Ten scam-prevention habits Which? experts actually use

Which? asked its own staff, people who write about scams and consumer rights for a living, what they personally do to avoid being caught out. The answers were not clever software or secret knowledge. They were small, repeatable habits. Here is what they said, and what you can take from it.

What this actually means for you

None of these habits make you unscammable. There is no such thing. What they do is remove the easy wins that fraudsters rely on: urgency, impersonation, and reused passwords. A scammer needs you to act fast and trust what you see. Each habit below slows that down or takes away the trust.

One Which? editor's own mother received a WhatsApp message that looked like it was from her daughter, saying she'd lost her phone and needed £2,500 sent urgently. It was a scam, a classic 'Hi Mum and Dad' impersonation. The family now use a private sign-off, known only to them, to check that an urgent message is really from one another. It costs nothing and takes one conversation to set up.

What to actually do

Agree a family code word. Pick a phrase or question only your close family would know. If someone claiming to be a relative asks for money unexpectedly, especially by text or message, ask for it before doing anything else.

Stop saving your card details online. A Which? Tech editor avoids storing payment details with retailers, specifically so that fewer companies are holding her card information at any one time. Fewer places holding your data means less to worry about if one of them is later breached.

Turn on two-factor authentication. Start with email, banking and social media, in that order. These are the accounts that, if lost, give a scammer access to everything else.

Don't answer unknown numbers. A Which? technology editor lets unrecognised calls go to voicemail, looks the number up online, and if he needs to contact a bank or company, uses the number listed on their official website or app, never a number given to him during a call. Phone numbers can be faked to look like they come from a real organisation.

Use a password manager. One Which? laptops expert uses a password manager to generate and store a different strong password for every account, so he only has to remember one master password himself.

Pause before you respond to anything urgent. A Which? antivirus expert's rule is simple: never rush. If a message or call creates pressure to act immediately, stop, and contact the organisation directly through its official website instead of replying or clicking.

Be wary of unsolicited tech support calls. Which? has heard from a member who lost £300 after a call from someone claiming to be from Microsoft. A Which? support adviser says fraudsters commonly pose as well-known tech companies to get remote access to your computer. Genuine companies do not cold-call you offering to fix a problem you didn't report. Never install anything or grant remote access to someone who contacts you first.

Check new shopping sites before you buy. A Which? researcher suggests using a free tool like ICANN Lookup to see when an unfamiliar retailer's domain was registered. A website that was only set up a few weeks ago, selling heavily discounted goods, is worth a second look.

Be cautious with cold callers asking for details. A Which? scams editor ends calls the moment someone she didn't contact asks for personal or financial information. There is rarely a good reason for this to happen over an unexpected call.

Keep your software updated. Set your phone, tablet and computer to update automatically, particularly if you use them for banking. Security patches close holes that scammers and malicious software rely on.

What this does not fix

These habits reduce risk. They don't remove it. A password manager stops you reusing weak passwords, but it cannot stop a company you've trusted being breached. Two-factor authentication makes accounts harder to break into, but it won't undo a transfer you've already approved under pressure. A family code word only works if everyone agrees to use it every time, not just when it's convenient. None of this replaces your own judgement when something feels off, and no single habit on its own is enough. The point is to stack several of them, so a scammer has to get past more than one thing to succeed.

If you've received a message that feels like one of the examples above, Veystrix's free scam message checker at /tools/scam gives you a second opinion before you reply or send anything.