Summary

Your financial assets are at greater risk than they have ever been. That’s because most of your assets are accessible online. Hackers and fraudsters know that, and they will invest significant resources to steal from you.

There are basic steps you should take to protect yourself. None of these steps is hard. No step on its own guarantees your safety. But together, they provide strong protection. Hackers and fraudsters are looking for easy targets. If you have built a layer of security around your assets, they will likely look for an easier mark.

Most critically, protecting yourself requires ongoing effort. Every day, you should be vigilant about suspicious emails, phone calls and texts. Sadly, hackers and fraudsters never rest.

Even if you do all of this, you still face risk. But your risk is much lower. A big reason: many of your friends and neighbors won’t be as careful as you are, making them – not you – easier targets. This may remind you of the apocryphal story of the two people in the sights of an approaching, menacing bear. One person looked at the other lacing up his running shoes and asked, “Why are you doing that – you can’t outrun a bear.” He replied, “I only have to out-run you.”

Our Summary Recommendations:

• Freeze your credit.
• Don’t share sensitive information over email, text or on social media.
• Create hard-to-hack passwords, use a password manager, and consider passkeys.
• Use 2-factor authentication for most sensitive logins.
• Wi-Fi: only use secure Wi-Fi networks.
• Automate software updates.
• Purchase anti-virus / anti-malware / anti-spyware software for all your devices and keep the software up to date.
• Think before you click on any hyperlink.
• Never answer a call from a phone number you don’t recognize.
• Buy and use a shredder.
• Slow down.

Our more detailed, 11-step action plan is below.

To compile it, we sought and received input from clients and friends about their experiences. We also researched best practices and reviewed discussions we have had over the last decade with clients.

Step 1: Freeze your credit.

Everyone’s credit profile is maintained by three credit bureaus: Experian, Equifax, and TransUnion. To obtain a mortgage or personal loan, or to open a credit card, the bank will first check your credit report at one of these three agencies. If you have frozen your credit, almost no lender will approve your application. So, a fraudster who has stolen your identity – perhaps your Social Security number, address, date of birth and other basic details – will not be able to open a credit card or loan in your name.

To freeze your credit, you should create an online account with each of the three credit agencies. (You can do it by telephone, but it’s easier online.) Then you simply select “credit freeze”. It’s that easy.

If you need to unfreeze your credit profile – for example, to open a new credit card – you simply ask the card issuer which credit bureau they use, go online to unfreeze (“thaw”) your credit, get confirmation your credit card application has been approved, and then go back online to re-freeze it. The entire process can take as little as 10 minutes.

Here’s a link with more info on how to freeze your credit, from the Consumer Financial Protection Bureau.

Step 2: Do not share sensitive information over email, text or on social media.

Never put any of the following in an email, text or on a social media website:

• Bank or brokerage account numbers.
• Your Social Security number.
• Your date of birth.
• Passwords.
• Secret words you use to verify your identity.

Yes, this is a hassle. The easiest workaround, if you need to share any of this sensitive information, is to provide it on a phone call. There are more elaborate tools like secure email that require a password – but those are not necessary for most people.

At Old Peak, every client has a secure portal. When sharing brokerage statements, tax returns or similar documents with sensitive info, we and our clients upload to and download from their secure portal.

Step 3: Create hard-to-hack passwords, use a password manager, and consider passkeys.

Most websites now require you to have a password which is complex – with upper- and lower-case characters, numbers and symbols. If they don’t, you should do it anyway.

Don’t use the same password twice, or the same password structure, like “FredSchwab123”, “FredWellsFargo123” and “FredFaceBook123”.

The easiest way to manage your passwords is with a password manager. There are dozens of products available – just search online for a list of recommended products. If you don’t already use a password manager, you will be amazed by how much easier it makes working online. As soon as you have one and have populated it with your passwords, shred the list you keep in your drawer with your passwords. The only password you will need to remember is the password to your password manager. Keep that somewhere very safe, make it complex, and share its location with your spouse or a trusted friend, in the event you are incapacitated or die.

Most password managers will auto-generate a complex password along the lines of “rF56dty$%_KlgL&”. This kind of password is almost impossible to hack. With a password manager, you don’t need to remember it. That’s a win-win.

Most websites are moving from passwords to passkeys. They serve a similar purpose, but they use fingerprint or facial recognition technology to allow you to login. As a result, you don’t need to remember a password. Search online to learn about passkeys and consider switching for websites that allow a choice.

Step 4: Use 2-factor authentication for the most sensitive log-ins.

Different websites use different types of 2-factor authentication (“2FA”). Some will send a code via text to your mobile phone or via email. Some use more sophisticated tools, which are even more secure.

At a minimum, you should use 2FA for the most sensitive logins, i.e., to any financial institutions where you have significant assets.

Step 5: Wi-Fi: only use secure Wi-Fi networks.

Start by making sure your home network – where you do most of your work when not in the office – is secured by a password. That will make it hard for someone hiding nearby to hack in.

Perhaps a bigger risk is accessing secure sites online when you are traveling, whether at an airport, a hotel, or a coffee shop. Assume none of those networks are secure. Your options:

1. Invest in a virtual private network (“VPN”). We do that at Old Peak because we work regularly from home.
2. Create a hotspot with your cellphone. That is far safer than the free Wi-Fi at your local Starbucks, even if it is “protected” by a password, because the password usually costs $2.50 to obtain (i.e., the price of a small regular coffee).
3. Don’t access any sensitive websites until you are back home or in the office.

Step 6: Automate software updates.

The major software companies are diligent about providing software updates online. Often these updates are to patch holes which have provided easier access for hackers to accounts or computers. Make sure your devices are set to accept updates automatically. If they are not, the alternative is to accept an update whenever you receive notice that one is available.

Step 7: Purchase anti-virus / anti-malware / anti-spyware software for all your devices and keep the software up to date.

All laptops come with a product built in. You can use it, or you can select a competitive product.

The US Government’s Cybersecurity & Infrastructure Security Agency has a succinct description of these products:

Although details may vary between packages, anti-virus software scans files or your computer’s memory for certain patterns that may indicate the presence of malicious software (i.e., malware). Anti-virus software (sometimes more broadly referred to as anti-malware software) looks for patterns based on the signatures or definitions of known malware. Anti-virus vendors find new and updated malware daily, so it is important that you have the latest updates installed on your computer.

Step 8: Think before you click on any hyperlink.

One of the common ways hackers can gain control of your computer is by your clicking on a malicious link. Emails and websites are full of links. They make life easier. This whitepaper has a few hyperlinks. Sadly, hyperlinks also make life easier – and more profitable – for hackers. Before clicking on any link, ask yourself: Is this email or online source legitimate? Am I sure the link is not malicious?

You can hover over the link to see the destination, and that may reveal it is not what you think. Our incoming email protection system identifies dozens of malicious emails every day.

If you have security software installed, you have some protection. Often you will get an alert before clicking on something malicious, and the software will work to identify malicious software when it has infected your device. But you are the first line of protection.

At Old Peak, we use a service that periodically tests each of us by simulating a phishing attack. Phishing is a type of online scam that targets email users – i.e., all of us -- by sending them an e-mail that appears to be from a well-known source – an internet service provider, a bank, or a mortgage company, for example. It asks the consumer to provide personal identifying information. Then a scammer uses the information to open new accounts or to invade the consumer’s existing accounts.

Thankfully, email services like gmail do a good job of sending phishing and suspicious emails into your junk folder. That’s why it’s far less common to receive the classic Nigerian prince email than it was only a few years ago. But hackers are always looking for the next path into your computer. That is why you must remain alert, 24x7.

Step 9: Never answer a call from a phone number you don’t recognize.

One easy way to hack into your computer is to call you, pretending you have already been hacked, and trick you into providing info the caller needs to gain access to your online accounts. The caller is supposedly from your bank, brokerage, Amazon, or Apple. They will use large, well-known companies, to maximize the likelihood you may use that product and therefore be more likely to fall prey to their scam.

The easiest way to avoid this threat is not to answer any phone call from a number you don’t know. We all have mobile phones, and we can easily enter in the details of anyone whose call we want to pick up. All other calls go into voicemail, or you can direct them to text you a message. If the call or message is important and legitimate, you can call them back within moments.

Step 10: Buy and use a shredder.

At a minimum, you should shred any documents that have account numbers or other sensitive info on them. We believe there is no reason to keep paper versions of statements or similar documents. There are secure file storage services, and financial institutions will keep your statements on their websites.

Most people should keep a paper version of their tax returns for at least three years. (The IRS has additional recommendations on their website for special cases.)

Everything else with sensitive info is best shredded.

Step 11: Slow down.

Like so much else in life, you can avoid mistakes by slowing down.

If you pick up a call from an unknown party claiming you need to provide them with your Bank of America account number, the best first step is to pause and think. Get a number and call them back. Then ask yourself: how can I determine if this is a legitimate call? Get help from a friend or call the number at Bank of America listed on their website.

If you receive an email with a link that seems a bit suspicious, stop and ask yourself: do I know and trust the sender? Am I sure the email is legitimate? Do I really need to click on the link? One of the many scams is an email supposedly from a relative who is traveling, not reachable by phone and in need of a money transfer. This combines three tell-tale signs of a scam: time urgency, emotion / need, and an inability to confirm the request’s legitimacy.

If you need to send your financial advisor an account number, ask yourself: what is the most secure way to do it? Can I use a secure portal or just call them with the info?

These kinds of steps are easy to follow. They only require you to slow down.

Disclosure: The information in this whitepaper was obtained from sources believed to be reliable. However, the accuracy or completeness of this information is not guaranteed. This whitepaper is not an offer to sell or a solicitation of any investment products or other financial product or service or an official confirmation of any transaction. It is a general discussion and may not consider unique issues faced by an individual reader. Securities and insurance products are not FDIC-insured, are not guaranteed, may lose value, are not bank deposits and are not insured by any federal government agency. Past performance is no guarantee of future results. Old Peak Finance LLC (“Old Peak”) is an SEC-registered investment adviser based in North Carolina. Old Peak will only transact business in those states in which it is registered or qualifies for an exemption or exclusion from registration requirements.