Six Simple Ways to Protect Your Financial Accounts
I have heard several stories about cybersecurity failures lately, so I thought it would be worthwhile to share a few tools for improving your security, especially when it comes to financial accounts.
My hope is to focus on things that are simple, effective, and easy enough to implement that they actually get done. You don't need to become a cybersecurity expert to make yourself a much more difficult target.
First, turn on two-factor authentication (2FA)
In my opinion, this is one of the most powerful security tools available to you. Passwords can be stolen, leaked, or guessed. Two-factor authentication adds another obstacle by requiring you to verify your identity, usually through a code sent to your phone or generated by an app.
Even if someone gets ahold of your password, they generally won't be able to access your account without that second step.
At a minimum, I recommend enabling 2FA on your email, investment accounts, and bank accounts. Your email is especially important because it can often be used to reset the passwords on your other accounts.
If you have a choice, an authenticator app is generally safer than receiving codes by text or email. Passkeys, which let you sign in using a trusted device, are even better. But don't let perfect be the enemy of good. Even text-message verification is much better than having no additional protection.
One important precaution: never give a verification code to someone who calls or messages you asking for it.
Second, use more secure passwords
For most people, a more significant risk is having their passwords stolen in a data breach or falling for a convincing scam.
A strong password has three characteristics: it's long, difficult to predict, and not used anywhere else.
Password length is particularly important. Every additional character can exponentially increase the number of possible combinations an attacker would need to try.
You may have heard that good passwords need a complicated mixture of capital letters, numbers, and symbols. That helps, but length matters more.
One approach is to create a long passphrase using several unrelated words. Something involving honey, bicycles, telescopes, and penguins might be both memorable and difficult to guess, provided the words are selected at random. You can enhance this by deliberately misspelling a word, as this makes it harder to guess.
For passwords you don't need to memorize, a random string of 16 or more characters is even better.
Third, use a password manager
Ideally, every account should have its own unique password. That way, if one company's database is compromised, the stolen password won't unlock your other accounts.
Of course, nobody wants to memorize 50 different passwords, which is where a password manageer comes in handy. These programs securely store your passwords, generate strong new ones, and fill them in automatically when you sign in.
Apple Passwords, Google Password Manager, 1Password, and Bitwarden are a few options. You don't need the most sophisticated system available. You need one that you'll actually use.
You'll generally need to remember only one strong master password, or use your device's secure authentication system. Be sure to secure the password manager itself with additional authentication and keep its recovery information somewhere safe.
And contrary to what you may have heard, you don't necessarily need to change good passwords every year. The more important thing is to make them unique and change them promptly if they're exposed in a breach. Again, the goal is to have a cybersecurity plan you can actually use.
Fourth, be suspicious of unexpected requests, and set up account alerts
Increasingly, criminals don't need to break into your accounts. They just need to convince you to let them in.
An email might claim there's suspicious activity in your bank account and ask you to log in immediately. A text might appear to come from your brokerage firm. Even a phone call can appear to originate from a legitimate financial institution.
Rather than clicking the link or trusting the phone number provided, open the company's app or website yourself. If you're concerned, call the institution using a number you already know is legitimate.
I also recommend turning on notifications for important financial account activity, particularly withdrawals, password changes, and changes to linked bank accounts. These alerts won't necessarily prevent a breach, but they can help you catch unauthorized activity quickly.
None of these measures will eliminate every cybersecurity risk. However, they can make it substantially harder for someone to gain access to your financial information.
If you haven't taken these steps already, I'd start with your primary email account, followed by your bank and investment accounts. You don't have to secure everything in one sitting. Even a few improvements can make a meaningful difference.
Fifth, freeze your credit
One of the easiest ways to protect yourself from identity theft is to freeze your credit reports. A credit freeze prevents most lenders from accessing your credit information to open a new account, making it much harder for someone to take out a loan or credit card in your name.
It's completely free, doesn't affect your credit score, and you can reverse it whenever you want.
You'll need to contact each of the three major credit bureaus separately:
Each allows you to place a free security freeze. Once you've done so, your credit remains frozen until you choose to lift it.
If you decide to apply for a mortgage, car loan, or new credit card, you can temporarily lift the freeze online or by phone, also for free. Then put it back in place when you're done.
A credit freeze won't prevent someone from accessing your existing accounts, so you'll still want to use the other security measures we've discussed. But for anyone who doesn't regularly apply for new credit, I think this is one of the simplest and most effective precautions available.
I recently froze all my own credit, and it took about 15 minutes for all three agencies combined. It happened all via the touch-tone, and didn't require any hold time. Basically, they'll just ask you your social security number, numerical address, zip code, and phone number.
Sixth, have a plan for scams
It isn't necessary to know every scam being run out there, or how it works. In fact, trying to understand how a scam works may only keep you engaged longer and increase the likelihood that the scammer gets the information they're looking for.
Instead, I recommend having a simple plan:
Step One: Disengage!
Hang up the phone, close the email, or stop responding to the text. Take a few minutes to collect your thoughts. Scammers often create a sense of urgency because they don't want you to stop and think.
Step Two: Go directly to the source.
If someone claims your bank, email, or investment account has been hacked, hang up and check the account yourself. Do not use any links or phone numbers provided by the suspected scammer. Instead, log in the way you normally would, or call the institution using a phone number from your statement or bank card.
See if there's anything suspicious. If you're still concerned, talk directly to the institution.
Alternatively, you might get a call from someone claiming to be a family member in trouble.
In the age of AI, it's increasingly possible to imitate someone's voice or even their face. Don't assume that a familiar voice proves who you're talking to. Hang up and call that family member at their usual number, or contact someone who can check on them for you.
It might also help to establish a "password" with your family members to help verify their identity.
Step Three: Get a second opinion.
If you get stuck, can't remember important information, or start feeling confused, slow down. Call a friend or family member, someone who can help you think things through. Two heads are better than one.
You can even call me if you want: 503-730-5093. I'll be happy to help you determine whether there's anything that legitimately needs to be done.
And frankly, there's some self-interest here. As your advisor, helping you recover from a scam, especially one involving a large financial loss, could be a tremendous amount of work and stress for both of us. A five-minute phone call to prevent all that is a great deal for me.
Comments