Multi-Factor Authentication (MFA)

Buy two FIDO2 hardware keys — a Yubico or equivalent, one carried and one in the safe — and register both on every account that will accept them. Then remove SMS as a recovery method wherever the institution allows it. That is the whole recommendation; the rest of this subsection explains why the alternatives are worse.

MFA means presenting credentials from more than one category: something you know, something you have, something you are. The categories are not equally strong.

• Physical security keys are the only factor immune to phishing, because the key performs a cryptographic challenge bound to the actual web domain and simply will not respond to a lookalike. No amount of social engineering extracts a credential that never leaves the device. Register a backup key before you need it — lockout represents the primary operational risk with hardware tokens instead of compromising security.
• TOTP authenticator apps generate codes that are strong in isolation but phishable: a convincing fake login page collects the six digits and replays them within the window. Cloud-synced authenticators go further and collapse their security into that of the sync account, so your brokerage is now protected by your email password.
• Push notifications are a reasonable middle tier, though vulnerable to “MFA fatigue” — an attacker spamming approvals until you tap one to make it stop.
• Biometrics reduce friction on a device you already control. They are not a remote authentication factor.
• SMS and email codes are the weakest and the most common. A SIM swap — an attacker persuading or bribing a carrier employee to port your number — defeats them entirely, and it is a targeted attack, meaning the people worth targeting get it. Call your carrier and add a port-out PIN or account lock; it takes ten minutes and closes the most likely path into your accounts.

The asymmetry is what justifies the effort: the cost is roughly $100 and an afternoon, and the exposure is every liquid dollar reachable by wire from an account you can log into.

Beyond MFA, advanced wealth preservation requires the following defensive protocols:

• Systemic Redundancy: Establish operating accounts at a minimum of two separate financial institutions to mitigate single-point-of-failure risk (such as administrative freezes or regional banking liquidity events).
• Verbal Passcode Overrides: Establish custom verbal passcodes with your private banker or institution for telephone verifications. Reject the default use of your Social Security Number (SSN) or mother’s maiden name, both of which are readily obtainable via public records or historic credit bureau leaks.
• Risk Compartmentalization: Segregate daily discretionary spend from core capital reserves. Isolate transaction exposure by using dedicated virtual credit cards or mobile wallets (such as Google Pay) with restricted credit lines for online merchants.
• Aggregator Liability Isolation: Restrict the use of third-party financial aggregators (e.g., Plaid, Yodlee). While these tools frequently use secure, tokenized OAuth (Open Authorization) connections, older integrations or smaller institutions may fall back to credential-based screen-scraping. This fallback introduces severe regulatory risk. Under Regulation E ( 12 CFR Part 1005), which governs electronic fund transfers, the tiered liability limits ($50, $500, or unlimited past 60 days — section “Debit Cards: Structural Risk and Liability Exposure”) only cover unauthorized transfers. Regulation E defines an access device broadly (12 CFR §1005.2(a)), and login credentials can fall within it. Voluntarily disclosing these credentials to an aggregator can allow the bank to argue that any subsequent transfers are contractually authorized, removing the §1005.6 liability caps and shifting the loss for system breaches or unauthorized transfers entirely to you. The CFPB’s (Consumer Financial Protection Bureau) Personal Financial Data Rights rule ( Reg 1033, finalized October 2024) would have mandated tokenized, revocable access — but the Bureau reversed course in 2025, asked the court to vacate its own rule, and a federal injunction now blocks enforcement while a rewrite proceeds. With no regulatory backstop in sight, the discipline is entirely yours: reject any service demanding direct login credentials.
• Velocity Limits: Configure restrictive, daily outbound limits on automated clearing house (ACH) and wire transfers, requiring manual, secondary phone confirmation for large transactions.
• Wire Verification Discipline: A completed wire is effectively irreversible—once funds settle in the recipient’s bank, there is no chargeback mechanism and recovery depends on the receiving bank voluntarily freezing the account. Business email compromise (BEC) fraud exploits this: an attacker spoofs an escrow officer, attorney, or vendor and emails altered wire instructions, most lethally during real-estate closings. Before sending any wire, verify the routing and account numbers by calling the recipient at a phone number you independently sourced—never a number supplied in the payment email or document. Treat any last-minute change to wire instructions as fraud until proven otherwise. If you do send a fraudulent wire, demand a SWIFT recall immediately and file with the FBI’s IC3 within hours; its Recovery Asset Team can sometimes claw back funds before they are withdrawn.
• Avoid P2P Rails for Anything But Trusted Payees: Real-time peer-to-peer rails ( Zelle, Venmo, Cash App) are designed to be instant and final. Critically, when you are tricked into authorizing the payment—an imposter “bank fraud department,” a fake invoice, a marketplace scam—the loss is classified as an authorized transfer and falls outside Regulation E’s liability caps, so the bank owes you nothing. Restrict P2P to people you know, never use it with merchants or to “verify” anything, and route any payment to an unfamiliar party through a credit card or escrow instead.