What could have happened

A code is just an address. You can't see where it goes until you're already there.

• A fake sign-in page. One that looks exactly like your bank, your email, or your work login — and takes your password the moment you type it.
• A payment already filled in. The amount looks right. The account receiving it belongs to someone else.
• A request to install something. An app, or a settings file your phone calls a "profile", that keeps reading your messages and screen long after you've forgotten about it.
• A network someone else controls. Once your phone joins it, they can see a great deal of what you do.

Both of these are real addresses

One of them is not your bank. At phone size, almost nobody sees which.

The second one starts with the letters r and n, not an m. Side by side you can see it. Alone, on a small screen, in the sun, in a hurry — you can't. This is the single most common trick there is.

This one isn't your bank either. The real site is always the last part before the first single slash — here, secure-login.xyz. Anything to the left of it can be made to say anything at all. Read an address from the slash backwards, not from the start forwards.

The padlock is not a promise

A padlock means the connection is private. It says nothing about who is on the other end.

Most people were taught that the little lock icon means a site is safe. It doesn't. It means nobody can read what passes between you and that site — even if that site is a criminal's. Fake pages have padlocks. They're free and take about a minute to set up.

The lock tells you the envelope is sealed. It tells you nothing about who is reading the letter.

Five habits that stop nearly all of it

None of this needs technical skill. It needs three seconds of attention.

• Read the address before you tap. Your phone shows it to you first, on purpose. If it isn't a name you recognise, close it.
• Check the spelling. Most fakes rely on one changed or added letter that your eye slides straight past.
• Never type a password on a page you reached from a code. Close it, open the app yourself, or type the address in by hand. Every time, no exceptions.
• Be suspicious of stickers. If a code is stuck on top of another code — on a parking meter, a table, a poster, a charger — it almost certainly isn't the owner's.
• Slow down when something feels urgent. "Your account closes today", "pay now to avoid a fine" — urgency is the tool. It exists to stop you thinking.

The bigger picture

Most of what is known about you was never stolen. It was collected legally, then sold.

A fake QR code is retail theft: one person, one password. The wholesale version is an entire industry, and it is legal almost everywhere. Apps and websites record where you go, who you know, what you read and what you buy. Data brokers buy those records from thousands of sources and merge them into a single file with your name on it. Those files are sold on to advertisers, insurers, employers and governments.

Companies like Palantir sit at the far end of that chain. For the most part they don't gather data themselves — they build software that stitches together records an agency already holds, such as case files, licence plates, phone records and immigration paperwork, so that searching for a person becomes as easy as searching for a word in a document. Its customers are a matter of public record: police forces, armies, immigration authorities and health services in a number of countries.

You can't opt out of the system. You can decide how much you hand it.

• Turn off your advertising ID. iPhone: Settings, then Privacy & Security, then Tracking — switch off "Allow Apps to Request to Track". Android: Settings, then Privacy, then Ads — delete the advertising ID. This one setting cuts a surprising amount of it.
• Give apps location "while using", never "always". Location history is the most valuable and most heavily resold category of all. A torch app does not need to know where you sleep.
• Use a browser that blocks trackers. Firefox with uBlock Origin, or Brave. Both are free and take two minutes to set up.
• Move conversations to Signal. Encrypted by default, and it deliberately keeps almost no record of who talks to whom.
• Be sceptical of free. Free apps, free quizzes, free wifi and loyalty cards are usually paid for with information about you.
• Set a passcode, not only a face or a fingerprint. A phone can be unlocked with your face or your finger while someone else is holding it. Something you know can't be taken from you the same way.

The two that know the most

Google and Amazon didn't have to buy your data. You handed it over, a little at a time, for years.

Google holds every search you've ever run while signed in, everywhere you've carried an Android phone, every video you've watched, and — through the advertising and analytics code embedded in a large share of the world's websites — a great deal of what you do on sites that have nothing to do with Google at all. You don't need a Google account for that last part to work.

Amazon holds every item you've ever looked at rather than bought, every word spoken to an Alexa device, every book you've opened on a Kindle including which page you stopped on, and, where Ring doorbells are installed, a view of the street outside a great many front doors. It also runs a large advertising business built on top of all of it.

Neither of these is a scandal. It's the product working as designed, and you agreed to it. But almost nobody has looked at how much has accumulated, and the controls are better than most people assume:

• Set your Google history to delete itself. Go to myactivity.google.com and switch on auto-delete at three months for Web & App Activity, Location History and YouTube History. This is the single highest-value change on this page.
• Turn off ad personalisation. In the same Google settings, and in Alexa's privacy settings on Amazon. The ads don't stop; the profile-building slows.
• Download your own file first, if you want a shock. takeout.google.com exports everything they hold on you. Most people have never seen the size of it.
• Delete your voice recordings. Alexa keeps them by default. The settings to review and delete them are in the Alexa app under privacy — worth checking what's still on by default, since these options change.
• Think about the microphone and the doorbell. A device that listens in your kitchen, or films the pavement outside your door, is a genuine convenience and a genuine choice. Just make it knowingly, and know that footage can be requested by others.

Cameras that read number plates

The lesson from Flock: this equipment arrives quietly, and it leaves when people find out about it.

An automatic number plate reader is a camera that photographs every passing car, converts the plate to text, and stores the plate, the location and the time in a searchable database — usually along with the make, colour and other distinguishing marks. It records everyone, not suspects. In the United States the largest supplier is a company called Flock Safety, with well over a hundred thousand cameras and data shared across thousands of agencies. The company says it doesn't sell the data or run facial recognition on it, and that agencies set their own deletion periods.

What makes it worth your attention outside America is what happened next. A man called Will Freeman started DeFlock — simply a public map of where the cameras are, built on OpenStreetMap by volunteers who photograph poles and add pins. Flock sent him a legal demand to stop. He refused, backed by the EFF, and kept going. Since the start of 2025, more than thirty towns and cities have deactivated their cameras or cancelled their contracts.

The idea travels. Number plate cameras are not an American invention — Britain has run a national network for years, and similar systems are in use across Europe, the Gulf and beyond. Wherever you live, the method is the same four steps:

• Look up. Once you know what the housings look like, you'll see them on your own street. Most people walk past them for years without registering them.
• Write it down. Add what you find to OpenStreetMap or DeFlock. A map is the thing that turns a private suspicion into a fact other people can check.
• Ask, in writing. Whatever your country calls it — a freedom of information request, a written question to a council, a letter to a regulator — public bodies can be asked what they bought, what it cost, how long the data is kept, and who else can search it. The answers are often more revealing than the cameras.
• Show up where the decision is made. Every one of those thirty-odd cancellations happened in a room, in front of elected people, because residents turned up. Contracts get renewed by default when nobody is watching.

Learn more

Free, trustworthy, and written for ordinary people.