CyberGuard Tips

Smart doorbells and indoor cameras have become one of the most common purchases in home security — useful for catching package thieves, checking in on pets, or seeing who's at the door before opening it. But every one of these devices sends footage somewhere outside your home, and very few owners actually know who can watch that footage besides them. The answer is often more people than you'd expect: the manufacturer, third-party contractors, law enforcement, and sometimes even your neighbors. Where Your Footage Actually Goes Unlike a traditional CCTV system that records to a local hard drive in your house, most smart doorbells and cameras (Ring, Nest, Blink, Wyze, and similar) upload video to the manufacturer's cloud servers by default, especially if you've paid for a cloud storage subscription to access clip history. That footage doesn't just sit there for your eyes only — several categories of people can potentially access it: The company's employees, f...

You land on what looks exactly like your bank's website, a small chat bubble pops up in the corner, and a friendly "AI assistant" offers to help verify your account. Within minutes, you've typed your card number, your one-time passcode, and your date of birth into a conversation with software that was never affiliated with your bank at all. Fake AI customer support chats are becoming one of the most effective scam formats of 2026, because they combine two things people have been trained to trust: official-looking brand chat widgets, and the growing normalcy of talking to AI for routine tasks. These aren't crude scripted bots anymore. Many run on real language models, which means they can hold a natural, responsive conversation, remember context, and adapt their answers convincingly — making them far harder to spot than the broken-English scam messages of a few years ago. How the Scam Works There are two common versions. The first happens on a cloned or lookal...

You tap your card on a payment terminal, the transaction goes through, and you walk away — but the terminal was never yours to trust. A wave of "ghost tap" and NFC relay fraud has been draining contactless cards and phone wallets without the card ever leaving the victim's pocket. Unlike traditional card skimming, which needs a compromised ATM or gas pump, this attack can happen while your card sits untouched in your bag. Contactless payment is genuinely more secure than swiping a magnetic stripe in most ways, but the convenience that makes tap-to-pay fast is exactly what criminals are now exploiting. How Ghost Tap and NFC Relay Fraud Actually Works Near Field Communication (NFC) — the technology behind tap-to-pay — only works over a few centimeters, which is supposed to make it safe. Relay attacks defeat that distance limit using two coordinated phones. One phone, held close to your card or wallet (in a crowded train, a bag left on a café chair, or even brushed past ...

You check into your Airbnb, unpack your bags, and everything looks normal. But every year, thousands of guests discover they were being watched the entire time by a camera hidden in a smoke detector, an alarm clock, a wall outlet, or a stuffed animal on the shelf. Hidden camera complaints against short-term rental hosts have become common enough that Airbnb now has a dedicated policy banning indoor cameras entirely — yet hosts keep installing them anyway, and hotels aren't immune either. The good news is that finding a hidden camera doesn't require expensive equipment or special training. A few minutes of deliberate checking when you arrive can tell you whether the room is actually private. Why This Keeps Happening Spy cameras are cheap, tiny, and sold openly online disguised as everyday objects: USB chargers, smoke detectors, screws, picture frames, and even fake water bottles. Many run on Wi-Fi and stream footage to an app in real time, or record to a hidden microSD card...

Relationships create shared digital access almost invisibly. A password typed in front of someone, a phone whose passcode both of you know, a streaming account, a shared location, a family plan, a recovery phone number set years ago. None of it feels like a security decision at the time. After a breakup, all of it is still live, and untangling it is not a matter of trust — it is basic account hygiene that most people never do. This is a practical checklist. Work through it in order, because some steps only hold once earlier ones are done. If you are leaving a relationship that involved control, monitoring, or abuse, read the safety note at the end first, because the order changes. Why This Matters More Than People Think The risk is not usually dramatic. It is quiet and persistent: a former partner who still sees your location because a family sharing setting was never turned off, who receives your password reset emails because their address is still your recovery contact, or who c...

Buying second-hand hardware is one of the smartest financial decisions you can make. A two-year-old flagship phone costs a third of its launch price and does everything you need. But a used device is not like a used sofa: it can arrive still carrying the previous owner's account locks, an unpatched operating system that will never receive another security update, or software deliberately installed to watch you. This is a checklist for the security side of that purchase — what to verify before you hand over money, and what to do in the first hour after you get the device home. The Three Real Risks Most guides to buying used devices worry about scratches and battery health. Those matter, but they are not what will hurt you. The device is stolen or account-locked Modern phones and laptops tie themselves to an account. An iPhone still linked to someone's Apple Account is unusable to you. Android devices have Factory Reset Protection. Windows laptops can carry a BIOS or firmw...

You search for a popular app, tap the first result, and install it. The icon looks right, the name is close enough, and there are thousands of reviews. What you actually downloaded was a clone built by a criminal group, and it now has permission to read your notifications, screenshot your screen, and forward your one-time passcodes. Fake apps are not a fringe problem. Google removed more than 2.3 million policy-violating apps from Play in a recent year and blocked well over 150,000 developer accounts, and Apple rejects or removes hundreds of thousands of submissions annually. The ones that get through are the ones designed to look boring and legitimate for the first few weeks. How Fake Apps Get Into Official Stores Most people assume an app store review is a security guarantee. It is a filter, not a wall. Attackers get past it in a handful of predictable ways. The dormant payload The version submitted for review does nothing malicious. It is a working flashlight, PDF reader, or ...

Most crypto losses are not the result of sophisticated hacking. They come from a handful of predictable mistakes about how wallets store keys — a seed phrase typed into the wrong box, a backup saved to cloud storage, a transaction approved without reading what it actually authorised. Unlike a bank transfer, there is no reversal, no chargeback, and no fraud department. This guide covers what a wallet actually is, the specific mistakes that empty them, and how to set up storage that survives both theft and your own errors. A Wallet Does Not Hold Coins This is the misunderstanding underneath almost every loss. Your coins exist on the blockchain. A wallet holds the private key that proves you control an address and authorises spending from it. The seed phrase — usually 12 or 24 words — is a human-readable representation of the master key from which every private key in the wallet is derived. Whoever has those words has the funds, permanently, from anywhere in the world. Losing you...

The single most exploited weakness in home computing is not a clever new hacking technique. It is the "Remind me later" button. Security researchers consistently find that the overwhelming majority of successful attacks use vulnerabilities that were patched months or years earlier — flaws with a fix already sitting on the vendor's server, waiting for someone to click install. Updating is boring, it interrupts your work, and occasionally it breaks something. Here is what is actually happening when you postpone one, how the risk window works, and how to set things up so updates stop being a decision you have to make. What a Security Update Actually Contains Software ships with bugs. Some of those bugs let an attacker do something the developer never intended — read memory they should not see, run code from a file that was supposed to be just data, escalate from a limited account to full administrator. When a researcher finds one, it is assigned a CVE identifier and re...

Almost every scam starts the same way: you click something, and your device looks up a domain name. Before a single byte of the fake login page loads, your device asks a DNS resolver, "what is the IP address for this domain?" If that resolver simply refuses to answer for known phishing and malware domains, the attack ends there — no antivirus scan, no warning banner, nothing to click through. That is what encrypted, filtered DNS gives you. It is one of the highest-impact security changes an ordinary household can make, it is free, and it takes about ten minutes to set up across every device in the home. What DNS Actually Does DNS, the Domain Name System, is the phone book of the internet. Humans use names like example.com; the network routes on numbers like 93.184.216.34. Every app on every device performs dozens of these lookups per minute. By default, those lookups go to whatever resolver your internet provider assigned when your router connected. That has two conse...

Your phone rings. The caller ID shows a number from your own area code, maybe even one digit off from your own. You answer, and a calm recorded voice tells you your Social Security number has been suspended, or that your bank has flagged a suspicious charge, or that you have won a prize you never entered for. That call was almost certainly a scam, and the number on your screen was almost certainly fake. Americans received roughly 50 billion robocalls in a single year, and phone-based fraud costs consumers billions annually. The technology that makes it possible costs criminals almost nothing. Here is how caller ID spoofing actually works, why the usual advice fails, and the settings that genuinely cut the volume down. Why Caller ID Cannot Be Trusted Caller ID was designed in an era when only telephone companies could place calls onto the network. The number displayed on your screen is simply a piece of data that the calling party supplies. Nothing in the original system verified ...

You open Instagram and your password does not work. Or a friend messages asking why you are promoting a crypto giveaway. Or you get an email saying your Facebook email address was changed — to something you have never seen. A hijacked social account is not just an inconvenience. For a lot of people it holds years of photos, business enquiries, a customer base, and the phone numbers of everyone they know. Attackers know this, which is why recovery is deliberately made harder for them and, unfortunately, harder for you too. The first hour matters more than the next week. Here is what to do, in order. How Accounts Get Taken in the First Place Almost none of these involve breaking encryption. The realistic routes are: Phishing login pages. A DM from a friend saying "is this you in this video?" leads to a perfect replica of the Instagram login screen. You type your password and your 2FA code into the attacker's page, and they use both in real time. Password reuse....

You visited a website once, clicked "Allow" on a popup you barely read, and now your desktop shows alerts like "Your PC is infected — click to clean" or "You have 3 new messages" even when your browser is closed. Those are not system warnings. They are web push notifications, and they have quietly become one of the most effective delivery routes for scams, fake antivirus, and malware. The tactic works because it borrows trust. A notification that appears in the corner of your screen looks like it came from your operating system, not from a random site you visited three months ago. Security vendors have tracked millions of these abusive notification domains, and the pattern is consistent: the permission is harvested through deception, then sold or reused to push whatever pays best that week. How the Permission Gets Stolen in the First Place Browser notifications are a legitimate feature. Gmail uses them. Your calendar uses them. The abuse comes from...