Practicing Digital Self-Defense

As the custodian of $3.4 trillion in client assets,¹ The Charles Schwab Corporation takes security seriously. “From biometric identification to Schwab’s Security Guarantee, we have a number of extremely robust safeguards in place to help protect our community of investors,” says Greg Ruppert, senior vice president of financial crimes risk management at Schwab (see “Security at Schwab,” below).

That said, Greg recommends clients take additional steps to protect themselves and their loved ones from increasingly sophisticated financial scams. After all, this issue is much bigger than Schwab: In 2017 alone, the Federal Bureau of Investigation’s Internet Crime Complaint Center received more than 300,000 complaints about internet scams, representing more than $1.4 billion in losses.

Here are seven ways to assess your virtual risk and help guard against potential threats.

1. Know where you stand

Review the transaction history of your bank accounts, credit cards and investments at least monthly, so you can identify and report suspicious activity before it potentially snowballs into something bigger.

What’s more, you’re entitled to one free credit report annually from each of the three consumer credit–reporting agencies (Equifax, Experian and TransUnion). By requesting a report from a different agency every four months (at annualcreditreport.com), you can check your credit report up to three times a year for free.

If you’re ever the victim of a data breach—the private data of 143 million Americans was exposed in a single Equifax hack in 2017, for example—you may be eligible for free credit monitoring or identity protection from the company that was compromised.

2. Employ alerts and freezes

• Alerts: If you suspect you’ve been the victim of identity theft, you can place a fraud alert with the three consumer credit–reporting agencies. Whichever one you contact is required to contact the other two on your behalf. These alerts notify creditors that your account may have been compromised and require them to verify your identity before issuing new credit in your name. They last for one year, though they can be extended for up to seven if you’ve filed a report with either the police or the Federal Trade Commission at identitytheft.gov.
• Freezes: Freezing your credit account with each of the three consumer credit-reporting agencies prevents new accounts or lines of credit from being opened in your name.² Federal law allows Americans to freeze and unfreeze their credit accounts at no charge an unlimited number of times each year. “A credit freeze is perhaps the single most effective security precaution against identity theft consumers themselves can take,” Greg says.

3. Be careful what you click

Despite the rise of increasingly sophisticated scams—including those involving minors (see “No kidding,” below)—“the most successful method of cyberattack is still spear phishing,” Greg says. Spear phishing is the practice of sending fraudulent emails purportedly from companies you trust in order to obtain confidential information or get consumers to click on potentially damaging links. Instead of clicking on embedded links, always log on directly at schwab.com and other websites.

If you’re ever suspicious of an email from Schwab, confirm the message by calling us at 800-435-4000—and by all means forward suspicious communications to phishing@schwab.com for further investigation.

4. Vary your credentials

Make sure you create unique usernames and passwords for all online accounts, financial and otherwise. Why? “Because criminals can often exploit the data on one site to gain access to another,” explains Clyde Langley, head of fraud risk management at Schwab.

If you’re the victim of a data breach, consider changing not only the passwords for all affected accounts but also those that share the same email address or other username. (If possible, switch up usernames, as well.)

Also consider a password manager, which can generate a super-secure unique password for every account you have—and then keep track of them so you don’t have to.

5. Sign up for two-step verification

Two-step verification confirms your identity prompting you to enter a code that’s been texted to your phone or sent to another device. Some forms of biometric identification—such as face, fingerprint and voice ID (all offered by Schwab)—are considered so secure they often don’t require additional verification. For everything else, sign up for two-step verification anytime it’s offered.

6. Just say no

Never grant remote access to or download software from a technology-support professional without first confirming her or his identity. In many such scams, fraudsters install malware that can capture your every click and keystroke. Instead, independently confirm the company’s customer-support number through an online search and return any calls that seem legitimate. Alternatively, search the vendor name or phone number online along with “fraud” or “scam” to determine if it’s previously been reported as illegitimate.

7. Be prepared

Always keep a copy of your most important data and documents—including account and insurance information—on a secure cloud server for easy access in case of emergency. (Periodic computer backups are also a good idea.) One of the many tragedies of the recent hurricanes in Houston and Puerto Rico has been homeowners’ inability to access everything from health care directives to wills, to say nothing of the insurance policies required to get folks back on their feet.

“From switching up your passwords to taking advantage of the latest protections offered by the companies with which you do business, the best approach is a holistic one,” Greg says. “Sometimes the simplest precautions can prove to be the most effective.”

¹Data as of 12/14/2018.

²For residents of Kentucky, Pennsylvania and South Dakota, a credit freeze lasts seven years. For residents of all other states, a credit freeze lasts until it is removed.