I’m excited to announce that my latest book is now available on Amazon:

• Household Cybersecurity: a CPA’s Guide to Protecting Your Accounts and Personal Information

As we’ve discussed here lately, data from the FBI and FTC indicate that cybercrime and fraud have been growing at an alarming rate in recent years. In part, that’s because the tools available to the bad guys are getting better and better every year.

Unfortunately, some people aren’t even aware of the problem. They’re just following the same cybersecurity practices that they were following a decade ago.

Some people do recognize the problem, but they aren’t really sure what they should be doing to protect themselves.

And finally, some people recognize the problem, and they’re actively working on improving their security, but they have a lot of questions about newer tools, what is safe, what isn’t safe, etc.

My goal is for this book to be helpful to all three groups.

Most cybersecurity advice boils down to telling you to be careful: be suspicious of that email, don’t click that link, etc. That is good advice, but it doesn’t go far enough, because it only works if you get it right every single time, for the rest of your life.

A primary theme of this book is that, whenever possible, we want to reduce the degree to which your security depends on making the right judgment, in the moment. The goal is to put protections in place that hold up even when somebody in the household makes a mistake. Because, eventually, somebody in the household will make a mistake.

It’s similar to what we do with saving and investing. A plan that relies on somebody remembering to make manual retirement account contributions every month is much less likely to be successful than a plan in which retirement account contributions are automated. In both cases, the idea is to create a system to reduce our dependence on perfect behavior.

The Focus

As is hopefully clear from the title, this isn’t a book about enterprise cybersecurity. Rather, the question at hand is: what does an ordinary household actually need to know and do to protect their money and personal information?

If you’ve been reading this blog for a while, you know that cybersecurity isn’t my primary profession. But I’ve spent considerable time studying the subject: I’ve earned CompTIA’s Security+ certification, ISACA’s Cybersecurity Audit Certificate, and the AICPA’s Information Security & Cyber Risk Certificate.

The book’s guidance is grounded in recommendations and frameworks from relevant government agencies (NIST, CISA, and the UK’s NCSC), as well as the Center for Internet Security.

Still, the perspective I’m bringing to this subject is that of a CPA and financial planner. The book is specifically focused on what households can do to reduce their risk of fraud, account compromise, or other forms of financial harm.

A Broader Goal

I also have somewhat of a broader goal here. While the book itself is entirely focused on what the reader can do to protect themselves and their loved ones, I’m also hoping that this book can be one small piece in a broader shift toward normalizing cybersecurity discussions as part of financial planning discussions — no different than tax planning, for example.

As it stands right now, most general-audience personal finance materials don’t discuss it at all. Most financial professionals don’t discuss the topic with their clients. Financial planning training materials don’t cover it.

Cybersecurity gets left out, because it’s considered a “tech” topic rather than a personal finance topic.

That’s fine for the people who have a loved one who is savvy on these topics and willing to personally coach them. But most people don’t have that. Most people, even people trying really hard to make sure their finances are in order, are getting little to no information about cybersecurity and fraud prevention. And I believe that gap is a contributing factor to the dramatic increase in fraud that we’re seeing.

And so I hope this book will also be useful to financial professionals who recognize that cybersecurity and fraud prevention are increasingly relevant to the households they serve, but who aren’t sure what they should be telling clients.

Table of Contents

Introduction: An Epidemic of Fraud

Part One: The Threat

1. What Does a Thief Need to Access Your Financial Accounts?
2. Know Your Opponent
3. We Need Protective Policies, Because Mistakes Happen

Part Two: Fundamental Cybersecurity Concepts

4. You Are the CISO (Chief Information Security Officer)
5. The CIA Triad
6. Cryptography Basics
7. Understanding Authentication
8. Password Strength

Part Three: The Tools

9. Password Managers
10. Authenticator Apps
11. Passkeys
12. Physical Security Keys

Part Four: Policies

13. Account Configurations
14. Device Security
15. Network Security
16. Security Maintenance
17. Responding to a Cybersecurity Incident
18. Protecting Vulnerable Loved Ones

Conclusion: Layers of Protection

If you think the book might be helpful to you or a loved one, please pick up a copy:

Household Cybersecurity: a CPA’s Guide to Protecting Your Accounts and Personal Information

And if you do find it helpful, please consider posting a review on Amazon!

A reader writes in, asking:

“You have said, and I have read elsewhere also, that passkeys are ‘phishing resistant.’ I’m ready to believe that, because everybody ‘in the know’ says so, but I haven’t really been able to wrap my head around WHY that’s the case. Is that something you could write about?”

Broadly speaking, phishing happens in either of two ways:

1. You somehow end up on a malicious website (one designed to look like your bank, email provider, etc.), and you don’t realize it’s not the real deal. So you enter your login credentials to sign in, and now the bad guy has collected those credentials.
2. As part of a communication (e.g., a text or phone call from the bad guy, who convinces you that they work at your bank or some other place where you have an account), you are tricked into sharing your login credentials (e.g., sharing them by text or stating them over the phone).

Passkeys are inherently strong against both of those types of attacks.

Phishing via Malicious Website

Passkeys are domain-bound, which means that when you create a passkey, saved as a part of that passkey is the specific domain that it’s used for. For example, if you bank with Chase, and you create a passkey while signed in on Chase.com, that passkey is specifically bound to the domain Chase.com.

So if you someday unknowingly end up on a malicious website that is designed to look like Chase.com, your passkey simply won’t work. The “accidentally enter your login credentials into a malicious website” scenario simply doesn’t exist with a passkey in the way that it does with a password.

Note, however, that if you have a website for which you can sign in via passkey or via password, then just because you have a passkey doesn’t mean you’re now invulnerable to being tricked into entering your password into a malicious website.

But even still, the passkey provides some useful protection. If you normally sign in with a passkey, and one day that passkey does not load, do not assume that your passkey “isn’t working” and that you should enter your password instead. Rather, treat your passkey not loading as a valuable and critical signal that you might be on the wrong website. Rather than entering your password, it’s probably best to start over: in the location bar of your browser type the known URL of the website you’re intending to visit (or use a bookmark). To be clear, passkeys can sometimes fail to load for benign reasons, but the safe response is the same either way: re-navigate to the website via a known-safe method.

Phishing via Malicious Communication

In normal usage, the user doesn’t actually see the secret part of the passkey (i.e., the private key of the private/public key pair). It’s saved in your password manager (or on a security key such as a YubiKey). And when you click a button to log in with a passkey, all of the magic (i.e., your device accessing your private key, using it to create a digital signature, and sending that digital signature to the website you’re logging into) happens behind the scenes, out of the user’s view. The user doesn’t even have an easy way (or, in some cases, any way) to share the secret part. And if you don’t have a way to share it, you can’t be tricked into sharing it with a bad guy.

Password manager providers are naturally attractive targets for hackers. So a critical question to ask is: what happens if an attacker manages to access the servers of the company that provides your password manager software? And the answer to that question will depend on both your own practices as well as the policies and practices of the password manager provider.

Here it’s worth backing up a step and looking at historical security breaches in general. For instance, there have been many cases in which some company (e.g., an insurance company, a credit bureau, a hospital system, or a large retailer) gets hacked, and the attacker is ultimately able to access customer/patient information, such as contact info and Social Security numbers.

But wouldn’t that data have been encrypted on the company’s servers? In other words, even if the attacker was able to download the data, why weren’t they stuck with unusable encrypted data? Sadly, in some cases, the answer is that no, the data in fact was not encrypted on the company’s servers. But even in many cases in which the data was encrypted, the attacker was ultimately able to decrypt the data. Generally, that’s not because the attacker was able to defeat the encryption. (Modern best-practice encryption is quite secure.) Rather, the explanation is a simpler one: the attacker was able to access the decryption keys.

In most cases, when a company is storing encrypted data, they also need to be able to decrypt that data themselves, so that they can use the data when needed. So the decryption keys must be accessible in some way by systems (and sometimes people) at the company. And that is where the security often fails. In the major data breaches that you’ve heard about, what has generally been the case is that the decryption keys were stored in some way that was itself insecure, or the attackers were able to access an application that has access to the keys. The details vary, but the result is typically that the attacker is able to download the encrypted data and access the decryption keys, thereby allowing them to simply decrypt the data.

Now back to our discussion of password manager software specifically. The details vary by provider, but many password managers (including Bitwarden or 1Password) use what is known as zero-knowledge architecture. The idea of zero-knowledge architecture is that the password manager provider itself never has your master password, the key necessary to decrypt your data, or a decrypted version of your usernames, passwords, etc. Your encrypted vault is stored on their servers, and when the vault needs to be decrypted (in order for you to access saved information) that decryption happens entirely on your device. Your device uses your master password to derive the decryption key and then uses that decryption key to decrypt the requested data. To reiterate: with zero-knowledge architecture, the password manager provider never has your master password, the decryption key, or a decrypted version of your vault.

What this means is that, if your password manager is using zero-knowledge architecture with strong encryption practices, and you are using a strong master password, then even if an attacker were able to breach the password manager’s servers and download your encrypted vault, they would almost certainly not be able to decrypt the information. There’s a fundamental difference here between this sort of setup and a setup in which the company is saving not only your encrypted data but also the means to decrypt that data.

Of course, it would still be preferable for your password manager provider not to be hacked at any point. And if you ever learn that your password manager provider has suffered a breach involving customer vaults, you should promptly change the passwords of your most important accounts, and then change the remaining passwords as soon as practical. But if you and your password manager are both following best practices, you don’t need to worry that a data breach would mean that an attacker would immediately have access to all of your passwords.

There are also options for offline password managers. For instance, KeePassXC is a dedicated offline password manager. Alternatively, Bitwarden can be self-hosted on your own server. In these cases, your vault would not be stored on the vendor’s servers and thus would not be accessible at all if the vendor’s servers were breached. One downside is that syncing your passwords across devices or sharing with other family members becomes something you must set up and manage yourself. Also, now you would be fully responsible for security (including backups and other security-related policies). Whether that’s a good thing or a bad thing depends on your skills and how much time you want to spend on the endeavor.

Finally, on the topic of password manager breaches, we have to talk about LastPass. In 2022, LastPass was the subject of a major breach. In addition to being breached, it became clear that they were not following certain other best practices. For one, they were not encrypting the URLs of the websites for which users were saving usernames and passwords. That made it easier for the attacker to pick specific vaults to target for brute-force decryption attacks. (Specifically, the attacker appears to have gone after vaults that had cryptocurrency assets.) Secondly, the vaults of LastPass users with older accounts were not as securely encrypted as they should have been. In 2018, LastPass had upgraded its default for new users, but older users were still on older encryption policies unless they explicitly adjusted the setting themselves. That made it easier for the attacker to effectively use brute-force attacks on customer vaults. (Weaker encryption settings meant that the attacker could make many more password guesses per second against those vaults.) We know that some people did have money stolen as a result. Finally, LastPass customers were not informed that their encrypted vaults had been accessed until months after it had occurred. A more timely notification could have allowed customers to update all of their passwords promptly and avoid any actual losses. For the above reasons, many experts in the field simply no longer feel comfortable using or recommending LastPass. Regardless, the event illustrates the importance of a password manager provider following best practices.

A Planet Money podcast episode last week directed me to a paper released earlier this year: Dementia and Long-run Trajectories in Household Finances. The authors explain their findings in pretty plain English, so I’m just going to quote their work:

“Our results point to impaired financial decision-making beginning about six years prior to clinically recognizable dementia.”

“A growing body of work links cognitive ability to financial outcomes such as portfolio allocation, credit use, and susceptibility to fraud. […] Most recently, Mazzonna and Peracchi (2024) show that older adults are often unaware of their own cognitive decline, and that such misperception can lead to persistent financial mistakes. We extend this literature by showing that the economic consequences of cognitive decline appear well before the onset of dementia symptoms (or clinical diagnosis) and manifest in sustained losses in household wealth.”

“Our findings underscore that dementia-related financial risk should be viewed as a universal and forward-looking household risk, not just a concern for those who are already symptomatic or diagnosed. Because financial mistakes often appear before individuals or families become aware of any cognitive decline, relying solely on diagnosis or subjective awareness is unlikely to be sufficient. Safeguards that can be implemented well in advance—such as designating trusted financial contacts, simplifying financial arrangements, or allocating part of retirement wealth to products with guaranteed payouts—may help reduce exposure to losses from impaired financial decision-making.”

Their findings are exactly in line with the stories I keep hearing stories from readers: situations in which, conversationally, Mom/Dad/Uncle Steve still seems fine. No obvious red flags. And yet, they’re making financial decisions that make no sense or falling victim to scams that they would not have fallen for just a few years ago.

Of course, dementia (or other significant cognitive decline) does not happen to everybody. But we don’t know in advance to whom it will happen. And waiting until there are obvious personality-related symptoms before putting protective financial policies in place doesn’t work very well, because the financial problems often come first.

I think the authors suggestions are excellent: simplified portfolios (and simplified finances in general), designated trusted financial contacts (to allow the financial institutions to share information with that contact), options for guaranteed income (most notably: delaying Social Security). And I’ll add: adopting security practices that are resistant to scams/phishing (i.e., passkeys and security keys).

A key point here is that all of the above suggestions are generally good ideas regardless of the possibility of cognitive decline.

• Dementia and Long-run Trajectories in Household Finances from Jing Li, Kathleen M. McGarry, Lauren Hersch Nicholas, and Jonathan S. Skinner
• How Your Bank Account Might Predict Dementia (The Indicator from Planet Money podcast episode)

Other Recommended Reading

• Why an Ohio Retiree Capped Her Net Worth and Spent Down the Excess from Sarah Leeson (very brief Marketplace podcast segment)
• Buying at Tops or Bottoms from Ben Carlson
• An All-Time Bull Market from Ben Carlson
• Trusted Help from a Daily Money Manager from Rick Kahler
• If America’s So Rich, How’d It Get So Sad? from Derek Thompson
• You Just Retired (or Are About to). Now What? from Christine Benz
• 10 Tricks of Financial Predators from Allan Roth

Thanks for reading!

“Have your parents been scammed yet?” Jim Dahle asked me, in a brief one-on-one conversation at the recent White Coat Investor Conference.

The implication, of course, is that it’s a matter of when it happens rather than whether it happens.

At the conference, three other attendees happened to share stories with me of their parents being scammed. (And, to be clear, I was not walking around polling people on this topic.)

And we recently discussed the stats from the FBI showing explosive growth in the rate at which people age 60+ are becoming victims of cybercrime.

Frankly, we have a situation on our hands.

Technology keeps moving. If anything, it’s speeding up. But as humans, at some point, we slow down. That’s just the nature of things.

That’s a major part of the context for this whole discussion of cybersecurity. It’s not just about how we can keep ourselves safe, it’s also about how we can keep our elders and less tech-savvy loved ones safe. And the combination of tech advancements (which older people are less likely to have kept up with) plus the possibility of some degree of cognitive decline makes for a challenging situation.

And to be clear, when I mention cognitive decline here, I’m not referring to full-blown dementia (although that obviously does dramatically increase the likelihood of being victimized). I’m talking about the more mundane but common situation in which a person is still capable of functioning normally in day-to-day activities, yet their ability to promptly detect a fishy situation — their “bullshit radar,” if you will — has started to become somewhat less sensitive.

What follows are important steps you can take to make yourself safer. And after implementing these policies for yourself, you can help your vulnerable loved ones implement them as well.

An important thing to note here is that if there are multiple people in the household, everything is only as secure as the weakest link. Each person should be following these policies.

Communication Policies

If you receive any inbound communication (whether email, text, or phone call) that purports to be from a company or government agency with which you have any sort of account:

• Do not reply.
• Do not give them any information whatsoever.
• Do not click on any links.

Essentially, don’t interact with inbound communications. If you need to interact with any organization with which you have an important account, make sure it is you reaching out to them, via a trusted means. That could be:

• Calling the number on the back of your credit/debit card.
• Typing the company’s URL directly into your browser.
• Visiting their website via a previously-saved browser bookmark (or navigating there via your password manager).
• Using an app on your phone (e.g., using the Bank of America mobile app, to contact Bank of America).

And the same thing goes for situations in which you’re contacted by (ostensibly) a loved one asking for money. Don’t engage with the inbound communication. Instead, reach out to the person in question via the contact information that you already have saved.

Credential Management Policies

To be clear, by far the largest risk for most individuals is getting tricked, rather than actually being hacked in some way. A major portion of cybercrime incidents are cases in which the victim:

1. Accidentally gives a thief their multi-factor authentication code (e.g., over the phone or by text) because they thought the thief was somebody else, or
2. Accidentally enters their login credentials on a fake website.

If you can eliminate those two possibilities, you have dramatically reduced the risk. Policies that work toward reducing or eliminating those possibilities include:

• Use passkeys when a website allows you to do so.
• Use security keys (i.e., YubiKey or similar) as the multi-factor authentication option when allowed to do so.
• Use a password manager (so that when a website forces you to use password-based login rather than a passkey, your password manager will not populate the password if you end up on the wrong website).
• Remove less-secure sign-in methods and account-recovery methods, to the extent you’re allowed to do so.

Essentially, you can’t get tricked into sharing the password with a malicious party if signing in with a password isn’t even an option (i.e., because the only sign-in option is to use a passkey). And you can’t get tricked into sharing the multi-factor authentication code with a malicious party if there is no such code (i.e., because the only accepted MFA option is a physical security key).

Other important policies regarding login credentials include:

• Use strong passwords for your various accounts. (Your password manager should have a tool for generating such.)
• Do not reuse passwords across different accounts.
• Use strong passcodes for mobile devices and tablets.
• Use an authenticator app as the multi-factor option (rather than SMS or email), if security keys are not an option and the website doesn’t allow passkeys.
• Activate SIM-swap protection with your mobile carrier.
• Use fake answers to “security” questions whenever an account asks you to set up such things (e.g., your third grade teacher’s last name was “i6c@vNShpJy$$9oV”), and store those answers in your password manager.

Other General Policies

Some of the other highest-impact security policies you can implement would be to:

• Freeze credit at all the major credit bureaus, and implement a security freeze with ChexSystems.
• Create an IRS Identity Protection PIN (and enroll to get a new one each year).
• Take advantage of any security features your brokerage firms offer such as money transfer lock at Fidelity or ACATS lock at Vanguard.
• Keep your operating system and apps up to date on all devices. (It’s unfortunate, but in many cases this will mean replacing devices at a point at which they’re still functional, in order to keep them on a current operating system.)

It’s Time to Upgrade Our Practices

To be clear, the policies mentioned in this article are not meant to be an exhaustive list. There are 100+ additional practices you could adopt, which would further improve your security. But the policies mentioned above are some of the highest-impact things you can do to keep yourself and/or your vulnerable loved ones safe. And if you implement all of the above, you (or your vulnerable loved one) will be a much harder target than most people.

Admittedly, for many people, this will mean learning to use some new tools (passkeys, security keys, password manager, authenticator app). But now’s the time. It’s not going to be any easier to start learning these things a few years from now.

And an important thing to note (and an important thing to mention, if you’re helping a loved one implement these practices) is that passkeys, security keys, and password managers all provide significant convenience benefits, relative to the alternatives. That is, in addition to being more secure:

• Logging in via passkey is generally more convenient than logging in via password + MFA code.
• Using a security key as the MFA method is generally more convenient than SMS, email, or authenticator app as the MFA method.
• Using a password manager is more convenient than trying to remember your passwords, record them on paper, or record them manually in some other electronic format.

The thieves have better tools available to them than they did just a handful of years ago. We have better tools available to us as well. But we have to actually use them. If your (or your loved one’s) security practices are no stronger than they were 10+ years ago, it’s time to upgrade those practices.

We’ve been discussing passkeys a fair bit here in recent weeks, and by coincidence last week the UK’s National Cyber Security Centre released a new paper and guidance on the topic.

• General guidance document: Passkeys: what you need to know
• Press release: NCSC: Leave passwords in the past – passkeys are the future
• Technical paper: Comparing the security properties of traditional user credentials and FIDO2 credentials for personal use

Below are a handful of quotes from the publications. Please note how strongly worded these statements are. And these are from a governmental cybersecurity organization, which is presumably being very intentional with its wording.

From the “what you need to know” document:

“Passkeys are a more secure alternative to passwords that you don’t need to remember as they are created and managed safely by the software on your device(s). […] The NCSC supports the public adoption of passkeys and recommends using passkeys over passwords wherever available.”

From the press release:

“Passwords are no longer resilient enough for the contemporary world.”

“Passkeys should now be consumers’ first choice of login across all digital services, the UK government’s technical authority on cyber security has announced today (Thursday).

Overhauling decades of security practice, the National Cyber Security Centre […] has taken the decision to no longer recommend individuals use passwords where passkeys are available because passwords lack the relative resilience to modern cyber threats.”

From the paper:

“At all stages of a credential’s lifecycle, and against all commonly observed attacks, FIDO2 credentials including passkeys are as secure or more secure than all forms of traditional MFA for individuals.”

Also of note (from the press release):

“Where a particular service does not support passkeys, the NCSC’s advice to consumers is to use a password manager to create stronger passwords and keep using two-step verification.”

If you want to read the paper (or even just the “Summary and recommendations” section at the end of the paper), a few points on terminology might be helpful:

• The word passkey itself is a colloquial term, and its exact usage varies a bit from one case to another.
• FIDO2 credential is a technical term for what would often colloquially be called passkeys.
• When this paper uses the term passkey it is specifically referring to passkeys synced via the cloud. It uses the terms single-device passkey or device-bound FIDO2 credential to refer to what we might think of as passkeys stored on a single device, not synced to the cloud.
• Sync fabric refers to whatever system is being used to store your passkeys in the cloud and sync them across devices (e.g., Apple Passwords, Google Password Manager, etc.).
• Relying party refers to whatever website or app you’re logging into when using a passkey.

Other Recommended Reading/Viewing/Listening

• Causes We Love: Turning Students into Investors (Bogleheads Conference session, in which I interviewed Cole Mattox and and Dylan Ingerman of First Generation Investors)
• Analyzing the Analysis: How Do AI Portfolio Recommendations Hold Up? from Allan Roth
• Can Millennials Count on Social Security? (in which I was interviewed for the How to Money podcast)
• Why Social Security Faces a Financial Reckoning Just a Few Years From Now from Alicia Munnell
• Social Security is Slowing Down. Here’s How to Get Your Benefits On Time from Mark Miller
• 2 Ways to Actually Reduce Smartphone Use from Cal Newport
• Private Assets May Be Coming to Your 401(k). You Should Know the Risks. from Tara Siegel Bernard (NYT)
• IRS Finalizes Deduction Rules for Tips, Adds 3 Eligible Jobs from Martha Waggoner
• Russia Hacked Routers to Steal Microsoft Office Tokens from Brian Krebs (Don’t use an old router!)

Thanks for reading!