Investment accounts are high-value targets. A handful of habits, from phishing-resistant sign-in to read-only connections, closes most of the common gaps.
Key takeaways
- Use a unique password per financial account, stored in a password manager.
- Prefer passkeys or security keys; avoid SMS codes where you can, and add a carrier port-out PIN.
- Never share one-time codes; open apps directly instead of clicking links.
- Turn on login, transfer and contact-change alerts.
- Prefer read-only connections; SIPC covers broker failure, not fraud or market losses.
Why investors are targets
Brokerage and retirement accounts concentrate a lot of value behind a single login. Attackers know that, and the most common attacks are not sophisticated hacks of the institution itself. They are attempts to trick you, or your phone carrier, into handing over access.
The good news is that the defenses are well understood. Most account takeovers rely on reused passwords, SMS codes that can be intercepted, or a convincing fake login page. Each has a straightforward fix.
Lock down sign-in
Use a unique, long password for every financial account, stored in a reputable password manager. Reuse is the single biggest risk, because a breach at an unrelated site can expose the same password.
Turn on the strongest second factor your institution offers. Passkeys and hardware security keys are phishing-resistant, because they will not authenticate to a fake site. Authenticator apps are a solid second choice. SMS codes are better than nothing but are vulnerable to SIM swapping, where an attacker convinces your carrier to move your number to their device.
Ask your mobile carrier about a port-out PIN or number lock. It takes a few minutes and makes SIM swaps much harder.
Illustrative diagram.
Recognize phishing
Be suspicious of any message that creates urgency: a locked account, an unusual withdrawal, a tax problem. Do not click links in those messages. Open the app or type the address yourself.
Legitimate institutions will not ask for your password or a one-time code by phone, text or email. If someone asks you to read back a code, it is almost certainly an attack in progress.
Watch for lookalike domains and attachments you did not expect. When in doubt, call the number printed on your statement or the back of your card.
A tool that cannot move money cannot be used to move money.
Monitor and limit
Turn on alerts for logins, withdrawals, transfers and changes to contact details. Fast notice turns a disaster into an inconvenience.
Review which apps have access to your financial accounts and remove the ones you no longer use. Prefer read-only connections for tools that only need to see your data. A tool that cannot move money cannot be used to move money if it is ever compromised.
Know the limits of protection. SIPC protects customers of failed member brokerages up to $500,000, including up to $250,000 in cash. It does not cover investment losses or losses from fraud you were tricked into authorizing.
How Wealthnow approaches it
Wealthnow is non-custodial: it never holds your money. Account connections are read-only through established aggregation providers, and Wealthnow finds and proposes; you approve every move. Our Security page explains the controls in more detail, and you can reach the team at security@wealthnow.io.
Your checklist
- Unique password for every financial account
- Passkey, security key or authenticator app turned on
- Carrier port-out PIN set
- Login, transfer and contact-change alerts on
- Unused app connections removed
- Never read a one-time code to anyone
Frequently asked questions
Is SMS two-factor authentication safe?
It is better than nothing, but SIM-swap attacks can intercept SMS codes. Passkeys, security keys or authenticator apps are stronger.
What does SIPC cover?
SIPC protects customers of failed member brokerages up to $500,000, including $250,000 in cash. It does not cover market losses.
Can Wealthnow move my money?
Connections are read-only and Wealthnow is non-custodial. Wealthnow finds and proposes; you approve every move.
Educational content, not investment, tax or legal advice. Wealthnow finds and proposes; you approve every move.
