1. How attackers really get in
FBI IC3's 2024 report logged $16 billion in cybercrime losses in the U.S. — investment fraud was the #1 category. Attackers do not "hack" your broker's servers; they hack you. The four common paths:
- Phishing: a convincing email/SMS/call lures you to a fake login page. You type your password and 2FA code; the attacker relays them in real time.
- SIM swap: attacker convinces your carrier to port your number to their SIM. SMS-based 2FA codes now go to them.
- Credential stuffing: a breach somewhere else exposes your email + password; bots try it on every brokerage.
- Malware on your device: keyloggers, info-stealers (RedLine, Vidar) extract saved passwords and session cookies.
2. Phishing & spear-phishing
Red flags
- Sender domain looks like the real one but isn't (fidelityaccounts-secure.com, schwabb.com).
- "Urgent" tone — your account will be closed, suspended, frozen.
- Generic greeting ("Dear Customer") on what claims to be a personalized alert.
- Link target (hover before you click) does not match the brand.
- Asks you to "verify" by typing your password into a page reached from the email.
Rule: Never click a link in an email or SMS that claims to be from your broker. Always type the URL yourself or open the broker's app.
3. SIM-swap attacks
One $25 bribe to a low-paid carrier rep can move your phone number. Once moved, every "Reset password — text us a code" flow is owned. Mitigation:
- Add a port-out PIN at your carrier (T-Mobile, Verizon, AT&T all support it).
- Never use SMS for 2FA on financial accounts. Use an authenticator app or hardware key.
- If your phone suddenly loses signal in a non-coverage area, call your carrier from another phone immediately.
4. Credential stuffing
The average person has ~240 online accounts. If you reuse one password and any of those 240 sites is breached, every account using that password is compromised. haveibeenpwned.com can show your exposure.
5. Investment & romance scams
- Pig butchering — a "wrong number" text builds a friendship, then convinces you to invest on a fake crypto/forex platform. Losses average $200,000+.
- Telegram/WhatsApp pump groups — coordinated buys to ramp a micro-cap, then dump on followers.
- Fake brokers / clones — websites that mimic Schwab/Fidelity. Always check FINRA BrokerCheck and SEC IAPD.
- Recovery scams — after you've been scammed, a second scammer offers to "recover funds" for an upfront fee.
6. Your 9-control defensive stack
| # | Control | Why |
|---|---|---|
| 1 | Unique 16+ char password per site (password manager) | Kills credential stuffing dead. |
| 2 | Hardware security key (YubiKey 5 or Google Titan) | Phishing-resistant 2FA. The single highest-impact upgrade. |
| 3 | Authenticator app (Authy, 1Password, Aegis) for sites without FIDO2 | Beats SMS 2FA on every metric. |
| 4 | Carrier port-out PIN + Number Lock | Stops SIM-swap. |
| 5 | Dedicated email for finance accounts (not used elsewhere) | Reduces phishing surface. |
| 6 | Account-level money-out alerts at every broker | You'll see a transfer attempt instantly. |
| 7 | Voice / withdrawal PIN with broker (Schwab, Fidelity offer this) | Stops social-engineering of the phone channel. |
| 8 | Credit freeze with all 3 bureaus + ChexSystems | Stops attacker from opening new accounts in your name. |
| 9 | Auto-updating OS & browser, no pirated software, no random Chrome extensions | Closes the malware path. |
7. Hardware keys (FIDO2)
A $50 YubiKey signs a cryptographic challenge from the real domain only. A phishing site cannot relay the auth because the signature is bound to the URL. Coverage in 2025:
- Google, Microsoft, Apple, Github, Amazon — full FIDO2.
- Fidelity, Schwab, Vanguard — TOTP only as of writing (push for FIDO2).
- Coinbase, Kraken, Gemini — full FIDO2.
- Buy two keys: one daily-carry, one in a fireproof safe as backup.
8. Security self-audit
Your security score
Check the controls you have. Hit "Score" to see your number.
9. The first hour after a breach
- Disconnect the affected device from the network.
- From a different, clean device: change the password and revoke all sessions on the email account first, then the broker.
- Call the broker's fraud line directly (use the number on the back of your debit card / official site, not anything from the email).
- Request a trading freeze and ACH freeze on the account.
- File reports: IC3.gov (FBI), reportfraud.ftc.gov, your broker's fraud team in writing.
- Place a fraud alert with credit bureaus.
- Reset every other account that shared the breached password.
- Wipe and reinstall the affected device — assume it is still compromised.
- Document a timeline. SIPC and broker fraud reimbursement processes will require it.