Financial account security,
the full stack.

Why this matters

Data breaches expose usernames, passwords, email addresses, and often Social Security numbers and dates of birth. If you reuse passwords, one breach gives attackers access to every account using that password. If you use SMS two-factor, a SIM swap attack transfers your phone number to a scammer's device and they receive your codes verify×DON'T TRUST, VERIFYClaim: SIM-swap attacks bypass SMS-based two-factor authentication by transferring the victim's phone number to the attacker's device.Verify at: FTC SIM-swap guidance ↗ and FBI SIM-swap warning ↗Both FTC and FBI have issued explicit warnings on this vector. Authenticator apps and hardware keys resist it.. Your account is compromised even with 2FA enabled.

The solution is not complicated. It is a one-time setup.

The password manager

Use a password manager. Without one you either reuse passwords (dangerous) or use weak memorable ones (also dangerous). With one, every account gets a unique random 20-plus character password. You remember one master password.

Setup (30 minutes)

1. Install the app.
2. Create your master password. Use a passphrase: four or more random words, minimum 20 characters. Write it on paper and store it somewhere secure. This is the one password you cannot lose.
3. Install the browser extension.
4. As you log into accounts over the next week, save them to the manager, then update each to a unique random password.

Two-factor authentication

Three types of 2FA, weakest to strongest:

Priority order for 2FA setup

1. Email accounts first. Email is the master key. Password resets go to email. Gmail, Outlook, iCloud. Use authenticator app minimum.
2. Financial accounts. Fidelity, Schwab, Vanguard, your bank, your brokerage, any Bitcoin exchange, credit-card portals.
3. Bitcoin-specific. Any exchange holding Bitcoin. Your Fidelity account if holding IBIT or FBTC.
4. Tax-related. IRS online account at irs.gov ↗ (create one if you do not have it). TurboTax, H&R Block, FreeTaxUSA.

Hardware security keys

A hardware key provides the highest level of protection against phishing. Here is how phishing bypasses authenticator apps: you receive a fake login page that looks real, you enter your password and authenticator code, the attacker's server immediately uses both on the real site. Your account is compromised even with authenticator 2FA.

Hardware keys block this. The key cryptographically verifies the actual website domain. If the domain does not match the registered site, the key refuses to authenticate. Even if you enter your password on a fake site, the key does not work verify×DON'T TRUST, VERIFYClaim: FIDO2/WebAuthn hardware keys are phishing-resistant because they bind authentication to the registered domain.Verify at: FIDO Alliance ↗Core security property of WebAuthn. Also why Google has not had a confirmed phishing account takeover among employees since switching to hardware keys (reported 2018)..

Recommended: YubiKey 5 Series. Works with Gmail, Microsoft, GitHub, many financial sites, 1Password, Bitwarden. Buy two identical keys. Register both on every account. Store one as a backup somewhere safe.

Many financial institutions still do not support hardware keys. Use authenticator app for those. The landscape is improving.

Bitcoin-specific security

Your hardware wallet IS your security key for Bitcoin. See Hardware Wallets.

• Never enter your seed phrase on any website or app. Ever. No exceptions. Any site asking for it is a scam.
• Keep your hardware wallet offline when not in use.
• Keep your seed phrase on metal storage, not paper, not a photo, not a digital file.
• See Seed Phrase Rules.

Account alerts

Set up transaction alerts at every financial institution. Email or push notification for any transaction over a threshold, new device login, password change, address change, new beneficiary added.

These do not prevent attacks but alert you immediately so you can respond before more damage is done. Most banks and brokerages have alert settings in the account security section. Set them all. About 10 minutes per institution.

The complete setup checklist

One afternoon. One time. Done.

Related