Man at bar: “I can’t believe my email, bank account, and brokerage account were hacked.”
Woman at bar: “What were your passwords?”
Man: “Password.”
Woman: “Yes, your passwords.”
Man: “I just told you.”
Recently, one of Mitchell Sinkler & Starr’s clients had their Schwab account hacked by a criminal who gained access to the client’s computer through a phishing scam; the client inadvertently clicked on a link that opened the computer up to the crook as easily as opening the front door of the house. Once inside, the hacker was able to wire money out of the client’s investment account electronically before Mitchell Sinkler & Starr was even notified that the fraudulent wire had been completed.
This stark example is a reminder that cybertheft is an ever-present threat, and vigilance and diligence are even more important in the AI age. So how do we protect ourselves? With complex passwords that are unique to each important website, backed up by two-factor authentication tied to your cell phone.
Passwords – Unique and Complex
Every time a data breach occurs exposing millions of usernames and passwords, hackers, now aided by AI, try those passwords and hundreds of subtle variations, on other websites.
If you recycle your passwords, you’re making it easier for criminals to break in. Important websites – banks and brokers – should be protected with long, complex, (seemingly) random, and unique passwords. If you need to write them down, lock them in a filing cabinet or hide them in a book, with as few identifiers as possible. Do not share them.
Two-Factor Authentication – Your Best Defense
As the name suggests, two-factor authentication requires multiple distinct forms of verification to guard access to your accounts. The first is your password. The second is a text or email providing a one-time code, a phone app login, or phone authenticator app.
Turn this on.
We typically recommend this option on your cell phone, which is independent from your laptop or computer. For clients with accounts custodied at Schwab, all the steps listed above are available as potential second factors. In the event your password is stolen, without your cell phone, there is no way for the hacker to gain access to your Schwab accounts.
And as an aside, never share a text code, for any website, with anyone. Period. That’s like handing the house keys to the burglar.
Schwab Account Protection – More Options
Mitchell Sinkler & Starr also strongly recommends that Schwab-custodied clients limit their online Schwab access. “Limited Access” restricts clients from trading and moving money out of their accounts themselves – the two actions that can lead to potential fraud and loss. Limited Access does not restrict clients from viewing their portfolios and positions, or from moving money into their account from approved bank and investment accounts. Nor does it restrict electronic approval of distributions (ACHs and wires) set up by our Operations Team upon the client’s request. Limited Access can be set up immediately by anyone on the Mitchell Sinkler & Starr team, simply by letting us know.
In the unfortunate example above, two-factor authentication would have stopped the unauthorized access into the client’s Schwab account. Even if they had gotten in, Limited Access would have made it impossible for them to send an outgoing wire (because the client would have needed to work directly with the team at Mitchell Sinkler & Starr to set up the transfer).
Questions? Please reach out to your Portfolio Manager or our Operations Team. Help protect yourself, and help Mitchell Sinkler & Starr protect you, by following the steps above.
W. Gregory Richardson, CFA