6 places you should never store your password

Securing your online accounts with strong, unique passwords is key to protecting yourself, but those passwords won't help much if they're stored somewhere criminals can easily access.

From a cluttered inbox to shared cloud storage folders you might have forgotten about, we reveal where you need to avoid storing your passwords – and where to keep them instead.

If you'd prefer 1-2-1 technical advice from Which? experts, including advice on online security and scams, you can join Which? Tech Support. Our friendly team is there to chat on the phone or by email as often as you need. Find out more about the support on offer. 

Source: Which? (31 Jul 2026) 

How to get rid of scam calendar invites

Scam calendar invites are a form of phishing designed to manipulate you into responding, confirming to scammers that your email is active and making you a target.

Unfortunately, getting rid of them isn't as simple as deleting the original email. We explain how to safely remove them from your device without accidentally interacting with them.

Source: Which? (17 Aug 2026) 

How to stop scam pop-ups on Windows

Using urgent messages, fake alerts and flashing warnings, scam pop-ups are designed to cause panic and persuade you into handing over personal information or downloading malicious software.

We share three simple steps to deal with scam pop-ups safely, along with quick fixes to greatly reduce your chances of seeing them again. Plus, other measures you can take to beef up your computer's security. 

Source: Which? (06 Aug 2026) 

Essential WhatsApp Update – How to Lock Down Your Security and Stop Scammers in Their Tracks

If you use WhatsApp regularly, a brand-new security feature has just been released that fundamentally changes how your privacy and personal data are protected online.

Historically, sharing your WhatsApp details meant giving out your actual mobile phone number. Because your mobile number is often linked to sensitive personal accounts—such as online banking, email logins, and government services—handing it over to strangers, new acquaintances, or online sellers carried inherent security risks. Once cold callers, spammers, or fraud syndicates got hold of your number, your handset could easily be bombarded with unwanted calls and phishing texts.

WhatsApp's latest update fixes this major flaw by introducing usernames and an optional security PIN system, removing the need to share your primary phone number ever again.

Key Features Explained

• Custom Usernames: Instead of revealing your personal mobile number, you can now create a unique username to share with people you wish to connect with on WhatsApp. Anyone who has your username can message or call you on the app, while your real phone number remains completely hidden.

• Easy Username Management: Unlike a phone number—which is difficult and inconvenient to change if compromised—you can update or edit your WhatsApp username at any time if you want to block unwanted contact.

• PIN Protection ("Contact Me by Username"): For an additional layer of crime prevention, you can restrict who can initiate a conversation using your username by enabling a PIN. Even if a scammer discovers your username, they will be unable to contact you unless you have provided them with this specific security PIN.

Step-by-Step Setup Guide

1. Open WhatsApp on your smartphone.

2. Tap the three dots in the top right-hand corner (or go to your app options) and select Settings.

3. Tap on Account, then look for the new Username option.

4. Select Create Username, choose a unique and memorable name, and check its availability. Once selected, save it to reserve your handle.

5. To restrict unknown contacts further, tap Contact Me by Username and select People who know my key.

6. WhatsApp will generate a secure PIN code. Share this PIN alongside your username only with people you explicitly wish to permit to contact you. You can review or change this PIN in your Settings whenever needed.

Security, Privacy & Crime Prevention Advice

• Minimise Phone Number Exposure: Your main mobile number is key identity data. Keep it strictly private and restrict its use to trusted institutions (like your bank or healthcare providers). Use your WhatsApp username for day-to-day networking, online marketplaces, and new acquaintances.

• Enable Two-Step Verification: In addition to setting up a username PIN, ensure you have enabled WhatsApp’s built-in Two-Step Verification (found under Settings > Account > Two-step verification). This prevents account takeover attacks if someone attempts to register your phone number on another device.

• Watch Out for Phishing & Impersonation Scams: Scammers frequently use WhatsApp for "Hi Mum/Dad" impersonation frauds or malicious link sharing. Never share security PINs or verification codes with anyone, even if they claim to be from WhatsApp support or a family member in distress.

• Keep the App Updated: Cyber threats evolve constantly. Always update WhatsApp via the official Google Play Store or Apple App Store to ensure you have the latest security patches and privacy features.

By taking a couple of minutes to set up your username and security PIN today, you significantly reduce your risk of targeted spam, identity theft, and messaging scams.

Source: The Phone Guardian

Crime Prevention Advice: Is Your Android Phone Secretly Helping Scammers Steal Your Money?

Mobile banking apps have made managing our money simpler than ever, but cybercriminals are constantly finding clever ways to exploit our devices. As highlighted in a security guide by The Phone Guardian (watch the video on YouTube), fraudsters are no longer relying solely on tricking you into giving away your online banking passwords.

Instead, they trick users into installing malicious apps or granting dangerous permissions on Android phones. These hidden "spyware" apps can record your login details as you type them, monitor your screen, and siphon funds straight out of your account—often while you are fast asleep.

To help protect your hard-earned cash, follow these 5 essential crime prevention steps to secure your phone today.

Step 1: Audit Your Accessibility Permissions

Malicious apps rely on elevated system access (such as Accessibility Services) to read what is on your screen or log keystrokes.

• How to check: Go to Settings > Search for Accessibility > Tap Installed apps (or Downloaded apps).

• What to look for: You will see legitimate tools listed here, but watch out for everyday utility apps (such as a flashlight, PDF scanner, or calculator app).

• Action: A standard calculator or flashlight has no legitimate reason to require full accessibility control. If you see any unfamiliar or unexpected apps on this list, tap them and select Disable or Uninstall immediately.

Step 2: Turn Off SMS Autofill Features

When your bank sends you a One-Time Passcode (OTP) via text message to verify a transaction, the message usually contains critical details—such as the payee name and transfer amount. Enabling autofill features bypasses this crucial line of defence.

• How to check: Go to Settings > Google (or your Google Account settings) > All services > Autofill and passwords > Verification codes by SMS.

• Action: Switch off both "Autofill codes in apps and sites" and "Autofill codes in your default browser". Manually reading and entering passcodes ensures you actually see and double-check any transaction warnings.

Step 3: Remove Saved CVV / Security Codes

While storing card numbers in your browser is common, saving the 3-digit CVV/CVC code from the back of your bank card gives fraudsters everything they need to make unauthorized purchases if your device is compromised.

• How to check: Open Google Chrome > Tap the 3 dots (top-right) > Settings > Payment methods.

• Action: Turn off "Save security codes". Additionally, ensure "Verify autofill payment methods" is turned ON. This ensures that using any saved card details always requires your fingerprint, facial recognition, or screen lock password.

Step 4: Restrict SMS Permissions

Your text inbox receives sensitive verification messages and security alerts from your bank. You should strictly limit which applications can read your SMS messages.

• How to check: Go to Settings > Search for Permissions > Tap Permission Manager > Select SMS.

• Action: Review the list of apps with access to your text messages. Revoke permission for any app that does not strictly require text functionality to operate.

Step 5: Run a Password Safety Checkup

Data breaches occur frequently across the web. If a password you reuse for mobile accounts has been leaked online, criminals can use automated tools to break into your profiles.

• How to check: Go to Settings > Google > Manage your Google Account > Security > Password Manager > Tap Checkup.

• Action: Review any Compromised passwords flagged by Google and change them immediately. Ensure you use strong, unique passwords for every online service, particularly for your primary email and banking accounts.

Taking a few minutes to complete these checks can drastically improve your phone’s security and protect your bank account from fraud. Share this advice with family and friends to ensure their devices remain secure as well!

Source: The Phone Guardian

Google Drive Says It’s Full When It’s Empty? Here’s Where Your Space Went

Ever opened Google Drive only to find it claims you are running out of space, even though your folders look completely empty? You are not alone.

Your total Google Account storage (for example, 28 GB used out of 102 GB) is shared across Google Drive, Google Photos, and Gmail. The storage indicator in the sidebar shows your overall account usage, not just the files saved in your Drive folders.

Common Reasons for Hidden Storage Usage

• Google Photos & Gmail: Large photo libraries, high-resolution videos, or old emails with heavy attachments consume space from the exact same quota.

• WhatsApp & App Backups: Hidden app backups (such as WhatsApp device backups) store hidden data on Google Drive without showing up as regular files.

• Items in the Bin / Trash: Deleted files, emails, or photos remain stored in your Bin for 30 days unless manually emptied.

• Orphaned / Unorganised Files: Files you uploaded into shared folders that were deleted by the owner lose their folder directory and become orphaned in your account.

How to Find and Clean Up Space

1. Check Storage Allocation: Go to one.google.com/storage in a web browser to see an exact breakdown of how many GBs are taken up by Drive, Photos, and Gmail.

2. Sort Drive Files by Size: Open drive.google.com/drive/quota to view all files owned by you, sorted from largest to smallest.

3. Check Hidden App Data: On the web version of Google Drive, click Settings (gear icon) > Settings > Manage Apps to check for app backups (like WhatsApp) and delete hidden app data if needed.

4. Search for Orphaned Files: Type is:unorganized into the Google Drive search bar to reveal lost files that still take up storage space.

5. Empty Your Bins: Head to the Bin in Drive, Gmail, and Google Photos, then click Empty bin to permanently remove those files.

Pro Tip: Save Space in Google Photos with "Storage Saver"

If Google Photos is eating up most of your quota, enabling Storage Saver (formerly known as High Quality) can free up massive amounts of storage.

What is Storage Saver?

• Photos: Compressed and capped at 16 MP (large images are stored as standard high-resolution JPEGs).

• Videos: Compressed to 1080p Full HD resolution (anything shot higher, like 4K, is automatically scaled down).

• Quality Impact: For standard viewing, social media sharing, and standard printing, the visual difference is virtually unnoticeable.

How to Enable It:

• For Future Uploads (Mobile App): Open the Google Photos app > tap your Profile icon > Photos settings > Backup > Backup quality > select Storage saver.

• Compress Existing Uploads (Web Browser): Go to photos.google.com/settings > click Manage storage > scroll to Recover storage > select Convert existing photos & videos to Storage saver.

Note: After clearing large files, emptying the bin, or compressing photos, Google Storage can take up to 24–48 hours to update your overall account balance.

(Before - c.28 Gb storage) - click image to view enlarged

(After -c.207 Mb storage - click image to view enlarged)

 

The scam where banks refuse to refund victims

As controls to prevent authorised push payment (APP) scams improve, criminals are changing tactics and increasingly tricking people into approving card payments instead. This leaves victims without the refund protections they expect.

The fraudsters might use similar tactics to APP fraud, such as posing as your bank to steal security codes, but getting your money back from your bank is much harder. Find out how to protect yourself from this latest evolution. 

Source: Which? (11 Aug 2026)