---

title: "Protecting Your Financial Accounts Online: What Actually Matters"

slug: protecting-your-financial-accounts

author: Nick Rygiel, CFP®

date: 2026-03-25

category: Security

tags: [cybersecurity, account-security, phishing, custody, client-education]

description: "The risk isn't that someone breaches your custodian. It's your devices, your credentials, and your attention. Here's what to do about it."

Protecting Your Financial Accounts Online: What Actually Matters

The risk isn't the institution. It's upstream from the institution.

When clients ask about account security, the concern is always legitimate. It is also almost always aimed at the wrong target.

The risk is not that someone breaches your custodian's servers. Qualified custodians — the regulated firms that hold your assets — invest hundreds of millions annually in cybersecurity, employ around-the-clock monitoring teams, and operate under strict federal oversight. The risk is your devices, your credentials, and your attention.

Here is what actually gets people compromised — and what to do about it.

The Three Attack Vectors That Matter

1. Phishing and Smishing

Attackers send emails or texts impersonating your bank or brokerage. They direct you to a spoofed login page. You enter your credentials; they capture them in real time.

This is not hypothetical. In 2025, multiple major custodians flagged smishing campaigns where fraudsters sent fake "transaction verification" texts. Victims who clicked the link and entered their credentials had their security tokens changed — locking them out while the attackers initiated wire transfers.

The sophistication is increasing. These are not the misspelled emails from a decade ago. Modern phishing pages are pixel-perfect replicas that can intercept two-factor authentication codes as you type them.

2. SIM Swap Attacks

An attacker contacts your mobile carrier, impersonates you, and transfers your phone number to their device. Now they receive your SMS-based two-factor authentication codes. The security layer most people trust becomes the entry point.

SIM swaps have been used to drain brokerage accounts, bank accounts, and cryptocurrency wallets. The carrier is the weak link — not the financial institution.

3. Credential Reuse

Same password across multiple sites? A breach at one service gives attackers a working key to your financial accounts. Automated tools test stolen username/password pairs across hundreds of financial institutions simultaneously. This is called credential stuffing, and it runs 24/7 at industrial scale.

The common thread: in virtually every case, the attacker did not "hack the bank." They tricked the account holder into providing access. The defense is at the device and behavior level — which means it is entirely within your control.

What Your Custodian Already Does

Before the action items: the structural protections already in place are more substantial than most people realize.

Fraud guarantees. Major custodians maintain guarantees covering 100% of losses from unauthorized account activity. These are typically automatic — no separate enrollment required. If someone gains unauthorized access and moves funds without your involvement, the custodian covers the loss.

Structural friction on money movement. Wire transfers and distributions require verified bank links, identity confirmation, and multi-day settlement windows. There is no instant-drain equivalent to compromised bank ACH. The friction is by design.

Continuous monitoring. Custodial fraud teams monitor all account activity around the clock using pattern analysis, behavioral analytics, and risk-based multi-factor authentication before granting access.

SIPC and excess coverage. The Securities Investor Protection Corporation (SIPC) protects $500K per account ($250K in cash) in the event of a broker-dealer failure. Major custodians carry additional excess SIPC coverage — often hundreds of millions in aggregate through underwriters like Lloyd's of London. This is separate from the fraud guarantee and activates if the custodian itself fails.

Asset segregation. Your securities are held separately from the custodian's own assets per SEC rules. Your holdings are not available to the firm's creditors, even in a bankruptcy scenario.

Your responsibilities under the guarantee: safeguard your credentials, do not share login information or grant remote device access, review statements, and report unauthorized activity promptly. These are conditions. Meet them, and the guarantee holds.

Your Security Hardening Checklist

Each step closes a specific attack vector. Implement all of them; 30 minutes total.

1. Hardware Security Key for 2FA

SMS-based two-factor authentication is vulnerable to SIM swap attacks. A hardware security key (YubiKey, Google Titan) is physically bound to your device and cannot be intercepted remotely. Most major custodians support hardware keys. If that is not feasible, use an authenticator app (Authy, Google Authenticator). Never rely on SMS alone for financial accounts.

2. Password Manager with Unique Passwords

Every financial account should have a unique, randomly generated password of 16+ characters. A password manager (1Password, Bitwarden) handles generation and storage. This eliminates credential reuse entirely. One breach, zero exposure elsewhere.

3. Lock Your SIM

Contact your mobile carrier and set a SIM PIN or account transfer lock. This prevents your number from being ported without the PIN. Each carrier has a slightly different process — call them directly. Ten minutes; eliminates SIM swap risk.

4. Freeze Your Credit at All Three Bureaus

Place a security freeze at Equifax, Experian, and TransUnion. This prevents anyone from opening new accounts in your name. Freezes are free, can be temporarily lifted for legitimate applications, and are the single most effective identity theft prevention measure available.

5. Verbal Password on Financial Accounts

Call your custodian and set a verbal password — a separate passphrase required for phone-based transactions. This prevents social engineering attacks where someone impersonates you by phone. Most major brokerages support this.

6. Never Click Links in Financial Texts or Emails

Navigate directly to your custodian's website by typing the URL or using the official app. No legitimate financial institution will ask for your password, PIN, or 2FA code via email or text. When in doubt, call the number on your statement — not the number in the message.

7. Transaction Alerts and Monthly Review

Set up alerts for logins, trades, and profile changes. Review statements monthly. Prompt reporting is both good practice and typically a condition of your custodian's security guarantee.

If You Suspect a Compromise

Time matters. These steps, in this order:

1. Call your custodian's fraud line immediately. Request an account freeze. The number is on your most recent statement and on the custodian's official website.

1. Contact Protocol Wealth via Signal or phone. We coordinate directly with the custodian's fraud team on your behalf.

1. Change all passwords — starting with email (the master key to all password resets), then financial accounts.

1. Run antivirus and malware scans on every device used to access financial accounts.

1. Freeze credit at Equifax (800-349-9960), Experian (888-397-3742), TransUnion (888-909-8872).

1. File reports with local police and the FBI's Internet Crime Complaint Center at ic3.gov.

1. Document everything — screenshots, timestamps, suspicious messages. This supports your fraud claim.

Under most major custodians' security guarantees, you are not responsible for unauthorized transactions provided you have safeguarded your credentials and reported promptly. Ask your custodian for the specific terms — or ask us and we will walk you through them.

A Note on Client Portals

Advisory firm portals — including ours — are typically read-only data aggregation tools. They display account balances and holdings. They cannot execute trades, initiate transfers, or move money. A compromised portal login exposes account balances; nothing more. Your assets remain at the custodian, protected by every layer described above.

A client portal is a window, not a door.

The Bottom Line

The custodial structure has more layers of protection than most people realize. The risk is not the platform. It is social engineering at the device level — and that is solvable.

The checklist above takes 30 minutes to implement. It is the highest-return security investment you can make.

---

Protocol Wealth, LLC is an SEC-registered investment adviser (CRD #335298). Registration does not imply a particular level of skill or training. This guide is for educational and informational purposes only. It does not constitute investment advice, legal advice, tax advice, cybersecurity advice, a recommendation to buy, sell, or hold any security, or an offer or solicitation of any kind. Custodial protections described are based on publicly available information from major qualified custodians as of the date of publication and are subject to change; clients should review their custodian's current policies directly. All investments involve risk, including the potential loss of principal. Past performance does not guarantee future results.

References: SIPC | SEC Investor Protection | FINRA