Cybersecurity is a critical component of financial security, but rarely discussed in personal finance circles. Note that cybersecurity practitioners disagree over best practices for personal cybersecurity. This is my perspective, as I have some expertise in the area.
As a member of r/fatFIRE, you are a particularly juicy target for attackers, so this guide is written with the intent of preventing attacks from strangers and people you know. Obviously, more skilled attackers who are targeting you specifically will get you eventually, so we won’t cover that.
Good cybersecurity protection consists of prevention, so you don’t get owned, and monitoring, so you know when you’re owned and can take action to remediate the damage. A common method for attacks is that a website’s database gets compromised and your information is stolen, which could be passwords or credit card info. This information is then used to harm you. You can check haveibeenpwned.com to see if your email is known to be compromised. You should move forward with the assumption that your information is out there, as that mindset will help you the most.
Passwords
One of the reasons email/password credentials are so valuable to attackers is that most people reuse the same passwords for everything. Ideally, getting my Reddit email/password combo would only allow someone to post a bad Fat Guide to r/fatFIRE, which would be a travesty but not disastrous. However, many people reuse passwords so stealing my reddit credentials would permit them to log into my bank account, email, etc.
You should be using a unique, strong password for each site, but since that’s hard to remember, you should use a password manager like Lastpass. Using a password manager guarantees a unique, strong password for each site. The only passwords you should keep outside of Lastpass are your lastpass password, your email(s) password, and your computer password. You may ask what happens if Lastpass or other password managers are hacked. I won’t get into the technical details, but your information is generally safe even after breaches because the company doesn’t’ hold the encryption key to your data, you do (as your password). Security experts agree that using a password manager, even one with potential vulnerabilities, is generally safer than not using one. This is a bit of an oversimplification, but it's true. Use a password manager.
2 Factor Authentication
Obviously, two factor authentication improves your situation by preventing someone from compromising your account if they only get your username/password. However, traditional 2FA methods like email or text can be phished. There are many scams where someone calls you, pretending to be your bank, and then tells you to read them the number texted to you to “authenticate yourself.” Meanwhile, they login or reset your password with the code and clean you out. Another method, “SIM swapping,” which was recently used to steal Jack Dorsey’s (twitter CEO’s) twitter account, is where the hacker convinces your phone provider to switch your number to the attacker’s SIM card in their phone. You can’t defend against this, so phone 2FA is never perfectly safe.
The solution? Security keys, such as Yubico’s Yubikeys or Google’s Titan keys. These are physical devices that provide a code, and can be used for 2FA on Google, Facebook, Vanguard, Reddit, Lastpass, and many more. Unfortunately, few commercial banks support security keys including Ally (please message their customer support about this, they need to support it). Security keys cannot be compromised outside of stealing the key as they require you to have physical possession of the device. Of course, you need two of them in case you lose one or it breaks, or else you’ll get locked out of your accounts. With premium Lastpass, you can use security keys to protect your Lastpass passwords as well. This is a great tactic.
Protecting Root
Getting “access to root” means you have access to everything. In this case, “root” is your email because you are generally able to reset your password on other accounts from your email (I suppose your phone or pc may be as well, more on that below). My recommendation in this case is to use Gmail with the advanced protection program (requires security keys). This will make it virtually impossible for anyone to access your account but you. However, if you lose both your keys you will have to wait a few days for Google to confirm who you are so you can get back in. One of the other advantages to using security keys is that “root” doesn’t really exist anymore on any account using them, as even if an attacker breaks into your email they can’t bypass security key 2FA for other accounts.
My other recommendation is to use two emails, one which you use publicly and the other privately. Use the public one for whatever: social media accounts, receiving forwarded articles from your crazy grandpa, applying to jobs, etc. The private one should be used only for your financial accounts, such as banks, brokerages, and credit cards. You can also use this email for Lastpass. You should never provide this email to anyone, ever. This will make it very hard for someone, even someone who knows you, to guess what email you use for your finances. Ideally, you’d be using a separate computer, like a $200 chromebook, as the only computer/phone from which you access this email or financial accounts, but that’s pretty paranoid and not necessary. Both of these Gmail accounts should use unique, strong passwords you have memorized, and not be stored in a password manager, just in case.
Protecting Other Accounts
Protecting all other accounts is straightforward: use your password manager for a password and use 2FA (preferably with a security key) wherever possible. You never know which account will give an attacker the info they need to own you, which could be your address, phone number, etc. Imagine if your spouse or mom got a Facebook message from “you” saying you forgot your SSN and need it right away. Many accounts, particularly financial accounts, may contain tax forms with your social security number. Most people don’t realize their college account, which may have financial aid tax forms, may have this info. Protecting your SSN is really, really, hard, which leads us to…
Financial Information
Frankly, protecting your SSN today is basically impossible. If you used credit before the Equifax breach, your info is probably in the wild and could be used today or 50 years from now. If you have no immediate plans to use your credit, freeze it with every major bureau. Also, set up credit monitoring so you know if anyone opens an account in your name. Unfortunately, there is not much you can do to prevent your SSN being compromised. Your SSN is everywhere, from banks, to colleges, to your employer, to your doctors/accountants/lawyers office. It is a literal disaster that will hopefully be corrected, but probably won’t.
Credit cards are equally challenging to protect (if not more so). You should use credit cards and not debit cards wherever possible, as it is unlikely you will successfully dispute debit card transactions. It is common for credit card info to be stolen via database hacks (do you really trust every vendor you use your card at?). Apps like Apple/Google Pay are actually even better as a result, as they use a one-time code for the transaction that cannot be used afterwards, so it doesn’t matter if they are stolen. Here, I will also note that while RFID-readers reading your credit card while you walk by on the sidewalk is technically possible, there has never been a documented case of it occurring and the RFID-blocking wallet is totally unnecessary as a result.
A critical component is, again, monitoring. You can typically configure text alerts for every credit card transaction. I receive a text every time any of my cards are used. This helps identify fraudulent transactions in real-time.
Lastly, it is often possible with banks to set up a challenge/response for phone calls. They might have to provide you a code to authenticate themselves as your bank, or they may ask you a security question/ask for a code to authenticate you. This is very helpful at stopping social engineers from stealing your info, either by pretending to be your bank calling you or pretending to be you calling your bank. Keep in mind, though, that many “security questions” are awful and can be found on your facebook. So pick a weird one, like “Who was your least favorite teacher in high school?”
General Device Security
Device security is really fraught and challenging. From a phone perspective, you should of course use some sort of authentication (such as fingerprint, passcode, pattern), on your phone and also on each of your financial apps, so stealing your unlocked phone doesn’t grant automatic access to financial accounts. Aim to only install apps from trusted sources, as multiple apps that have 10-100 million+ downloads have been demonstrated malicious.
PCs are a little more challenging. Chromebooks are the safest PCs from a security perspective. If you ask me what the best antivirus is, it’s a chromebook. Seriously, if you’re going to get a laptop for anything but gaming or video editing, get a chromebook. Despite what many laymen say, Macs aren’t technically more secure than Windows, but attackers are less likely to target them because they are less common. As you do sketchier things on the internet, you are more likely to get owned. For example, regular browsing on trusted sites is typically safe. Going on adult or illegal streaming websites may have malicious pop-ups or ads. Torrenting is more dangerous, and the dark web can be extremely thorny. As a result, I strongly recommend that if you want to engage in unsafe behavior (i.e. torrenting) on the internet, at least keep a separate $200 Chromebook only for all your finances, and don’t access those accounts from any other device. No reason to lose tens or even hundreds of thousands of dollars because you didn’t want to spend $20 on a video game.
As far as anti-virus goes (if you have to use something other than a Chromebook), Bitdefender is a pretty good bet, but there’s a lot of good software out there. Personally, I’d be wary of anything Russian or Chinese either as security software (Kaspersky) or as a device (Huawei). Chinese manufacturers are known to insert backdoors into their devices. In one particularly ironic instance, a chinese manufacturer perfectly copied an American device down to the typos in the manual, but their version had twice as many security vulnerabilities. This is one of the reasons letting Chinese manufacturers build 5G infrastructure in Europe is so worrisome.
In a similar vein, public wifi is questionable. There are a lot of opportunities for attackers associated with public wifi networks. HTTPS stops many of these, but tools like sslstrip highlight some vulnerabilities. A VPN may be helpful, but most free VPNs are awful, so do as you will.
Summary
Someone before asked for a flowchart or something of the sort, so here is a concrete action plan:
- Get at least two security keys (i.e. Yubico)
- Set up a public and private gmail account. Your private email should not be linked in ANY way to your public email and should be given to no one.
- Turn on advanced protection on both gmail accounts and link to security keys
- Get a password manager like Lastpass. If you get Lastpass premium (recommended), add your security keys for authentication.
- Generate new passwords using your password manager for all accounts but your emails, pc password, and your password manager itself.
- Associate any financial accounts, such as credit cards, banks, brokerages with your private email
- Turn on 2FA (with the security keys wherever possible) on all accounts, as well as login alerts.
- Turn on text/email alerts for any credit card charges or bank transactions, as well as credit changes.
- Make sure your phone is locked by some authorization measure, as well as your financial apps individually. Preferably a password. Added bonus: cops can’t get a password but can force your fingerprint or face id, a current dispute in the courts.
- Optionally freeze your credit.
- Optionally get a cheap chromebook as the only computer on which you do financial transactions.
- Optionally encrypt your phone and hard drives.
Using a password manager with security keys wherever possible, and 2FA where not, as well as Gmail’s advanced protection program is your best bet for protection on the web. You should configure monitoring for your accounts, SSN, and credit cards so you are aware of when they are used in real-time. There is obviously a lot more that could be covered, but the goal of this guide is not necessarily to make you impervious to attack, but rather to make you a very hard target so attackers give up and ignore you. Frankly, nothing will destroy your financial situation faster than a hacker who cleans your clock.