Blog – Page 8

Why Password Hygiene And 2FA Are So Important

Last Updated: October 4, 2024

How to Secure Your Online Accounts: A Cautionary Tale and Easy Fixes

Last week, I helped a business owner who was dealing with a major issue: her Facebook account had been hacked. Some sneaky person managed to gain access, make themselves an admin, and was on the verge of locking her out of her own business page. She only discovered the problem when she couldn’t log into her Instagram account, even though she was certain she had the correct password.

Why Did This Happen?

After looking into it, it became clear that someone likely obtained her password through a data breach or used a brute-force attack to guess it. The reason this was possible? She wasn’t using unique passwords for each account and hadn’t enabled 2-factor authentication (2FA). These are simple steps that could have prevented the whole ordeal.

How to Prevent This From Happening to You

Yes, it takes a bit of effort to secure your accounts, but trust me, the alternative is much worse. If someone gains control of your business accounts, they can wreak havoc—posting inappropriate content, driving away customers, and damaging your reputation. Reclaiming access to a hacked account can be a nightmare, and the damage done in the meantime can be long-lasting.

Let’s break down some easy steps to avoid this headache.

What is 2FA?

2-factor authentication (2FA) adds an extra layer of protection by requiring a second form of identification, beyond just your password. You can use apps like Aegis (the most private of these options), Authy, Google Authenticator, or Microsoft Authenticator to set this up.

One important tip: avoid using text messages for 2FA if possible. Some services still require this (like most banks), and while it’s better than nothing, it’s far from foolproof. Hackers can use something called a SIM swap attack, where they get your phone number assigned to their device without you knowing.

If you have no choice but to use SMS-based 2FA, consider using a service like Google Voice (free) or Sideline (paid), which are much less vulnerable to these types of attacks.

If you’d like a quick intro to 2FA in video form, check out NBTV’s video on it:

What Does Good Password Hygiene Look Like?

First and foremost, your passwords should be unique for every account. Each password should include numbers, uppercase and lowercase letters, and symbols, and it should be at least 16 characters long.

This graphic helps you understand how easy it is to break through simple passwords. Keep in mind that this is using 2024 compute power. Every year this power increases and once we get to quantum computing, this all goes out the window so the stronger you make them now, the longer they’ll last.

time it takes to brute force a password in 2024

One trick is to use a passphrase—a sentence or fragment that’s easier to remember but long enough to be secure. Just don’t forget to mix in numbers and symbols.

Even better, use a password manager.

What is a Password Manager?

Trying to remember every password is asking for trouble. Since trying to remember all your passwords is an impossible task in today’s day and age, most people cope by using weak passwords or repeating them across accounts. A password manager lets you store all your passwords in one place, meaning you only need to remember one password, but most importantly, it’ll make it super easy to use very complex passwords. Most password managers auto-generate secure, complex passwords and can even autofill your login details across devices and browsers.

I recommend checking out Bitwarden—it’s a trusted and reliable option. We have no affiliation with them, but they have a solid track record.

For a great video on this topic, check out another NBTV video here:

In Conclusion

I know setting all this up may seem overwhelming at first, but I promise it’s worth it. It doesn’t take much effort to secure your accounts, and once it’s done, you’ll hardly notice the small inconvenience. What’s truly inconvenient is having your accounts stolen or hacked. Protecting your online presence is a small price to pay compared to the damage that can be done if your accounts are compromised.

Take these steps now to secure your business and your peace of mind!

Domain Renewal Letters Sent By Snail Mail Are Scams

Last Updated: October 2, 2024

Leer en español

In this edition of our ScamWatch series, we’re highlighting a specific type of scam that’s has been around for years, but just won’t go away—fake domain registration renewal letters sent by good old-fashioned snail mail.

What Are Fake Domain Registration Renewal Letters?

Picture this: You’re sorting through your mail, and you find a letter that looks official. It says your domain is about to expire, urging you to renew immediately. The letter looks professional and uses scary language like “final notice” or “urgent action required.” But here’s the catch—it’s a scam.

(Click an image to expand it)

These fake domain registration renewal letters are designed to trick you into thinking your website will go offline unless you take immediate action. The scammers hope to get you to pay for a bogus renewal service or to charge you way more than what your actual domain registrar would ask.

The critical thing to remember is this: if it arrives by mail, it’s almost certainly a scam. Unlike emails, which can sometimes be legit (though they require careful scrutiny), you can safely assume that 100% of domain-related letters sent via snail mail are fraudulent. Just throw them out.

Why Do Scammers Send These Letters?

While many scams these days target your inbox, domain renewal scams have a retro twist—they often arrive by postal mail. Scammers choose this method because it feels more official and less likely to be questioned. After all, most people are cautious about clicking on email links but may be less skeptical of a physical letter that looks official.

These fraudsters use public domain registration data, pulling your contact information from databases like WHOIS (whois.com). Then they mail you a letter, hoping the official-looking document convinces you to part with your money.

How to Spot and Avoid Fake Domain Letters

It’s easy to avoid falling victim to these scams once you know what to look for. Here’s a quick checklist to help you stay safe:

They’re always demanding way too much money. Domain registration should cost you between about $10 and about $20 per year. These scams are typically looking for several hundred dollars.
If it’s by mail, it’s a scam: As we mentioned, no legitimate domain registrar sends renewal notices via postal mail. All genuine renewal notifications come through email or your registrar’s online portal.
Verify through your registrar’s website: If you’re ever in doubt about the status of your domain, log into your account with your official registrar directly. Don’t trust any information that comes from a letter in the mail. Popular registrars include Porkbun, Godaddy, Ionos, Namecheap, Bluehost, and DreamHost. (We have no affiliation with any of these, they’re just popular providers. If you need a recommendation, please reach out to us and we’ll give you our thoughts on them.)
Keep track of your domain expiration date: One of the best ways to avoid these scams is to stay on top of your renewal schedule. Make a note of when your domain actually expires and set reminders to renew it through your registrar. (Pro tip: Include the name of your registrar in the reminder because MANY people forget who they registered the domain with)
Enable domain privacy protection: Protect yourself by enabling privacy protection when you register your domain. This keeps your contact details out of public databases, making it a bit harder for scammers to target you.

Related Scams We’ve Covered

Fake domain renewal letters aren’t the only scam targeting business owners. In fact, we’ve written about domain listing scams in the past, which work in much the same way. These scams also arrive with official-sounding language, urging you to pay for a “listing service” that your domain doesn’t need. Reading through that older, but highly-related post is a smart way to keep yourself protected.

Final Thoughts: Toss That Letter!

As part of our ScamWatch series, our goal is to help small business owners like you stay ahead of scams and keep your operations running smoothly. When it comes to domain renewal letters that show up in your physical mailbox, you can be confident they’re not legit. Throw them away immediately and stick to managing your domain renewals through trusted, verified channels.

By staying alert and informed, you can avoid falling for these tricks and ensure your business stays protected. If you ever have questions or come across something suspicious, feel free to reach out or revisit our articles for guidance.

ScamWatch: That Demo Isn’t As Unbiased As You May Think

Last Updated: September 27, 2024

Your search results are not my search results because Google shows significantly different results to each user. Failing to understand the extent of this personalization is leading many people to be taken advantage of, and I want to help put a stop to that.

We all know that ranking highly in Google’s search results drives more traffic, which then drives more sales. Unfortunately, some sales reps are more concerned about their own profits than being transparent and manipulate search results in a way that essentially misleads you about your true rankings. One way they do this is by performing a search during a video call or in a pre-recorded video to “prove” that your rankings are strong.

It seems foolproof — you just saw it happen with your own eyes. But what you might not realize is how easy it is to manipulate those results to create a narrative that the salesperson wants you to believe.

Let’s break down how this works and why it’s so important for your business to understand.

The Personalized Search Illusion

Google is fantastic at delivering information tailored to us individually. It tracks our preferences, our search history, and even takes location into account when displaying results. But that also means that Google’s search results are highly personalized. What you see on Google isn’t necessarily what your customers see, and that’s where the problem arises.

If a salesperson is trying to impress you by showing how well your business ranks, they’re unlikely to explain how they’ve been searching for your business repeatedly over the past few months. Google, in turn, learns to prioritize your website in their search results because it assumes they have a strong interest in it. So, when they type in a hyper-specific term like “professional tankless hot water installation service Highlands, TX,” your business appears to rank highly. You, as the business owner, feel reassured.

But what you might miss is that the town mentioned is very small, the search term is overly-specific, and the rep’s search history is packed with similar terms. All of this ensures that your business shows up prominently…for him/her. The issue is that potential customers, who don’t have this search history, may not have the same experience. In fact, they might find you buried on page 4, which is about as helpful as an ice cream shop on Pluto.

Real-Life Examples of How Different Search Results Can Be

To show how much search results can vary, I ran searches using two different Google accounts — one was my personal account, and the other was a generic work account with very little search history. Even though I searched for the exact same keywords, the results were noticeably different.

It Starts With Search Suggestions

Personalized search doesn’t just impact the final results — it even affects the suggestions you see when you first click the search box. Take a look at the difference between the suggestions on my work account (left) versus my personal account (right)… and I hadn’t typed a single thing yet!

If you don’t believe this is powerful stuff, check out Robert Epstein’s research at AIBRT which exposes how much Google sways our elections: https://aibrt.org/downloads/EPSTEIN_2022-GOOGLE’S_TRIPLE_THREAT.pdf

Hot Water Installation Houston, TX

For this example, let’s pretend you’re the owner of Nick’s Plumbing, and I’m the sales rep for your marketing company. You’ve called me, frustrated, because you’re not happy with your current rankings on Google. In response, I reassure you that your rankings are excellent. To prove it, I perform a quick search for “Hot Water Installation Houston TX.”

What I didn’t tell you is that I ran this search while logged into a specific account, carefully curated to show you the results I want you to see. According to the results on this account, you’re in the top spot! See, I told you I’m the best marketer out there…

However, if I had used my personal account, you’d be a lot less impressed. To find your result, we’d have to scroll past two paid ads, then two more sponsored listings, followed by the 3-pack of local results, then past the “People Also Ask” section. Then, you’d finally see your business.

Now, it’s worth noting that Nick’s Plumbing is still the first organic result — which is great! But think about which result any sales rep would choose to show you. Of course, they’d pick the search result from the carefully chosen account. But the personal account’s results actually provide a much more realistic view of what your customers are likely to see.

Appliance Repair Denver, CO

We see a similar pattern with this search. The personal account displays four ads first, then the 3-pack, followed by the organic listings. In contrast, the work account skips straight to the 3-pack, showing a more streamlined result.

While the difference isn’t as stark as in the previous example, the layout still presents quite differently depending on which account is used. If the rep doesn’t explain this to you, you’re left with a skewed impression of your ranking performance.

Random word search “hoops”

For this search, I picked a random word with no context to see how differently the results would come up.

Notice how the two sets of results are laid out. There’s a lot of common content between the two, but the order and presentation vary. The work account displays a horizontal carousel of cast members for a show called “Hoops” at the top of the page, while the personal account pushes this information further down and to the right-hand sidebar.

Additionally, the personal account shows several sections that the work account doesn’t:

Map listings
Image search results
Shopping results
YouTube listings

Depending on the narrative I want you to believe, I can easily choose the results that tell the story I want to sell you.

The Takeaway: How to Protect Yourself From This Misleading Tactic

The key takeaway is simple: don’t blindly trust the search results that sales reps show you. Here’s how to protect yourself:

Test in Private/Incognito Mode
- To see less personalized search results, use Google’s Incognito mode (or private browsing mode in other browsers). While this won’t completely eliminate personalization, it can provide a clearer view of how your business appears to new visitors.
Use Multiple Devices and Locations
- Check your rankings across various devices (tablet, phone, laptop) and using different internet connections (turn WiFi off on your phone to use mobile data, for example). Ask friends or colleagues in different locations to search for the same terms, which will give you a broader perspective of how your business is ranking.
Leverage Tools
- Several tools can help you obtain more generic search results. One option is our AdTrax service, which uses multiple proxy servers to anonymize results and tracks those results over time. While no tool will give you a perfect, unbiased result, this approach provides a better way to measure the effectiveness of a campaign over time by showing minimally-biased results and the trends over time.
Ask Questions
- If a sales rep shows you results that seem too good to be true, ask some tough questions. How did they perform the search? Was it in Incognito mode? What does their browsing history look like? Transparency is crucial, and any reputable SEO consultant will understand the need for these questions.

Conclusion: Be Vigilant About Personalized Search

As a business owner, it’s crucial to understand that Google’s personalized search results can be easily manipulated. Some salespeople use this to mislead you into thinking your rankings are better than they are. Just because you see your business ranking highly in their search doesn’t mean that’s what your potential customers see.

Stay informed, be proactive, and make sure you’re thoroughly testing your search rankings before drawing conclusions about your SEO success. By understanding these misleading tactics, you’ll be better equipped to assess your business’s true performance in Google search results.

SEO Myth-Busting: The Truth About Landing Pages

Last Updated: March 3, 2025

First things first: A landing page needs to be on your website’s domain. If it isn’t, then it’s not a landing page—it’s a completely separate website, even if it’s only a single page. This distinction is crucial because many business owners are being misled by marketers who claim otherwise. This myth can end up hurting your SEO and wasting your marketing efforts.

The False Promise: “Landing Pages on Other Domains Boost Traffic!”

Some marketers might try to convince you that placing landing pages on different domains is a clever way to boost traffic or “hack” Google’s system. They might claim that this tactic can somehow give you an edge in search rankings or drive more leads. But here’s the reality: creating landing pages on different domains does not give you an SEO advantage. In fact, it can do the opposite.

The Reality: What Landing Pages Are and Aren’t

A landing page is a tool designed to guide visitors toward a specific action, like signing up for a newsletter, requesting a quote, or making a purchase. However, to be an effective part of your marketing strategy, it must reside on your main domain. For example, if your website is www.yourwebsite.com, your landing page should look something like www.yourwebsite.com/landing-page. When it’s hosted on your main domain, it contributes to your site’s overall SEO health and authority.

If you create a page on a different domain (like www.someotherdomain.com), Google treats it as an entirely separate website. This means you’re splitting your SEO power between multiple sites instead of building authority on one, which can confuse search engines and weaken your online presence.

Why This Myth Hurts Your Business

Let’s break down why the myth of off-domain landing pages is harmful:

Diluted SEO Efforts: By placing landing pages on different domains, you’re fragmenting your SEO. Instead of building the authority of your main site, you’re spreading it thin across multiple domains. Google sees each domain as a separate entity, reducing your chances of ranking higher in search results.
Visitor Confusion: Sending visitors to a different domain can confuse them. If they expect to be on your website but are redirected elsewhere, this can break trust and reduce the likelihood of conversions.
Wasted Resources: Creating and maintaining multiple domains requires additional time and effort, without offering any real SEO benefit to your primary site.

The Honest Truth About Landing Pages

Landing pages are valuable, but they aren’t a loophole to exploit Google’s algorithms. Here’s what they actually do:

Drive Specific Actions: A landing page is a focused tool designed to funnel visitors toward a specific action—whether that’s filling out a form, clicking a button, or making a purchase. But this focus should happen on your domain, reinforcing your website’s authority.
Optimize for Relevancy: When properly used, landing pages can improve your website’s SEO by providing relevant, targeted content that aligns with user searches and marketing campaigns.
Boost PPC Campaigns: Landing pages are incredibly effective for Pay-Per-Click (PPC) campaigns. By directing highly-targeted traffic to a page specifically built around the ad’s message, you can improve relevancy scores, drive down costs, and increase conversions. But again, this only works if the landing page is part of your main domain.

The Real Power of Landing Pages: PPC Campaigns

Landing pages can be a game-changer for your PPC campaigns. When they’re hosted on your main domain and aligned with your ads, they can:

Improve Relevancy Scores: PPC platforms like Google Ads value relevancy. When your landing page closely matches the content of your ad, Google sees this as a positive signal, improving your relevancy scores. Higher relevancy means lower costs per click and better ad placements.
Increase Conversions: A landing page that’s tailored to the ad’s message creates a seamless user experience, making visitors more likely to convert. This is a win-win for both your PPC performance and your overall website goals.

Best Practices for Landing Pages

To avoid falling into the trap of off-domain landing pages, focus on the following best practices:

Keep It on Your Domain: Always host your landing pages on your main website. This not only boosts your SEO but also ensures a cohesive experience for your visitors.
Streamline the Experience: Use landing pages to create a focused, distraction-free environment. Minimize navigation options to keep visitors on the path toward your desired action.
Align with Your PPC Strategy: Tailor your landing pages to match the message and intent of your PPC ads. This approach maximizes your ad spend’s effectiveness by increasing conversions and lowering costs.
Provide Clear Value: Use compelling content and a strong call to action to guide visitors toward a specific goal. Remember, the purpose of a landing page is not to trick search engines but to provide a clear, valuable path for your audience.

Protecting Your Business from SEO Myths

If someone is telling you that landing pages on different domains are the secret to driving traffic and boosting SEO, they’re selling you a myth. Quality landing pages are a powerful tool, but they must live on your main domain to be effective. They’re not about gaming the system; they’re about offering targeted, valuable experiences that drive conversions and support your website’s overall goals.

Don’t let yourself be taken advantage of by misleading marketing tactics. A solid landing page strategy—rooted in best practices and honesty—will always serve your business better in the long run. In SEO and online marketing, there are no magic tricks—just smart strategies and consistent effort.

Repeated Charges From Facebook – Is It A Scam?

Last Updated: September 27, 2024

If you’ve just started running ads on Facebook (Meta) and are noticing multiple small charges on your credit card, you’ve probably got several alarm bells going off. We get it—seeing a string of transactions labeled “Facebook” with random codes screams fraud and will set off all the alarm bells. But before you panic, let’s break down what’s really happening with Facebook’s billing practices.

Why Am I Seeing So Many Facebook Charges?

If you’re new to Facebook Ads, the company’s billing practices will most certainly catch you off guard. You’re going to see multiple Facebook charges on your credit card and they’ll all be from something like “Facebook WHNS8298DI” which is very suspicious. The Meta ads billing schedule is…unusual…to be sure. These initial charges typically range from $2 to $5, and they seem to happen back-to-back, which is why you’ll likely be hearing from your credit card company’s fraud protection department.

Facebook isn’t trying to scam you, and your card wasn’t hacked. Unfortunately, Meta decided, for some reason, to charge people in a fashion similar to scam artists. In theory, this is because they’re trying to mitigate their risk of being left holding the bag on services rendered without payment received. They’re trying to ensure your payment method works and that you’ll actually pay for the traffic they’re sending you. At the start of your ad campaign, Facebook will bill your card in small increments in rapid succession. Over time, that interval will space out and the dollar amount per transaction will increase.

Here’s a couple real-world examples from some of our clients to illustrate the point.

Facebook’s Billing Practices for New Ad Accounts

If you’re new to running ads, the process might feel overwhelming—and these charges only add to the confusion. Facebook’s billing practices for new accounts are designed to minimize risk (for them and for you). By making smaller charges more frequently, they’re verifying that your card is valid and that payments will go through.

This system can easily trigger fraud alerts on your credit card or bank account. We’ve seen it happen to business owners just starting out with Facebook Ads, and it’s completely understandable why you’d be concerned when you see this rapid succession of charges. But rest assured: it’s completely normal for Facebook’s billing schedule.

What Can You Expect as Your Campaign Progresses?

As you continue running ads and Facebook sees a consistent history of payments, the charges will start to change. Instead of seeing multiple small charges every day or every other day, Facebook will space out the transactions and start charging larger amounts less frequently. So, after a few weeks, instead of seeing $5 here and $7 there, you might see a single $50 or $100 charge once or twice a month.

It’s Facebook’s way of saying, “Okay, we trust this payment method now.” They’ll adjust their billing practices accordingly as your ad campaign gains more traction.

Why Do These Charges Look So Suspicious?

If you’ve been scrolling through your credit card statement and see transactions labeled as “Facebook” followed by a random alpha-numeric code, you’re not alone in thinking it looks shady. Many new advertisers freak out when they see this, but it’s completely legitimate. These codes are just how Facebook categorizes and processes their transactions—nothing to worry about.

What to Do if You’re Concerned About Fraud

It’s always best to log into your Meta Ads account directly, and verify the charges from that side. DO NOT click a link in an email to get to this account because there are many phishing schemed out there that look very legitimate but are 100% just stealing your login credentials. Instead, type the address in directly. If those charges match with what you’re seeing on your card statement, you’re OK. If not, then you have to keep digging because you might have some actual fraud taking place.

In Summary

If you’re new to Facebook Ads, the way Meta handles their ad billing schedule can be a bit jarring. Seeing multiple small Facebook charges back-to-back might seem like a red flag, but this is just their way of verifying that everything’s working properly before moving on to larger, less frequent transactions.

So, don’t worry if you’ve just started advertising on Facebook and your card statement looks strange—it’s all part of their billing practices for new ad accounts. If you’re still concerned or your bank flags the transactions, just confirm that these are legitimate charges and you’ll be good to go!

Prospect Genius