Web Starter Guide

Why: Domains at wholesale cost (no markup). A .com is ~$10.11/year. No tricks, no upsells, includes free privacy protection.

Best for: Everyone. It's genuinely the cheapest for most TLDs.

Register on Cloudflare

Why: Low prices, friendly interface, great support. Often has the best prices for unusual TLDs.

Best for: If you want a nicer UI or Cloudflare doesn't support your TLD.

Visit Porkbun

Why: Established company, frequent sales, good support. First-year deals can be very cheap.

Best for: Catching a sale, or if you prefer a well-known brand.

Visit Namecheap

AI Prompt Template

Help me brainstorm domain names for my [business/project].

About my project:
- What it does: [describe briefly]
- Target audience: [who is it for]
- Keywords: [list 3-5 relevant words]
- Tone: [professional/fun/creative/etc]

Please suggest:
1. 10 exact-match .com domains (check availability)
2. 5 creative alternatives using other TLDs
3. 5 short, memorable options

For each suggestion, note if it's likely available (common words = probably taken).

Free tier: Unlimited bandwidth, 500 builds/month, unlimited sites

Best for: Most projects. Fast global CDN, easy GitHub/GitLab integration, serverless functions (Workers) if needed later.

Setup: Connect GitHub repo, auto-deploys on every push.

Learn more about Cloudflare Pages

Free tier: 100GB bandwidth/month, 1GB storage, unlimited public repos

Best for: Personal sites, portfolios, documentation. Simplest setup if you already use GitHub.

Setup: Enable in repo settings, push to main branch.

Learn more about GitHub Pages

Free tier: 100GB bandwidth/month, serverless functions, edge functions

Best for: React/Next.js projects, or if you want the best developer experience.

Setup: Import from GitHub, auto-configures most frameworks.

Learn more about Vercel

Forward emails from [email protected] to your personal Gmail, Outlook, etc. Unlimited addresses, completely free.

1. Go to Cloudflare Dashboard
2. Select your domain → "Email" → "Email Routing"
3. Click "Get started"
4. Add your destination email (Gmail, etc.)
5. Verify by clicking the link sent to that email
6. Create routes like [email protected] → your Gmail

Catch-all option: Enable this to receive emails to any address at your domain.

What you get: 5 users, 5GB each, webmail, mobile apps, real SMTP/IMAP

Setup: zoho.com/mail → Sign up with your domain → Verify domain → Set up MX records

Catch: Free plan requires you to use Zoho's interface (no SMTP to other clients on free tier, actually). You can use their webmail or mobile app.

What you get: Free forwarding + limited sending (via their SMTP)

Setup: forwardemail.net → Add domain → Set DNS records

Bonus: Open source, privacy-focused, no ads.

What you get: Send from your custom domain using Gmail's interface

How it works:

1. Set up Cloudflare Email Routing to forward to your Gmail
2. In Gmail: Settings → "See all settings" → "Accounts and Import"
3. "Send mail as" → "Add another email address"
4. Enter your custom email address
5. For SMTP server, you'll need a service like Resend or Brevo (see below)

Or $0 if you're using a free subdomain!

The Coffee Shop That Disappeared

Sarah ran a small coffee shop for 8 years. One morning, her Google Business Profile showed "This listing has been suspended." No warning, no explanation. Her business vanished from Google Maps, Google Search, and all the reviews she'd built up over years were gone. Phone calls dropped 60% in the first week.

What happened: A competitor had filed fake "business moved" reports. Google's automated system suspended her listing for "suspicious activity." It took 3 months and countless hours to get reinstated.

The Contractor Blacklisted by Email

Mike's HVAC company sent appointment confirmations and invoices via email. One day, his emails started bouncing. Then customers reported his emails were going to spam. His domain had been blacklisted.

What happened: His WordPress contact form had been compromised and was sending thousands of spam emails from his domain. He never noticed because the spam was going out, not coming in. His domain's email reputation was destroyed.

The Bakery's Social Media Nightmare

A bakery with 15,000 Instagram followers lost their account overnight. Instagram said it violated community guidelines. The business had been posting cake photos for 5 years.

What happened: Their account was reported en masse by a coordinated attack (possibly a disgruntled ex-employee or competitor). Instagram's automated system disabled the account. Appeals took 6 weeks.

Email Reputation Protection

• Set up SPF, DKIM, and DMARC - these prove emails actually come from you (Cloudflare makes this easy)
• Use a dedicated email service - don't send business email through your web hosting
• Monitor your reputation - check MXToolbox Blacklist Check monthly
• Secure contact forms - add CAPTCHA, rate limiting, and spam filtering
• Use transactional email services - SendGrid, Mailgun, or Amazon SES for automated emails
• Never buy email lists - only email people who explicitly opted in

Google Business Profile Protection

• Verify your business - complete all verification steps Google offers
• Keep information accurate - hours, address, phone must match reality exactly
• Respond to reviews - active engagement signals legitimacy
• Monitor for changes - check your listing weekly for unauthorized edits
• Document everything - save photos, receipts, business licenses proving legitimacy
• Set up Google Alerts - get notified when your business name appears online

Social Media Account Protection

• Enable 2FA on every account - use an authenticator app, not SMS
• Use unique, strong passwords - password manager required
• Audit connected apps regularly - remove any you don't actively use
• Never share login credentials - use platform's native team/business features
• Download your data regularly - Facebook, Instagram, Twitter all offer data exports
• Build an email list - own your audience, don't rely solely on social platforms
• Document your content - save copies of important posts, images, videos locally

Website Security

• Keep software updated - WordPress, plugins, themes - all of them, always
• Use security plugins - Wordfence, Sucuri, or similar if on WordPress
• Monitor for changes - file integrity monitoring catches injections
• Regular backups - automated, stored offsite, tested periodically
• Web Application Firewall (WAF) - Cloudflare free tier includes basic WAF
• Check Google Search Console - Google will notify you of security issues here

Domain Protection

• Enable registrar lock - prevents unauthorized transfers
• Use registrar 2FA - domain theft is devastating
• Keep payment info current - set calendar reminders before expiration
• Enable auto-renew - but still monitor it
• WHOIS privacy - reduces spam and social engineering attempts
• Consider registry lock - extra protection for critical domains (may cost extra)

Email Reputation Recovery

Rebuilding email reputation takes time - often 2-4 weeks of consistent good behavior.

• Start with small volume, gradually increase
• Focus on engaged recipients who open and click
• Remove bounced addresses immediately
• Use email warm-up services if needed
• Monitor delivery rates daily during recovery

Rebuilding After Social Media Loss

If an account is permanently lost, you need to start fresh strategically.

• Create new account with slightly different name if needed (avoid exact duplicate)
• Email your customer list announcing the new account
• Cross-promote from other platforms you still control
• Consider this a lesson: diversify platforms, build your email list
• Post consistently to rebuild algorithm favor

Legal and Escalation Options

When normal channels fail:

• State Attorney General - can sometimes pressure companies on consumer issues
• Small claims court - viable for documented business losses
• Media attention - local news loves "big tech vs small business" stories
• Social media escalation - tagging company executives sometimes works
• Lawyer letter - sometimes a formal letter gets attention
• Industry associations - some have relationships with platforms

Extension Safety Rules

• Minimize extensions - every extension is a potential security hole
• Check permissions - be suspicious of "Read and change all your data on all websites"
• Research the company - who owns this extension? What's their business model?
• Review periodically - remove extensions you no longer use
• Use separate browser profiles - banking in a clean profile with no extensions

Priority Updates

• Operating system - enable automatic updates (Windows Update, macOS Software Update)
• Browser - Chrome, Firefox, Safari auto-update; just don't delay restarts
• Password manager - keeps your credentials safe
• Antivirus/security software - signature updates are critical

Red Flags

• Urgency - "Act now or your account will be closed!"
• Generic greetings - "Dear Customer" instead of your name
• Suspicious links - hover to see the real URL before clicking
• Unexpected attachments - especially .exe, .zip, or Office files with macros
• Requests for passwords - legitimate companies never ask for your password
• Too good to be true - you didn't win a prize you didn't enter

1. Don't Put All Eggs in One Basket

• Use different email providers for different purposes
• Don't use Gmail as the recovery email for critical accounts
• Consider paid email for business (Fastmail, Proton Mail) - you're a customer, not a product

2. Maintain Access to Your Domain

• Don't use Gmail as the contact for your domain registration
• Use a completely independent email for your registrar account
• Enable registrar lock to prevent unauthorized transfers
• Keep domain registration details up to date

3. Backup Everything

• Google Takeout - export your Gmail, Drive, Photos regularly
• GitHub - clone repos locally, don't only store code on GitHub
• YouTube - download your own videos, keep originals
• Social media - export your data periodically

4. Avoid Triggering Automated Systems

• Don't use VPNs that rapidly change your location
• Don't use automation tools on personal accounts
• Don't share accounts across many devices
• Don't repeatedly fail login attempts
• Keep payment methods up to date

1. Keep Everything Updated

• Enable auto-updates for WordPress core
• Enable auto-updates for plugins (or update weekly)
• Delete unused themes and plugins - don't just deactivate
• Use reputable plugins from wordpress.org with recent updates

2. Secure Your Login

• Don't use "admin" as your username
• Use a strong, unique password (via password manager)
• Install a 2FA plugin (Two-Factor or Wordfence)
• Limit login attempts to block brute force attacks
• Consider changing the login URL (security through obscurity helps)

3. Choose Good Hosting

Managed WordPress hosts handle security for you:

• Cloudways - good balance of control and management
• Kinsta - premium, excellent security
• SiteGround - good budget option with security features

Avoid: cheap shared hosting, GoDaddy, EIG brands (Bluehost, HostGator)

4. Backup Regularly

• Use UpdraftPlus for automated backups
• Store backups off-site (Dropbox, Google Drive, S3)
• Test restoring from backup periodically
• Keep at least 30 days of backups

What it checks: SSL/TLS certificate configuration, encryption strength, vulnerabilities

Use it: ssllabs.com/ssltest

Aim for: A+ grade. Anything below A indicates issues.

What it checks: HTTP security headers (CSP, HSTS, X-Frame-Options, etc.)

Use it: securityheaders.com

Aim for: A grade. Add missing headers via Cloudflare or your server config.

What it checks: Overall web security, combines multiple tests

Use it: observatory.mozilla.org

Shows: Actionable recommendations with explanations.

What it checks: Malware, blacklist status, known vulnerabilities

Use it: sitecheck.sucuri.net

Good for: Quick check if your site has been compromised.

What it checks: If your email/password appears in known data breaches

Use it: haveibeenpwned.com

Action: If found in breaches, change those passwords immediately.

What it checks: Your Google account security settings, recent activity

Use it: myaccount.google.com/security-checkup

Shows: Devices, third-party access, recovery options.

What it checks: DNS records, email configuration (SPF, DKIM, DMARC), blacklists

Use it: mxtoolbox.com

Key tests: "Email Health" and "Domain Health" reports.

1. Broken Access Control

What it means: People can access things they shouldn't - like viewing other customers' orders or accessing admin pages.

Small business example: Your online store lets anyone view any order by changing the number in the URL (order/123 → order/124). A curious customer sees someone else's name, address, and purchase history.

Protect yourself: If you use a website builder (Shopify, Squarespace), they handle this. If you have a custom site, ask your developer "How do you verify users can only see their own data?"

2. Cryptographic Failures

What it means: Sensitive data isn't properly encrypted - passwords stored in plain text, credit cards transmitted without HTTPS.

Small business example: Your contact form emails you customer inquiries, but the email includes their phone number in plain text. Or worse, your old website stored passwords without encryption, and now they're leaked.

Protect yourself: Always use HTTPS (the padlock icon). Never store customer passwords yourself - use "Sign in with Google" or a proper auth service. Never email sensitive data.

3. Injection

What it means: Attackers insert malicious code through input fields (like search boxes or contact forms) that your website accidentally runs.

Small business example: Someone fills out your contact form with weird code instead of their name. Your website treats it as a command and suddenly they can see your entire customer database.

Protect yourself: Use established platforms (WordPress with security plugins, Shopify, etc.) rather than custom code. If custom, your developer must "sanitize all inputs" - ask them about it.

4. Insecure Design

What it means: The website was designed without thinking about security from the start - security was an afterthought.

Small business example: Your appointment booking system lets anyone cancel any appointment if they know (or guess) the confirmation number. There's no "Are you sure?" or login required.

Protect yourself: When getting a website built, ask "What happens if someone tries to misuse this feature?" Use established platforms that have already thought through these issues.

5. Security Misconfiguration

What it means: The website or server is set up with insecure default settings that were never changed.

Small business example: Your WordPress site still has the default "admin" username. Your hosting account still uses the password they emailed you on day one. Error messages show your database structure to visitors.

Protect yourself: Change ALL default passwords immediately. Turn off detailed error messages on live sites. Remove sample files and unused features. Keep everything updated.

6. Vulnerable and Outdated Components

What it means: Using old, unpatched software with known security holes.

Small business example: You installed a WordPress plugin 3 years ago and forgot about it. That plugin had a security flaw discovered last year. Hackers have scripts that automatically find and exploit sites with that old plugin.

Protect yourself: Update everything regularly - WordPress, plugins, themes. Delete plugins/themes you don't use. Set up automatic updates where possible.

7. Identification and Authentication Failures

What it means: Weak login systems - allowing simple passwords, not limiting login attempts, poor session management.

Small business example: Your admin login allows unlimited password attempts. An attacker runs a script trying thousands of common passwords until "password123" works. Or your site keeps you logged in forever, and someone uses your unattended computer.

Protect yourself: Require strong passwords. Enable 2FA for admin accounts. Limit failed login attempts. Use automatic logout after inactivity.

8. Software and Data Integrity Failures

What it means: Trusting code or data from untrusted sources without verification.

Small business example: You download a "free premium" WordPress theme from a sketchy website instead of the official source. It works great - but it also contains hidden code sending your customer data to hackers.

Protect yourself: Only install plugins/themes from official sources (WordPress.org, official developer sites). Never use "nulled" (pirated) software. Verify downloads when possible.

9. Security Logging and Monitoring Failures

What it means: No way to detect or investigate when something bad happens.

Small business example: Someone accessed your admin panel from Russia at 3 AM and changed your prices to $0. You don't find out until a customer mentions it a week later. You have no logs to figure out what happened or how they got in.

Protect yourself: Use hosting/platforms that provide activity logs. Check logs periodically. Set up alerts for unusual activity (many security plugins offer this).

10. Server-Side Request Forgery (SSRF)

What it means: Tricking your server into making requests to internal systems it shouldn't access.

Small business example: Your website has a feature that fetches preview images from URLs. An attacker provides a special URL that makes your server access your internal admin panel or database, bypassing normal security.

Protect yourself: This is technical - if you have custom development, your developer needs to validate and restrict what URLs your server can fetch. Most standard platforms handle this for you.

Email Phishing Examples

SMS/Text Phishing (Smishing)

Voice Phishing (Vishing)

CEO Fraud / Executive Impersonation

Payroll Diversion

Tailgating / Piggybacking

Baiting

Pretexting

Investment / Crypto Scams

Vendor/Supply Chain Compromise

Watering Hole Attacks

Social Media Reconnaissance

Create a Security Culture

• Train everyone, repeatedly - Security awareness isn't one-and-done. Cover new scams quarterly.
• Make reporting safe - Employees should report suspicious contacts without fear of looking stupid. The person who reports saves the company.
• Simulate attacks - Send fake phishing emails to test awareness. Make it a learning opportunity, not punishment.
• Establish verification procedures - Any financial request over $X requires verbal confirmation. Any bank change requires callback to known number.

Technical Protections

• Email filtering - Use a service that scans for phishing and malware
• Multi-factor authentication - Even if credentials are stolen, attackers can't log in
• Separate accounts - Admin accounts shouldn't be used for email and web browsing
• Call verification - For any unusual request, call back on a known number

Red Flags Checklist

• Urgency - "This must be done TODAY"
• Secrecy - "Don't tell anyone about this"
• Authority pressure - "The CEO needs this NOW"
• Unusual payment methods - Gift cards, Bitcoin, wire transfers
• Changes to established procedures - "Use this new bank account"
• Too good to be true - Free stuff, huge returns, lottery wins
• Fear - "You'll be arrested" or "Your account will be closed"
• Requests for passwords or sensitive data
• Pressure to bypass normal processes

The scam: Email claims to have video of you "enjoying" adult websites, recorded through your webcam. Demands Bitcoin payment or they'll send the video to your contacts. Often includes an old password of yours (from previous data breaches) to seem credible.

Subject: Your password is [actualoldpassword] - I know what you did

I know [actualoldpassword] is one of your passwords. You don't know me but I know you very well.

I placed malware on an adult video site and you visited it. While you were watching, your webcam recorded you. I also have your contact list from Facebook, email, and phone.

If you want me to delete everything, send $1,900 in Bitcoin to: [wallet address]

You have 48 hours. If I don't receive payment, I will send the video to all your contacts. If you need proof this is real, reply "Yes" and I'll send it to 10 of your contacts.

Don't bother contacting police. I'm untraceable.

Why it works: The old password is real (harvested from LinkedIn, Adobe, or other breaches). This makes victims think the rest must be real too. Shame and fear prevent people from asking for help.

The reality: There is no video. They don't have webcam access. They're sending millions of these emails hoping a small percentage pay. The password is from a public breach database.

What to do: Delete it. Change that password if you're still using it anywhere. They have nothing. The FBI's IC3 received 18,000+ reports of this scam in a single year.

Source: FBI IC3 Public Service Announcement

The scam: A Lithuanian man sent fake invoices to Google and Facebook, impersonating a legitimate hardware vendor (Quanta Computer) that both companies used. Over two years, he invoiced them for computer equipment that was never delivered.

What happened: Both tech giants - companies with massive security teams - paid the invoices. Google paid approximately $23 million. Facebook paid approximately $98 million. The money was wired to bank accounts in Latvia, Cyprus, and other countries controlled by the scammer.

Why it worked: The invoices looked exactly like real ones from a real vendor. The scammer registered a company in Latvia with the same name as the real vendor. He created email accounts that mimicked real employees. Nobody called to verify.

The aftermath: Evaldas Rimasauskas was arrested in 2017, extradited to the US, pleaded guilty, and was sentenced to 5 years in prison. Both companies recovered most of the money by tracing the bank accounts.

The lesson: If Google and Facebook can be fooled by fake invoices, so can your business. Verify banking details by phone before large transfers. Always.

Source: US Department of Justice Press Release

The scam: Named after the practice of fattening a pig before slaughter. Scammers build relationships over weeks or months - often romantic - before introducing a "great investment opportunity" in crypto. Victims are groomed to invest larger and larger amounts.

How it works:

1. Contact: Random text ("Hey! Is this Jessica?"), dating app match, LinkedIn connection, or WhatsApp message
2. Relationship building: Weeks of friendly conversation, sharing life details, building trust
3. The hook: Casually mention making money with crypto trading. Show screenshots of profits.
4. Small investment: Victim invests small amount on a fake platform. It shows gains. They can even withdraw small amounts to build trust.
5. Bigger investments: Encouraged to invest more. Platform shows massive returns.
6. The slaughter: When victim tries to withdraw, they're told to pay "taxes" or "fees" first. Or the platform simply disappears.

The scale: The FBI reported $3.3 billion in losses from crypto investment scams in 2022 alone. Individual victims have lost millions. Many scam operations are run by trafficking victims forced to work in compounds in Southeast Asia.

Real victim quote: "I thought I was helping my girlfriend invest. I put in $750,000 - my retirement, my kids' college funds. The platform showed $4 million in profits. When I tried to withdraw, they said I owed $380,000 in taxes first. That's when I realized it was all fake."

Source: FBI IC3 2022 Internet Crime Report

The scam: Email claims your Geek Squad or Norton subscription has auto-renewed for $399.99 (or similar). Includes a phone number to call "if you didn't authorize this charge."

Subject: Your Geek Squad subscription has been renewed - $399.99

Dear Customer,

Thank you for renewing your Geek Squad Total Protection subscription.

Amount: $399.99
Transaction ID: GS-2024-8847291
Date: [today's date]

This amount will be debited from your account within 24 hours.

If you did not authorize this transaction, please call our billing department immediately:

+1 (888) XXX-XXXX

Best regards,
Geek Squad Billing Team

What happens when you call: A "support agent" offers to refund you but needs remote access to your computer. They pretend to process a refund but "accidentally" transfer $3,999 instead of $399. They act panicked, say they'll lose their job, and beg you to send back the difference via gift cards or wire transfer. The "extra money" was never actually transferred - they just edited the HTML on your bank's webpage while screen sharing.

Why it works: Targets older adults who may have actually used Geek Squad. The urgency of a charge you didn't authorize makes people call. Once scammers have remote access, they control what you see.

Real case: In 2023, an 80-year-old woman in Ohio lost $25,000 to this scam. She called the number, allowed remote access, and sent gift cards to "return" the fake overpayment.

Source: FTC Report on Business Impersonation Scams

The scam: Text from unknown number claims to be your child: "Hi Mom, I broke my phone. This is my new number. Can you save it?" Follows up with an urgent request for money.

Scammer: Hi Mom! I dropped my phone in the toilet and it's completely dead. This is my temporary number. Save it!

Mom: Oh no! Is this Sarah?

Scammer: Yes it's me! Such bad timing. I need to pay my rent TODAY and I can't log into my banking app on this borrowed phone. Could you transfer £2,500 and I'll pay you back Friday when I get paid?

Mom: Of course honey, what's the account?

Scammer: Thanks Mom you're the best! Send it to: [scammer's account details]

Why it works: Parents want to help their kids. The phone explanation prevents the obvious "why didn't you call me?" question. The urgency (rent due TODAY) prevents careful thinking.

The scale: UK Finance reported £1.5 million lost to this scam in the first half of 2022 alone. Australia reported $7.2 million AUD in losses.

What to do: ALWAYS verify by calling your child's actual number (or another family member). Ask a question only they would know. Establish a family code word for emergencies.

Source: UK Finance Fraud Report

The scam: Attacker convinces your mobile carrier to transfer your phone number to their SIM card. They now receive all your calls and texts - including 2FA codes.

How it works:

1. Attacker gathers your personal info (from social media, data breaches, or social engineering)
2. Calls your carrier pretending to be you: "I lost my phone, need to activate my new SIM"
3. Provides enough personal details to pass security questions
4. Your phone loses service. Their phone now has your number.
5. They request password resets, receive the SMS codes, and take over your accounts

Real case - Jack Dorsey: In 2019, Twitter CEO Jack Dorsey's Twitter account was hijacked via SIM swap. Attackers posted offensive content from his account. If Twitter's CEO isn't safe, neither are you.

Real case - $400,000 crypto theft: In 2018, a California investor lost $400,000 in cryptocurrency after attackers SIM-swapped his phone and drained his Coinbase account. He sued his carrier.

Protection:

• Set up a PIN/password with your carrier that's required for any account changes
• Use authenticator apps instead of SMS for 2FA
• Consider Google Voice number for sensitive accounts (harder to SIM swap)
• Some carriers offer "port freeze" - enable it

Source: KrebsOnSecurity: The Allure of the SIM Swap

The scam: After you've been scammed, you're contacted by someone claiming they can recover your money - for a fee. They might claim to be lawyers, investigators, or a government agency. They take your fee and disappear.

How they find you: Scammers share victim lists. If you lost money to one scam, your name is sold to recovery scammers. Or they find victims posting in Facebook groups seeking help.

Real example: Victims of the Binary Options scam were later contacted by "recovery agents" who promised to retrieve funds. Victims paid $5,000-$30,000 in "legal fees" and "processing costs." The recovery company was run by the same people who ran the original scam.

The pattern:

• "We've identified your funds and can recover them"
• Upfront fee required for "legal work" or "processing"
• Pressure to act fast before the "window closes"
• Once paid, they need more fees for "taxes" or "unforeseen complications"
• Eventually stop responding

The reality: Legitimate recovery is extremely rare. Government agencies don't charge fees. Most lost crypto and wire transfers are unrecoverable. Anyone promising guaranteed recovery is almost certainly scamming you again.

Source: CFTC Advisory on Recovery Room Scams

The scam: Malicious QR codes placed over legitimate ones, in phishing emails, or on flyers. Scanning takes you to a fake site that steals credentials or installs malware.

Real examples:

• Parking meters: Scammers placed stickers with fake QR codes on parking meters in Austin, Houston, and San Antonio. Scanning led to a fake payment site that stole credit card info.
• Restaurant menus: Fake QR codes placed over legitimate menu codes at restaurants led to phishing sites.
• Package deliveries: Fake "missed delivery" notices with QR codes to "reschedule" that lead to credential theft.
• Crypto ATMs: Scammers place QR codes directing payments to their wallets instead of the machine.

The danger: QR codes obscure the URL. You can't see where you're going before you scan. On mobile, URLs are often truncated, making fakes harder to spot.

Protection: Preview URLs before opening (most phone cameras show the URL). Be suspicious of QR codes in emails. Verify physical QR codes aren't stickers placed over originals. Use official apps rather than scanning codes for payments.

Source: FBI San Antonio Warning on Malicious QR Codes

The scam: You receive packages you never ordered - often cheap items from Amazon or other retailers. There's no return address or invoice.

What's actually happening: Sellers (usually Chinese third-party sellers) have your name and address from data breaches. They ship cheap items to you, then post fake "verified purchase" reviews using your name to boost their product ratings.

Why it matters:

• Your personal info is in criminal hands
• Your name may be used for fake reviews (potentially fraud)
• More concerning: sometimes this is a precursor to identity theft

Newer twist: Some packages now include QR codes urging you to scan to "register your warranty" or "claim your gift" - leading to phishing sites.

What to do: Report to the retailer. Change your passwords. Monitor credit reports. Don't scan any QR codes in the package.

Source: Better Business Bureau: Brushing Scams

The scam: Attackers register domains nearly identical to legitimate businesses (paypa1.com instead of paypal.com, arnazon.com instead of amazon.com) and send emails or create login pages that look exactly like the real thing.

Real case - Ubiquiti Networks ($46.7 million): In 2015, the network equipment company was defrauded of $46.7 million. Attackers impersonated executives via email, using look-alike domains, and convinced the finance department to wire funds to overseas accounts controlled by the attackers.

Techniques used:

• Homograph attacks: Using characters from other alphabets that look identical (Cyrillic "а" vs Latin "a")
• Typosquatting: micros0ft.com, googIe.com (capital I instead of l)
• Subdomain tricks: paypal.com.malicious-site.com
• Added words: paypal-security.com, amazon-support.com

Protection: Never click links in emails. Type URLs directly. Use bookmarks. Verify the domain letter by letter on financial sites. Look for the padlock but understand that scam sites can have HTTPS too.

Source: KrebsOnSecurity: Ubiquiti $46M Cyberheist

Why every scam ends with gift cards:

• Untraceable - no ID required to redeem
• Instant - funds available immediately
• Global - can be redeemed from anywhere
• Non-reversible - once the code is used, money is gone
• Convertible - gift card codes can be sold for cash or crypto

The numbers: The FTC reported $228 million lost to gift card scams in 2022. The most requested cards: Google Play, Apple, eBay, and Steam.

The rule: No legitimate business, government agency, or employer will ever ask for payment in gift cards. Not the IRS. Not tech support. Not your boss. Not publishers clearing house. EVER.

If someone asks you to pay in gift cards, it is a scam. Full stop.

Source: FTC Data Spotlight: Gift Card Scams

The scale: The FBI reported $739 million in romance scam losses in 2021. That's just what's reported - actual losses are estimated at several times higher. Many victims are too embarrassed to report.

Who gets targeted: Mostly people over 40 (60% of losses), but all ages are victims. Educated, intelligent people fall for these scams. It's not about being stupid - it's about being human.

The infrastructure: Many romance scams are run by organized crime operations with:

• Scripted conversations and psychological training
• Shifts of operators working the same "character"
• Stolen photos (often from Instagram influencers or military personnel)
• Backstory documents (fake passports, military IDs)
• Professional money laundering networks

Real victim stories:

• A 75-year-old widow sent $661,000 to an "engineer" she met on Words With Friends
• A nurse lost $1.4 million to a "doctor" working overseas
• A man lost his entire $200,000 retirement to a "woman" who was actually a team of scammers in Nigeria

The forced labor connection: Many scam operations in Southeast Asia use trafficking victims - people lured with fake job offers, held captive, and forced to run scams. The FBI is investigating these operations as human trafficking.

Source: FBI IC3 Annual Report, ProPublica Investigation

• https:// Scheme - secure connection (good!)
• mail Subdomain - ⚠️ Anyone who owns the domain can create any subdomain
• google.com Domain - ✅ THE ONLY PART YOU CAN TRUST
• /inbox Path - ⚠️ Can say anything
• ?compose= Query - ⚠️ Can contain any data
• #section Fragment - ⚠️ Can say anything

1. The Subdomain Trick

The trick: "paypal.com" is just a subdomain! The real domain is secure-login.ru (a Russian site)

2. The Look-alike Domain

The trick: "arnazon" with an "rn" looks like "amazon" with an "m". Also watch for: paypa1.com (with a 1), micros0ft.com (with a zero), faceb00k.com

3. The Path Deception

The trick: The real URL is in the path! The actual domain is "scammer-site.com" - everything after the first "/" is just the page path

4. The Hyphen Confusion

The trick: Real companies rarely have hyphens in their domain. Wells Fargo's real site is wellsfargo.com

5. The Extension Swap

The trick: ".com.de" is actually a subdomain of ".de" (Germany). The real domain is "chase.com.de" - which is NOT Chase bank

The Cyrillic letter "а" (U+0430) looks identical to the Latin "a" but is a different character. A scammer could register:

Modern browsers now display suspicious international domains in punycode format (xn--pple-43d.com) to warn you, but older browsers may not. When in doubt, type the address yourself rather than clicking links.

Test yourself:

1. login.microsoft.com.account-verify.net/signin
2. https://www.amazon.com/gp/css/order-history
3. mail.google.com/mail/u/0/#inbox
4. support-apple.com/icloud/verify