Most cybersecurity articles begin with the same advice:
Those recommendations should be implemented by everyone. However, because they are so widely discussed, they can overshadow several equally important cybersecurity plays that receive far less attention.
For investors, the greatest financial losses often result from account takeover, identity theft, wire fraud, and social engineering rather than sophisticated hacking. The five plays below focus on reducing the financial impact of those attacks.
You log on and use your email account every day, which probably desensitizes you to the fact that it is arguably the gateway to your financial life. Cyber-criminals understand that if they control your email, they often don't need to break into your bank or brokerage directly. Instead, they simply use the "Forgot Password" feature on financial websites, receive the password-reset email, and take control of those accounts.
Make it your first line of defense to secure your email:
That said, consider using Fast Identification Online (FIDO) authentication for apps and websites that support this new security protocol. For example, Gmail supports it. FIDO provides phishing-resistant, passwordless authentication that replaces and is more secure than traditional passwords and common MFA methods.
Many consumers assume identity theft means someone steals money already in their bank account. Instead, criminals often establish entirely new credit relationships using stolen personal information.
One way to prevent this is to be proactive and freeze your credit. A security freeze prevents lenders from issuing new credit in your name until you temporarily lift the freeze. Unlike credit monitoring, which alerts you after suspicious activity, a freeze helps prevent fraudulent accounts from being opened in the first place.
Sometimes people use the terms “credit freeze” and “credit lock” interchangeably. However, they are different. A credit freeze is free and governed by federal law. A credit lock is not as regulated, and two of the three credit bureau agencies charge a fee. To be effective, you would have to implement a credit lock on all three bureaus. That means this option would have a cost.
Using a credit freeze is easy. Simply freeze your credit by contacting all three major credit reporting agencies. When you need to apply for credit, contact them to unfreeze it. Then, after the creditor has checked your credit, request a freeze again. It takes one business day to freeze and an hour to unfreeze if you request online or by phone. For more information and links to the online forms, go to https://www.usa.gov/credit-freeze.
Five minutes of inconvenience may save you hours and days of dealing with identity theft, not to mention the financial consequences that may occur.
While we’re talking about your credit, take the time to monitor your credit. You can use AnnualCreditReport.com to check your credit report from all three credit bureaus each week for free and to request a free copy of your credit report once every 12 months. One strategy is to request a report from a different credit bureau every four months. See https://consumer.ftc.gov/articles/free-credit-reports for more information.
Waiting for a monthly statement is no longer adequate. Alerts transform you into an active participant in your own fraud detection.
Banks, credit card companies, and brokerage firms allow customers to receive notifications for password changes, new-device logins, ACH transfers, wire transfers, profile changes, and unusually large transactions. Immediate awareness often determines whether fraud is stopped quickly or becomes a major financial loss.
Unlike the other plays, this one addresses a specific type of fraud: tax refund fraud. Some unfortunate taxpayers have had the experience of having someone steal their Social Security number and file a fake tax return designed to generate a tax refund.
You can prevent this fraud by signing up for an identity protection PIN on the IRS website. The easiest way to obtain this PIN is to create an IRS online account. This account can be used for other things, such as paying quarterly taxes.
Your IP PIN is valid for one calendar year and is retrieved each year through your online account. You can find it in your account Profile Tab. You must use the IP PIN when filing any federal tax returns. No one can file a return using your Social Security number without the correct IP PIN.
For more information, see https://www.irs.gov/identity-theft-fraud-scams/get-an-identity-protection-pin.
Anyone who has access to your financial accounts should be following the same security protocols. If other household members are lax, all your efforts may be for naught. To avoid this, create a cybersecurity plan for your household, and review it with everyone. Use the protocols identified in this article as a foundation.
You may need to help some of the members of your household get organized, and that will require time and patience. However, considering the amount of financial pain you can avoid, it seems well worth the cost.
Many brokerage firms allow you to designate a trusted contact. This individual cannot trade your account or withdraw money, but the firm may contact them if it suspects financial exploitation or it cannot reach you.
Cybersecurity is now an essential part of protecting your financial well-being. While no strategy can eliminate every risk, the suggestions outlined in this article can significantly reduce your exposure to identity theft, account takeover, tax fraud, and financial scams.
The best part is that most of these protections require only a modest investment of time. Start by implementing one or two of these cybersecurity plays today, then continue working through the rest over time. Just as sound financial planning is built on consistent, proactive decisions, so is protecting the wealth you've worked so hard to accumulate.
[i] https://www.cisa.gov/sites/default/files/2024-12/joint-guidance-mobile-communications-best-practices_v2.pdf
Apella Capital, LLC (“Apella”), DBA Apella Wealth, is an investment advisory firm registered with the Securities and Exchange Commission. The firm only transacts business in states where it is properly registered or excluded or exempt from registration requirements. Registration of an investment advisor does not imply any specific level of skill or training and does not constitute an endorsement of the firm by the Commission. Apella Wealth provides this communication as a matter of general information. Any data or statistics quoted are from sources believed to be reliable but cannot be guaranteed or warranted.
This communication is provided for general educational and informational purposes only. It is not individualized investment, legal, tax, or cybersecurity advice, and it does not modify your account, advisory agreement, or account instructions.
Neither Apella Wealth nor its employees will request your password, full account credentials, or multifactor-authentication code by email or text message. If you receive such a request from someone claiming to represent us, do not respond; contact us using a known telephone number or a secure method.