Archives for February 2026

This article is the second in a series about cybersecurity/fraud prevention. (You can find the first article here: What Does a Thief Need to Access Your Financial Accounts? It’s Likely Less Than You Think.)

I recently received a very clever phishing attempt by email. (In hindsight, I wish I had taken screenshots prior to deleting it.)

Here’s what it looked like in my inbox:

• From: Vanguard Brokerage Services
• Subject: Your Vanguard statement is ready

Looking at the email via my desktop browser, it was very easy to see that it was a phishing attempt.

Looking at the email on my mobile device, however, there was no immediately obvious sign that the email was not legit. Based on everything immediately visible via my mobile mail app, it looked exactly like a genuine Vanguard email.

Looking at the “From” Field

When I viewed the email on desktop, the “from” field was a dead giveaway. While the “name” of the sender was “Vanguard Brokerage Services,” the email address of the sender was complete gobbledygook. Something like “senderx34x3@xyzpayments.info.” Clearly, that’s not actually Vanguard.

On mobile though, the sender’s email address does not appear immediately (at least not on most mobile mail apps). You just see the name. When viewing the email, there will be somewhere you can tap to display the sender’s email address. But you have to go out of your way to actually do that. And of course the percentage of people who do that with every single email is vanishingly small.

Body of the Email

The text of the email was a character-for-character copy/paste of the real statement-notification emails that Vanguard sends, complete with the appropriate images, branding, etc. Everything looked exactly as you’d expect.

The only thing about it that was wrong is that the links that appeared to point to Vanguard’s login page actually pointed to a scam URL. (That is, the “anchor text” of the link was the appropriate URL, but that’s not where the link actually pointed.)

In other words, it was something like this:

https://vanguard.com/

If you look only at the text of the link itself (the “anchor text”) you’ll think the link is going to take you to Vanguard. But it doesn’t. The link points to ObliviousInvestor.com. On desktop, you can see that easily by hovering over the link. Your browser (usually in the bottom corner) will show you where the link points. (Though even this can be spoofed. So as with the email address, if it looks suspicious, it definitely should not be trusted. But if it looks normal, that doesn’t necessarily tell you that it’s genuine.)

On mobile, however, “hover over” isn’t an option. You can tap a link and hold your finger down, in order to see where the link points. But how many people actually do that for every link they consider tapping? Also, there’s the risk that you tap the link and accidentally take your finger off the screen too early — and now you’ve visited the scam link rather than activating the “preview” functionality.

Browser Location on Mobile

Of course, I did not visit the links in the spam/phishing email. But if I had, I’m confident that the destination page would look exactly like Vanguard’s real login page. Except, of course, it wouldn’t have actually been Vanguard. It would have been a fraudster’s website, set up to collect people’s usernames and passwords as they entered them.

On desktop, at the top of your browser window, you easily see the full URL of the page you’re on. That makes it at least somewhat easier to recognize whether you’re on a legitimate website or not.

On mobile, depending on your browser and device, you often don’t. You might see the first several characters or the last several characters. But you might, for example, have accidentally visited:

vanguard.com-payments-us-vanguard.com

If you only see the beginning or end of that URL, you might think that you’re on Vanguard’s website. But that’s not Vanguard’s website. The actual domain in that URL is “com-payments-us-vanguard.com”, which any old fraudster could have purchased. (The “vanguard” at the start of the URL is a subdomain.)

What To Do

There are a handful of ways to avoid falling for this sort of thing.

Firstly, it’s helpful to actually look at the email address of the sender, even if it’s not immediately displayed in your mobile app. But even that can be spoofed. So while a spammy email address tells you it’s spam, a legit-looking email address does not necessarily tell you it’s genuine.

Secondly, it’s helpful to generally be aware when using mobile that 1) you aren’t seeing as much information as you would via desktop and 2) sometimes the information that you’re not seeing would have been a clear red flag.

Thirdly, if you did end up falling for the email and visiting the link in question, you’d be in better shape if you use passkeys or a password manager (both topics for another day, which we’ll get to). Your passkey would not work on the fake domain. And a password manager would recognize that the domain in question was not actually Vanguard.

But the most effective way to avoid falling for this? It’s the same exact rule that we discussed in the first article in this series! (I promise I’ll move on to other topics soon. But I just want to drive home how critical and valuable this rule is.)

If you receive any inbound communication (whether email, text, or phone call) that purports to be from a company with which you have any sort of account:

• Do not reply.
• Do not give them any information whatsoever.
• Do not click on any links.

Essentially, don’t interact with inbound communications. Instead, if you think it might be genuine and require some sort of response, reach out directly, via trusted means (i.e., either typing the company’s URL directly into your browser or calling the number on the back of your credit/debit card) and ask the company in question about it.

As I’ve written before, the most common financial planning mistake I see is to spend too much time focusing on asset allocation (or investments more broadly) and tax planning, while leaving one or more other major parts of the financial picture unaddressed. That’s often estate planning, some gap in insurance coverage, or spending tracking. But it can also be major gaps in cybersecurity/anti-fraud practices. So on that note, this article is the first in a series about cybersecurity/fraud prevention.

A long-time Oblivious Investor reader recently wrote in to share that he and his spouse had fallen victim to a fraud that resulted in a theft from one of their IRAs at Fidelity (which, as discussed below, was not reimbursed). The total loss was “only” about $4,000. But it absolutely could have been much worse.

Here’s how it played out.

John and Rachel (not their real names) had just returned from a trip abroad. Rachel received the following text:

If you can’t see the image, the conversation reads as follows:

Incoming text:
Fidelity ®: Did You Attempt A Transaction of $374.52 At MODERN FEMME FASHIONS 12/02/2025 (EDT).
Reply (YES) if Recognized.
Reply (NO) if Unauthorized, A Call Will Be Generated To You Momentarily

Outbound text:
No

Incoming text:
Fidelity ®: Thank you for confirming. Please hold for the next available agent to assist you.

After that text exchange, Rachel received a phone call as indicated. At the outset of that call, the agent said that, in order to confirm her identity, Fidelity was going to send her a 6-digit code and asked her to please read it back to them. Rachel received the code and read it back to the agent on the phone.

And that was it. As of that moment, the fraudster was able to access her Fidelity account.

The thief promptly initiated a few money transfers out of the account. Fortunately, John promptly noticed what was going on and contacted Fidelity. Fidelity was able to recover one of the transfers, but the other two (totaling ~$4,000) were not recovered. And because the theft involved the victim unintentionally sharing login information with the thief, Fidelity did not reimburse John and Rachel for the theft.

Why was it only $4,000 that was stolen, when there was much more in the account? (Even the cash balance at the time far exceeded $4,000.) I’m not entirely sure. I think the thief must have intentionally chosen a low amount to hopefully not trigger any alerts on Fidelity’s end. But the situation clearly could have been much worse.

How the Fraud Worked

When we log into an account (if not using a passkey, which is a topic for another day), we provide username, password, and the multi-factor authentication (MFA) code. So we might think of all three as being necessary.

But the thief didn’t need Rachel’s username or password at all. All they needed was the six-digit MFA code.

If that sounds surprising to you, take a look at the password-reset forms for any number of financial institutions. (Here’s Vanguard’s for instance. Here’s Fidelity’s.) Take a careful look at the information they ask for. For many financial institutions, the form requires:

• Name,
• Date of birth,
• Social Security number (or last 4 digits of Social Security number), and
• Zip-code.

After you enter that info, they send you a 6-digit code. And after entering that code, they let you reset your username and/or password, or perhaps they display your username on the screen in plain text and allow you to pick a new password.

And, unfortunately, for most of us, all of that information is available for purchase on the dark corners of the internet, due to large-scale security breaches that have already happened. In the 2017 Equifax breach alone, approximately 147 million Americans had their name, DoB, SSN, home address, and phone number stolen. That’s roughly 43% of the U.S. population in just one data breach. And there have been tons of other breaches.

In other words, for most of us, a thief has everything they need to get into our accounts, other than a 6-digit multi-factor authentication code.

We deal with MFA codes so often that they feel commonplace, mundane, disposable. But they’re the keys to the kingdom. It’s not an exaggeration to say that MFA codes should be guarded more closely than your Social Security number.

“We’re Contacting You About Fraud” Is Itself a Red Flag for Fraud

The readers targeted in this incident are not at all the only people to fall victim to fraud, via a fraudster pretending to be the financial institution, warning them of fraud. It’s a very common tactic. Here are two other examples, if you’re interested in similar stories:

• Imposters Stole $8,000. How ‘Money with Katie’ Got Scammed
• How My Coinbase Account Was Almost Stolen

“We’re contacting you about a suspected fraud” is itself a great way to defraud somebody, for two reasons.

Firstly, it gives the fraudster a plausible reason for the initial contact to the targeted person.

And secondly, it puts the targeted person in a mindset of wanting to take prompt action, in order to stop the supposed fraud — thus making it easier for the fraudster to get the target to follow instructions. It might even be effective enough to generate a panic/fear response in the target, thereby inhibiting clear thought.

What To Do When You’re Contacted

When a financial institution with whom you have a relationship reaches out to you (whether about a suspected fraud or about anything else):

• If it’s a phone call, take down whatever information they give you. (Or frankly just don’t answer the phone if it’s from a number you don’t know. Just listen to the voicemail, if they leave one.)
• Regardless of method of contact, do not give them any information. No information whatsoever. Not your date of birth. Not your Social Security number. And absolutely not a multi-factor authentication code. Give them nothing. Truly, nothing. If it’s a text, do not reply. If it’s an email, do not reply to the email.
• If it’s an email, do not click on any links in the email.
• Then reach out to a trusted phone number that you already have for that financial institution. If it’s your bank, call the number on the back of your credit/debit card. Or directly type in schwab.com (or whatever is the applicable website), and find the applicable phone number there. And once you know you’re actually in contact with the right organization, ask them for details on the situation.

To summarize:

• Don’t respond to any inbound messages that appear to be from financial institutions. Don’t give them any information.
• Separately reach out to a phone number that you know is genuine, to ask about what’s going on.
• Treat multi-factor authentication codes with the utmost security and caution. If you accidentally give one to a thief, that’s quite possibly all they need to get into your account.