Hackers Are Looking for Easy Access to Your Retirement Savings: Your Email and Cellphone Could Give It to Them
Cybercrime is a growing threat for older investors with substantial savings, and hackers don't need much more than your email account or cellphone number to gain access. Here's how to stay safe.
Americans get plenty of advice on how to achieve financial freedom, but not nearly enough on how cybersecurity factors into it.
An investor could do a great job of building assets through investing strategies and portfolios structured to produce income, but then risk it all by failing to put the correct digital safeguards in place. And the need for protection is increasingly critical.
As a large wealth advisory firm, we are seeing more and more examples of investors having their emails compromised or their identity impersonated. What used to be very rare is becoming more frequent.
From just $107.88 $24.99 for Kiplinger Personal Finance
Become a smarter, better informed investor. Subscribe from just $107.88 $24.99, plus get up to 4 Special Issues
Sign up for Kiplinger’s Free Newsletters
Profit and prosper with the best of expert advice on investing, taxes, retirement, personal finance and more - straight to your e-mail.
Profit and prosper with the best of expert advice - straight to your e-mail.
The FBI's Internet Crime Report revealed that total financial losses in 2024 from suspected internet crime totaled $16 billion, a 33% increase from 2023. People over 60 reported the most losses by age group, which is consistent with other reports showing that older investors are frequently targeted and may be the most vulnerable. And it's likely the numbers will keep increasing.
Company data breaches and hacks have already created a treasure trove of personal information for bad actors to use in their schemes, including Social Security numbers (SSNs), emails, addresses and phone numbers.
That data cannot be deleted or removed from the web once it's out there, nor can you change your SSN or easily change phone numbers or emails without disruption. The only thing you can do is use cybersecurity best practices to protect yourself.
What can happen if you lose access to your email or cellphone number?
You should always use financial institutions (banks or brokerage firms) that have strong data protections in place. But you still have to help protect your own identity and account access to prevent potential takeovers.
If a hacker takes over the email account you use and locks you out, they may be able to gain vital information that then allows them to request cash distributions or transfers from your financial accounts.
While the best-case scenario is that you recover your assets over time, there could be a long period during which you are unable to access your investments, as they may be frozen during the investigation.
Hackers can also take over your cellular number in a scheme called SIM swapping. Having access to your incoming calls and SMS messages allows them to intercept one-time security codes sent to your phone for two-factor authentication (2FA).
If your bank or investment custodian uses these codes for access and the hacker can determine your password, this gives them the keys to the kingdom.
You may not even notice your cellular number has been hijacked right away. Your phone would lose service, and it might just seem like a temporary glitch. But it could be something much more serious.
If an online custodial account is hacked, the hacker can link a new bank account to your investment account and attempt to transfer assets from it. Only prompt attention and action can prevent this type of damage.
Some custodians have certain 'hacking guarantees' in place — but where the liability falls in each circumstance is murky, and you really don't want to have to fight to recover lost assets. This speaks to the critical importance of maintaining unique and strong passwords as well as the most robust forms of 2FA.
Finally, financial institutions may authenticate your identity using an SMS code or similar, so losing access to the device you receive those on, or your email account, may seriously delay their ability to help you in an emergency.
Digital risks — weak passwords and your accounts
Accounts and account management for financial assets are now digital and online. That means if you choose to ignore cybersecurity, you do so at your own risk.
Even if you don't intend to manage your accounts online, at the very least you should set up your profile on each account and enable all the available security and privacy settings, so that someone posing as you can't do so on your behalf.
It used to be that registering your phone number with your bank or custodian was enough. However, due to the growing prevalence of SIM swap attacks, many providers are moving away from SMS-based codes. Using time-based or token-based authenticator apps or passkeys is now the more robust and secure option.
If your institution still primarily offers SMS, see if one-time email codes are available instead. If they are, you can then move on to hardening the security of your email account.
You don't want to lose access to the email accounts your financial institutions communicate with, so enabling all available security controls on your email is a must. This may involve setting up backup 2FA methods, such as authenticator tokens and passkeys, backup codes, and using a unique, complex password. Check whether your email providers offers a security checkup or recommends which security settings to enable to secure your account.
Digital independence also means reducing your reliance on a single platform or point of failure (in case you lose access to it). For example, using a password manager is crucial to security and password hygiene, and many web browsers have them built in.
But using one that isn't built in may help you retain access to all your passwords if you ever lose your primary device or are locked out of it.
Many password manager apps run in the cloud and have accompanying mobile apps. They can also store your unique 2FA tokens.
Taking responsibility for your digital literacy
Given how fast cybercrime is evolving, we all need to educate ourselves on the risks and maintain good cyber hygiene. Digital literacy is now intertwined with financial literacy and protecting your assets, just as diversification helps protect against market risk.
Unfortunately, there is no centralized playbook or one-size-fits-all guide for protecting yourself online. U.S. government agencies, such as the National Institute of Standards and Technology (NIST) and the Cybersecurity and Infrastructure Security Agency (CISA), offer online educational materials for individuals and organizations. AARP also offers some courses and educational content on cybercrime.
Cybersecurity and digital access are important parts of asset protection, just like diversification and other financial planning tools. But they're important for estate planning as well. If a family member passes and their online accounts are locked or next of kin are unable to access them, that creates additional financial headaches, especially if immediate access to funds or liquidity is needed.
A trusted advisory team can be a valuable resource, providing ongoing digital education and assistance, and making sure critical account settings are in place.
Financial advisory professionals with dedicated trading teams that monitor account transactions will also be able to help spot potential fraudulent transactions in real time.
Related Content
- How to Protect Yourself From Rising Financial Fraud, According to an Expert
- Seven Things to Do Right Away If You're a Victim of a Data Breach
- How to Protect Your Privacy While Using AI
- AI Could Derail Everything from Global Financial Systems to Online Privacy: Would You Be Vulnerable to an Attack?
- Trusting Fintech: Four Critical Moves to Protect Yourself
