Sales claims and facts

Fourteen claims

• Misleading · what the seller says

  Without a VPN, everything you do online is wide open to hackers.

  Without a separate service, your traffic is visible to anyone on the same network or anywhere along the way.

  What is true

  HTTPS protects the contents of ordinary browsing between your browser and the website. A VPN can hide traffic from the local network, but it cannot make a scam site or malware safe.

  A VPN encrypts the connection between your device and the VPN server. The local network sees less, but some trust shifts to the VPN provider. It does not stop phishing, password reuse or malware on your device.

  A VPN can be useful for employer-provided remote access or limiting what a local network can observe. Check operation and local rules separately on a restricted network. It should not be sold as a cure-all for ordinary home browsing.

  Research into VPN advertising found systematic exaggeration of online threats. Compare the actual features, ownership, data practices and independent audits instead of relying on an advert.

  What you can do: Pay attention to browser connection warnings and check the site address before signing in or paying.

• Misleading · what the seller says

  Public wifi is dangerous.

  On a cafe or airport network, anyone can read your passwords and your card details.

  What is true

  HTTPS protects content between your browser and the website on a public network too. The network owner may still see connection details, and a fake network or scam site remains a risk.

  Public networks are less risky than they once were because websites now generally use HTTPS. Encryption protects the contents of the connection, but it does not confirm that you joined the right wireless network or opened the right website.

  In 2022 the advertising regulator in Britain found that one advertisement in this industry caused unjustified fear, and stopped it from running. The decision was about how the advertisement was made, not about what the product does.

  For especially sensitive use, or whenever the network looks suspicious, use your phone’s own connection. A privacy service can limit what the local network sees, but it cannot fix a mistyped address or a scam site.

  What you can do: Choose the correct network, heed browser warnings and check the site address before signing in.

• Sales pitch · what the seller says

  Sponsored: this service hides you completely.

  The person who made the video says they use the service themselves and promises it makes you unidentifiable online.

  What is true

  There is no such thing as perfect anonymity. Logging in to your own account identifies you, whichever server your traffic passes through.

  A sponsored creator is paid to present the product. That does not make every claim false, but the recommendation should be assessed as advertising rather than an independent test.

  Research on influencer marketing found systematic exaggeration of what the product protects. The same research found that viewers who know something about security also overestimated the protection, going by the advertisements.

  In a consumer organisation’s test, 12 services out of 16 made inaccurate or exaggerated claims. The most common one was a promise of perfect anonymity.

  What you can do: Treat a sponsored recommendation as advertising and verify its main claims with independent sources.

• Fraud · what the seller says

  A virus has been detected on your device. Call this number.

  A web page or a pop-up says it has found an infection and tells you to call a support number straight away.

  What is true

  An ordinary web page's own alert is not the operating system's virus scan. A phone number shown on the page is not a safe route to support.

  The notice is built to look like a warning from the operating system itself. It often has a sound, a countdown and a warning triangle, because all three pull your attention away from the one question: how would it know?

  If the tab will not close, close the whole browser using the operating system’s controls or restart the device.

  Finland’s National Cyber Security Centre warns about scams that use urgency and fear. Do not call the page’s number or install the remote-access tool it suggests.

  What you can do: Close the tab. Do not call the number, and do not let anyone connect to your computer remotely.

• Misleading · what the seller says

  The protection that comes with Windows isn't enough.

  The protection built into the operating system is a basic level, and real safety needs a paid package.

  What is true

  In an independent test laboratory's June 2026 round, Windows' own Defender scored full marks for protection. Twelve other products received the same score.

  In the June 2026 test, Defender shared the top protection score with 12 other products. That does not mean it beats every paid product or that one test round settles the comparison permanently.

  When a paid product is worth it

  A paid package can be worth it if you need one specific extra feature and you know which one. Central management for several computers, or parental controls, are examples.

  Compare the extra feature, annual price and a current independent test result before subscribing.

  Test rounds change every few months. Check the date of the result before comparing products.

  What you can do: Check that Windows' own protection is switched on and that updates install automatically. For most people that is enough.

• Sales pitch · what the seller says

  Your old router is dangerous. Buy a new one.

  Your router is so old that it is a risk, and the only fix is to buy a new one right now.

  What is true

  This is sometimes true. On 7 May 2025 the FBI warned that criminals use routers the manufacturer no longer updates. What decides it is update support, not the age of the device as such.

  According to the FBI’s notice, routers built in 2010 or earlier are unlikely to get updates any more. Malware can install a proxy on the router and relay other people’s traffic through it.

  The FBI also found end-of-life routers with remote management enabled. Switch it off if you do not use it.

  How to check

  The model number is on the bottom or side of the device. Use it to find the manufacturer’s support page and check the latest update and support status. If the information is missing, ask the manufacturer.

  What you can do: Find the model number of the device and check on the manufacturer's support page whether it still gets updates. Switch remote management off while you are there.

• Sales pitch · what the seller says

  This device protects every smart device in your home.

  A box you plug into the network watches the traffic and protects every device in the home at once.

  What is true

  A network-security device may monitor or restrict traffic, but it cannot install a missing manufacturer software fix on another device.

  Ask the seller to distinguish traffic monitoring, connection blocking, time limits and any claim that the product repairs faults in other devices.

  Another network device may limit connections or detect unusual traffic. The software fault itself still needs an update installed on the affected device.

  A guest network or other separation can limit access from smart devices to computers and phones when the router supports isolation. Check your router’s instructions before buying another device.

  What you can do: First check device support and the isolation controls already in your router. Then compare the extra functions the separate product provides.

• Misleading · what the seller says

  Without identity protection your details get sold on the dark web.

  A service with a monthly fee stops your personal details being misused and keeps watch over you around the clock.

  What is true

  Services vary. Finland's free voluntary credit ban makes it harder to take out credit in another person's name, while paid monitoring may provide alerts and extra services.

  One risk from the misuse of personal data is credit being taken out in another person’s name.

  A vapaaehtoinen luottokielto (voluntary credit ban) makes it hard for anyone using your details to get credit. It does not stop you taking out a loan yourself.

  The voluntary credit ban from Verohallinto (the Finnish Tax Administration) is free. Paid services may add monitoring of other registers, alerts, practical help or insurance.

  When a paid service can still be worth it

  If your details have already leaked and misuse has happened, continuous monitoring can be useful. Even then, set up the credit ban that costs nothing first.

  If your Finnish personal identity code leaked, Suomi.fi advises blocking address notifications at both DVV and Posti. Restrict the release of contact details too. In MyTax, limit changes to the tax-refund account number to the authenticated online service.

  What you can do: Set up a vapaaehtoinen luottokielto (voluntary credit ban) in the positiivinen luottotietorekisteri (positive credit register) kept by Verohallinto, the Finnish Tax Administration. It costs nothing.

• Sales pitch · what the seller says

  The offer is only valid for the length of this call.

  The price disappears if you do not decide now. Thinking it over costs you money.

  What is true

  In most Finnish phone-sales situations, a contract binds only after you accept the later offer in writing. The law has two exceptions.

  The rule has applied since 1 January 2023. In covered phone sales, the contract is made only when you accept the post-call offer in writing or another durable form.

  The rule has two exceptions. It does not cover phone and internet subscriptions or a situation where you called the company yourself or asked it to call you.

  What you can do: Ask for the offer in writing and end the call. If the terms are not available in writing, do not accept the offer.

• Fraud · what the seller says

  I am calling from your operator's security department.

  The caller represents a company you know, and has information about your subscription or your device.

  What is true

  The number on your screen can be faked, including a number that appears to belong to a company you know. A job title does not verify the caller.

  Calling back on an official number you found yourself verifies which organisation you are dealing with.

  Finland’s Police is clear: banks and public authorities do not ask for online-banking credentials or confirmation codes by phone, text message or email.

  Do not use a number you were given in that same call or message. Look the number up yourself on the back of a bill, on your card, or on the company’s website.

  What you can do: End the call and ring back on a number you look up yourself, from a bill or from the company's website.

• Sales pitch · what the seller says

  Your camera's recordings are only safe with a cloud subscription.

  Without the monthly fee the recordings disappear, and the camera is of no real use.

  What is true

  Recording depends on the model. If local storage meets your needs, the subscription adds a separate copy and the features included in the service.

  A cloud subscription is not the only possible way to store video. The alternatives depend on the camera model.

  A camera may use a memory card, internal memory, a separate recorder or the cloud. A subscription can add a separate copy, longer retention and easier searching.

  When a cloud copy helps

  If the camera can be stolen or damaged, a recording already uploaded to the cloud remains available. Check the retention period and whether you can download the recording.

  Ask which functions remain without the subscription and what happens to existing recordings when the plan ends.

  What you can do: Check the camera's manual for whether it records locally. Then decide whether you need a copy somewhere else.

• Misleading · what the seller says

  Without the extra cover offered at the till, a repair will cost hundreds.

  When the warranty ends you are on your own, so you should buy the paid cover now.

  What is true

  A warranty ending does not end statutory liability for defects. Paid extra cover is a different product and may cover damage that the law does not.

  A genuine warranty is free to you. A paid maintenance agreement, extra cover or product insurance is not a warranty, even if its marketing name sounds similar.

  A warranty ending does not end statutory liability for defects. Its duration follows from how long a comparable item can reasonably be expected to last.

  Paid cover may include wear or damage caused by something outside the device. Judge it by its own terms, not by the marketing name.

  Work it out before you decide

  Put the price next to the price of the device. A hundred euros of extra cover on a two-hundred-euro device is a different proposition from a hundred euros on a thousand-euro one.

  Ask what the cover leaves out. Compare the exclusions with what it promises to cover.

  What you can do: Ask for the terms. Check the covered events, exclusions, excess and total price.

• Fraud · what the seller says

  Pay with a gift card, it is the fastest way.

  The payment has to happen right now, and a gift card is the fastest or the only way. Often you are asked to read the card's code out over the phone.

  What is true

  If somebody requires you to buy a gift card and give away its code as payment, it is a scam. The card number and PIN give the scammer access to its loaded value.

  A contact requiring you to buy a gift card and give away its code as payment is a scam.

  The card number and PIN give the scammer access to the loaded value. The scammer can spend it while you still hold the card itself.

  End the conversation. If you gave away the code, contact the card issuer immediately and ask for a refund. Keep the card and receipt and report the offence to the police.

  What you can do: End the conversation. If you already gave away the code, contact the card issuer immediately, ask for a refund and report the offence to the police.

• Sales pitch · what the seller says

  Do not tell anyone about this, it is a special offer.

  The benefit is personal, and talking about it would spoil it or be unfair to other customers.

  What is true

  A seller's demand for secrecy prevents independent checking and is a reason to pause the decision.

  The terms of a consumer offer should stand up to a written check. Secrecy combined with urgency is a strong warning sign.

  Ask for the company name, total price, contract length and cancellation terms in writing. Check them yourself or with someone you trust.

  If the seller refuses a check or the offer disappears when you ask, do not agree during the call.

  What you can do: Go through the offer with someone you trust. A second pair of eyes can spot unclear terms.

Checked 2 September 2026