How to Protect Your Money Online: A Cybersecurity Checklist

Most money stolen online is not taken by someone breaking through a bank's defenses. It is handed over: a password typed into a fake login page, a one-time code read aloud to a "fraud department" caller, a payment app transfer sent to a stranger who seemed legitimate. The good news is that the same pattern makes most of these losses preventable with a handful of habits and settings.

This guide is a practical cybersecurity checklist for your personal finances. It covers how today's scams work, how to lock down your accounts, what to do in the first hour after something goes wrong, and how to help older relatives stay safe. You do not need to be technical to follow it; you need about an afternoon and a willingness to slow down when something feels urgent.

How scammers get in: phishing, smishing and vishing

Almost every financial scam starts with a message designed to make you act before you think. The channel changes, but the script is remarkably consistent.

• Phishing is the email version: a message that looks like it is from your bank, a delivery company, a tax agency or a popular retailer, urging you to click a link and "verify" your account.
• Smishing is the text message version: an alert about a suspicious charge, an unpaid toll, a package that cannot be delivered or a prize you have supposedly won.
• Vishing is the voice call version: someone claiming to be from your bank's fraud team, a government agency, tech support or even a family member in trouble. Caller ID can be spoofed, so a familiar name or number proves nothing.

The red flags

• Urgency or fear: "Your account will be locked in 24 hours," "A warrant has been issued," "Act now to stop this charge."
• A request for secrets: passwords, PINs, full card numbers or one-time verification codes. Legitimate banks do not ask you to read a code back to them on a call they initiated.
• Unusual payment methods: gift cards, cryptocurrency, wire transfers or payment-app transfers "to a safe account."
• Links that do not match: the web address is misspelled, uses an odd domain or is hidden behind a shortened link.
• Pressure to stay quiet: "Don't tell the bank teller," "Don't hang up," or "This is confidential."

Account takeover: what attackers are really after

Many scams aim for account takeover: getting into your email, bank, brokerage or payment app so they can move money, change your contact details or open new accounts in your name.

Your email account is the master key. Password reset links for nearly every financial account go to your inbox, so anyone who controls your email can often reset everything else. Your mobile phone number is a close second, because many accounts send verification codes by text. Attackers sometimes try to move your number to their own device (a "SIM swap" or "port-out" scam) to intercept those codes.

Protecting these two accounts first gives you the biggest security improvement for the least effort:

• Give your primary email a long, unique password and the strongest multi-factor authentication it supports.
• Review your email's recovery phone, recovery email and any auto-forwarding rules, and remove anything you do not recognize.
• Ask your mobile carrier to add a PIN or passcode to your account and turn on any port-out or SIM-change protection they offer.
• Check which devices are signed in to your email and financial apps, and sign out of any you no longer use.

Strong, unique passwords with a password manager

Reusing passwords is one of the most common ways accounts get taken over. When any website you use suffers a data breach, criminals try those leaked email-and-password pairs on banks, shopping sites and email providers. If you reused the password, they get in.

The fix is simple in principle: a different, long password for every account. The only practical way to do that is with a password manager, an app that generates, stores and fills in passwords for you, protected by one strong master password.

1. Pick a reputable password manager. Look for one that supports all your devices, offers multi-factor authentication for the vault itself and has a clear security track record.
2. Create a strong master password. A passphrase of several random, unrelated words is long, memorable and hard to guess. Never reuse it anywhere else.
3. Start with what matters most. Change the passwords for email, banking, credit cards, brokerage, payment apps and your mobile carrier first. Use the generator to create long random passwords.
4. Clean up over time. Each time you log in to another site, update its password. Many managers will flag reused or weak passwords for you.
5. Plan for access. Store your recovery codes safely and consider your manager's emergency-access feature so a trusted person can reach critical accounts if something happens to you.

A password manager also helps you spot phishing: if it does not offer to fill in your bank password, you may be on a fake site that only looks like your bank.

Multi-factor authentication: apps and passkeys beat SMS

Multi-factor authentication (MFA) requires a second proof of identity beyond your password. Even if a criminal steals your password, MFA can stop them at the door. Turn it on for every financial account and your email.

Not all second factors are equally strong:

Use the strongest option each account offers. If your bank only supports text codes, keep them on and add a carrier PIN to reduce SIM-swap risk. And remember: a verification code is for you alone. Anyone who asks you to share it, no matter who they claim to be, is attempting fraud.

Freeze your credit and turn on account alerts

Credit freezes

A credit freeze (also called a security freeze) stops most lenders from viewing your credit report, which makes it much harder for someone to open a new account in your name. Freezing and unfreezing is free by federal law, it does not affect your credit score, and it does not stop you from using your existing cards and loans.

You must place a freeze separately at each of the three nationwide credit bureaus: Equifax, Experian and TransUnion. Each offers it online, by phone or by mail. When you need to apply for credit, a new apartment or certain jobs, you can temporarily lift the freeze, often within minutes online, and then put it back.

• Freeze your credit at all three bureaus and store the login details or PINs in your password manager.
• Consider freezes for your children as well; a child's clean credit history can be an attractive target.
• Pull your free credit reports at AnnualCreditReport.com and look for accounts, addresses or inquiries you do not recognize.

A fraud alert is a lighter option: it asks lenders to take extra steps to verify your identity. Placing one with any single bureau notifies the other two. It is useful if you suspect your information has been exposed but are not ready to freeze.

Account alerts

Alerts turn your bank's app into an early-warning system. Most banks and card issuers let you choose notifications by email, text or push. Useful ones include:

• Any transaction over a small amount you choose (some people set this very low)
• Card-not-present or online purchases
• International transactions
• Password, email, phone number or address changes
• New payees, external transfers or new linked accounts
• Low balance and large withdrawals

Alerts work best as part of a system. Our guide on how to automate your finances explains how to combine alerts with autopay and a weekly money check-in so nothing slips by.

Safe devices, apps and Wi-Fi

Your phone and computer are the front door to your accounts. Keep them in good shape:

• Turn on automatic updates for your operating system, browser and apps. Updates often fix security holes attackers are actively using.
• Lock your devices with a strong PIN, password or biometric, and set them to lock automatically after a short time.
• Download financial apps only from official app stores, and check the developer name matches your bank.
• Do not let strangers control your screen. Uninstall remote-access tools that a "tech support" caller asked you to install.
• Secure your home Wi-Fi with a strong password, modern encryption settings and an updated router; change the router's default admin password.
• Be careful on public Wi-Fi. Prefer your phone's cellular connection for banking, or use a reputable VPN on networks you do not control.
• Turn on "find my device" and remote wipe so you can lock or erase a lost phone.
• Back up important files so ransomware or a broken device cannot hold your records hostage.

Peer-to-peer payment app scams

Peer-to-peer (P2P) payment apps make sending money to friends easy, and that is exactly what scammers like about them. Transfers often move within minutes, and once you authorize a payment to a scammer it can be very hard to get back, because you technically approved it.

Common P2P scams include:

• Fake sellers: someone advertises concert tickets, a rental or a puppy, takes your payment and disappears.
• Overpayment: a "buyer" sends too much and asks you to refund the difference; the original payment later reverses.
• Accidental payment: a stranger "mistakenly" sends you money and asks for it back, often using a stolen account.
• Bank impersonation: a caller says your account is compromised and tells you to send money to yourself or a "safe account" through the app.

1. Pay only people you know and trust. Treat P2P apps like handing over cash.
2. Use payment methods with buyer protection for purchases from strangers, such as a credit card through a reputable checkout.
3. Double-check the recipient before you send, and send a small test amount to new contacts.
4. Turn on the app's security features, including a PIN or biometric lock and transaction notifications.
5. Refuse refund requests from strangers. Tell them to contact their bank or the app's support, and let the app reverse a genuine mistake.

What to do if you have been hacked or scammed

Speed matters. The faster you act, the better your chances of stopping further losses and recovering money. Do not let embarrassment slow you down; these scams fool careful, intelligent people every day.

1. Contact your bank or card issuer immediately. Use the number on your card or in the official app. Report the fraud, ask them to freeze or close affected cards and accounts, and ask whether a transfer can be stopped or reversed. Federal rules generally give you more protection the sooner you report unauthorized transactions.
2. Secure your accounts. From a device you trust, change passwords starting with email, then banking and payment apps. Turn on or reset MFA, and sign out all other sessions.
3. Freeze your credit at Equifax, Experian and TransUnion if you have not already, or place a fraud alert.
4. Report identity theft at IdentityTheft.gov. The FTC's site creates a personalized recovery plan and an identity theft report you can use with creditors.
5. Report the scam at ReportFraud.ftc.gov. Reports help law enforcement spot patterns. For internet-based crimes you can also file with the FBI's Internet Crime Complaint Center at ic3.gov.
6. Check for a malware infection. If you installed anything a scammer asked for, remove it and run a security scan, or have the device professionally checked.
7. Watch closely for the next few months. Review statements and credit reports, and be alert to "recovery" scammers who promise to get your money back for a fee.

Protecting older relatives

Older adults are frequent targets, often because they may have savings, be home to answer calls and be less familiar with new scam tactics. Helping them is less about technology and more about respectful, ongoing conversation.

• Talk about scams regularly, sharing real examples without lecturing. Make it clear they can always call you before sending money, with no judgment.
• Agree on a family code word to verify emergency calls; voice-cloning tools can make an impostor sound like a grandchild.
• Help set up alerts on their accounts and, with their consent, consider adding a trusted contact person at their bank or brokerage.
• Simplify their devices with automatic updates, a password manager or a written password book kept somewhere secure at home, and call-blocking features.
• Freeze their credit if they are not planning to apply for new credit.
• Watch for warning signs such as secretive new "friends," unusual withdrawals, gift card purchases or sudden urgency about money.

Your money security self-check

Use the interactive checklist below to see where you stand. Each item you can check off closes a door that scammers commonly use. Explore more free planning tools on our tools page.

If you would like a professional review of your household or small business setup, MR IT LLC provides financial cybersecurity and fraud protection services, including password manager rollout, MFA setup and alert configuration. We never ask for your passwords or one-time codes, and we do not access accounts without explicit written authorization. Questions are welcome through our contact page. And if a scam has pushed your savings off track, our guide on how to build an emergency fund can help you rebuild your cushion.

This article is for general educational purposes only and is not legal, financial or professional security advice. If you believe you are a victim of fraud, contact your financial institution and the appropriate authorities right away, and consider consulting a qualified professional for your situation.