How to Protect Your Money From Hackers
Two recent events prompted questions about the safety and security of bank and investment accounts. The first was the announcement of security holes in PHP, the programming language that runs about 70 percent of websites, including those of banks and credit unions. While there were no reported breaches or financial losses, federal agencies told organizations that couldn’t patch right away to take their PHP systems offline.
The second event did result in theft. Binance, the world’s largest crypto exchange, said that hackers stole $6.3 billion. The company explained that the attack was months in the making and started with an employee downloading a tampered artificial intelligence coding tool. The hackers also used a bogus job interview to compromise a computer and eventually seized control of the company’s wallets.
Binance will repay customers who lost funds, but investors who use the platform should understand that the company was not obligated to do so. And notably, if Binance itself were to fold, there are no customer protections in place. That stands in contrast to the two main government safety nets that kick in when a bank or brokerage firm fails: FDIC and SIPC.
The Federal Deposit Insurance Corporation (FDIC) insures checking, savings and money market deposit accounts, as well as CDs, up to $250,000 per depositor, per insured bank, per ownership category. That means that you can have an individual account, a joint account and an IRA at the same bank, and each would be insured separately. The Securities Investor Protection Corporation (SIPC) covers brokerage customers up to $500,000, including a $250,000 limit for cash, per customer, per account type.
Notably, FDIC and SIPC do not reimburse you if a scammer tricks you into wiring money or a hacker logs into your account with your password. For the latter, a federal rule known as Regulation E limits your liability for unauthorized electronic transfers from a bank account. If your card or login information is lost or stolen, you’re liable for no more than $50 if you report it within two business days of discovering it, and generally no more than $500 after that. You must also report any unauthorized transfer within 60 days of receiving the statement that shows it. Wait longer, and you could be on the hook for everything. (Unfortunately, Reg E doesn’t cover wire transfers or payments you were tricked into authorizing yourself.) Many large brokerages offer fraud guarantees, but typically only if you followed basic security practices.
To help protect yourself, here’s a quick cyber-hygiene checklist:
Use strong, unique passwords and a password manager.
Turn on multi-factor authentication for every financial account.
Be skeptical of unsolicited contact. If someone calls, texts or emails about your account, hang up and call the number on your statement.
Don’t download software from links or ads. Get apps only from official app stores or company websites.
Check accounts often and set alerts for logins, withdrawals and contact-information changes.
Freeze your credit at Equifax, Experian and TransUnion. It’s free and stops thieves from opening accounts in your name.
Spread large balances across ownership categories or institutions to remain within FDIC and SIPC limits.
Finally, be alert, especially during the busy holiday season. Pay attention to these trending scams:
AI Deception: AI can create highly realistic voices, ads and images. Even if something seems real, verify the request before acting.
Fake Online Relationships: Someone builds trust on social media, then asks for money.
Impersonation: Someone pretends to be a trusted source, like your bank, law enforcement or even a family member.
Online Shopping Deals: Deep discounts can be a red flag and may be too good to be true.