate) she’d been … but the positive side of this, and the main reason for sharing this is that she’ll be much more careful in the future!

Postscript.

We don’t know whether the identity theft side of this will ever be resolved. We all know that a huge amount of information is held on us on the internet. We all know that some websites have had their security breached and identity information stolen. We don’t know what was held by others about my daughter. She had a public profile, they now have the potential to add even more information to their database about her if they had managed to download information from her email (and other) accounts before my son locked them down. We just don’t know.

There was a mysterious book that arrived at her house with a cryptic message in it.

There have been some scamming emails purporting to come from her since this event.

She now uses a different email account.

We just don’t know whether these are connected to the fraud event or are just strange random occurrences … and I suppose we never will know just how much additional information they may have downloaded – emails, photographs, documents, etc. etc. Very frightening.

NatWest Guide to Fraud
Some privacy tips for iPhone users.