Cybersecurity and Anti-Fraud Checklist

Financial fraud and cybercrime are increasingly common and increasingly sophisticated. This checklist is designed to help your household take practical steps to make you a harder target.

A key point is that each person in the household must follow the policies described below. For example:

• We have to make sure that each person in the household follows prudent communication policies (e.g., not responding to texts that purport to be from your bank, brokerage firm, etc.).
• For any account where there are multiple users (e.g., one for each spouse), we have to make sure that each user’s log-in credentials are secure, as discussed below.
• We have to make sure that all household members’ devices are set up with secure practices.

I would encourage you to use this checklist as a starting point in creating your own checklist, specific to the people in your household, devices you use, etc.

Security Awareness/Communication Policies

• Each household member is aware of common scam methods.
• Each household member knows not to interact with inbound communications (whether phone call, text, or email) that appear to come from a trusted institution. (Phishing/fraud attempts are increasingly sophisticated and now convincingly appear to be legitimate communications.)
  • Don’t click the links.
  • Don’t give them any information.
  • Instead, reach out directly yourself (e.g., directly typing Vanguard.com into your browser, calling the number on the back of the debit/credit card, etc.).
• Each household member knows not to trust inbound communications (whether phone call, text, or email) that appear to come from a family member or friend asking for money.
  • Don’t click the links.
  • Don’t give them any information.
  • Instead, hang up and reach out directly yourself by calling the number saved in the contact list in your phone.

Account Credential Management (Log-in Security)

Make a list of all security-critical accounts, such as:

• Email (Email is the most critical of all accounts. If somebody gets into your email, they can not only see a tremendous quantity of sensitive information, they can also reset the passwords on many of your accounts.)
• Password manager, if you use one
• Bank accounts
• Brokerage/retirement accounts
• Insurance accounts
• Anything else with sensitive private information

And then for each of those accounts we want to be sure that:

• Passkeys are enabled and used where supported.
• Password is strong (i.e., long string of random characters) and unique (i.e., not used for any other account).
  • A password manager such as Bitwarden, Apple Passwords, or 1Password is a valuable tool.
• Multi-factor authentication is enabled.
  • Ideally with hardware security key (most secure) or authenticator app.
  • Ideally not with email or SMS as the multi-factor.
  • If backup codes are provided, they are stored securely (e.g., in a password manager or printed out and stored in a secure physical location).
• Email or SMS notifications are enabled.
  • We don’t need to track portfolio balance every day, but we do want a notification immediately about money being moved out of the account, or about a new bank account being connected, or about a change in contact information.
• Any account-recovery options are up to date and themselves well-secured. (Many accounts let you recover access via a backup email address or phone number. This is a security problem if that email or phone number is not itself well-secured or is out of date.)

Identity and Credit Protection

Complete the following for each person in the household:

• SIM-swap protection should be activated for each mobile number.
• Credit frozen at Equifax
• Credit frozen at Experian
• Credit frozen at TransUnion
• ChexSystems security freeze
• IRS Identity Protection PIN (Once enrolled, you receive a new one each year.)
• Physical documents with sensitive information are shredded after scanning (i.e., not just thrown in recycling/trash).

Device Security

• Regularly update all critical software, such as operating systems for mobile and desktop, and all browsers. (Ideally automatic updates are enabled.)
• Do not save passwords in the browser on any laptop or other device that is reasonably likely to be accessed by another party.
• Use a password-locked screensaver on any laptop, ideally with a short delay before activation.
• Use a strong passcode and/or biometric lock for mobile devices and tablets.
• Enable “Find My Device” (or equivalent) on all mobile devices, tablets, and laptops, including the ability to remotely lock or wipe the device if lost or stolen.

Network Security

• Use a modern router for your home network.
• That router is configured to receive automatic software updates.
• You have changed the network name and password from the factory defaults, and the current password is strong.
• If your router supports it, set up a separate guest network.
• For your main network, WPA3 encryption is enabled if it’s an option. Older devices that can’t use WPA3 can be on the guest network with WPA2.
• Internet of things devices (e.g., smart dishwasher, smart refrigerator) should not use default credentials and should be placed on the guest network if one is available.

Security Maintenance

• Whenever a new device (phone, computer, router) is put into use, review the Device Security and Network Security sections above and ensure all relevant policies are applied to the new device.
• When a new critical account is opened (e.g., a new bank or brokerage relationship), review the Account Credential Management section above and ensure all relevant policies are applied to the new account.
• On an annual basis, review this checklist to see if any gaps have appeared due to changes in your household, your accounts, or best practices in cybersecurity.
• If there is a known data breach at any institution with which you do business, change your credentials at that institution immediately, even if you have not been directly notified by the institution.