Summary: The first rule of wealth management is to protect what you have. Yet, most people - including those with substantial financial assets - are extremely lazy and naive about protecting their wealth, particularly on the internet.

Cybersecurity is especially important. As most wealth and money-linked activities (banking, investing, transactions, interaction)  has moved online and become more seamless, the number of ways to steal or commit scams continues to expand.

In this post, I will collate links of the most significant threats to Australians of financial losses due to scams or cybersecurity issues. I will also provide links of the most essential protective steps including devices (laptops, smartphones), malware, WiFi use, browsing use (e.g. SSL sites), passwords, two-factor security, transaction limits, transaction alerts and avoiding scam methods (phishing, etc).

An overview of many of the steps that will be covered here is: Scamwatch - Protect yourself from scams

Related Posts:
> See the scams category of this blog

Details:

Use a secure email  service (e.g. Gmail) that offers convenient security like two-factor authentication (2FA) and blocks most malicious spam automatically or quickly. Actually implement the extra security options like 2FA

See:
> Support.Google - Security & privacy
> Support.Google - Gmail security tips
> Google Account - 2-step verification


Use and maintain secure software including the operating system (e.g. Windows, Mac iOS, Android) and especially the browser (e.g. Chrome, Safari). Actually implement the optional security. An advantage of using Google Chrome with a Google account is that you can implement security features like 2FA for signing into your browser

See:
> PCWorld - Google Chrome: Best security tips for safer browsing


Avoid installing malicious software on your laptop, tablet or smartphone. Enable automated software scans and take action. Conduct manual scans when necessary

See:
> SMH - Malware hijacks big four Australian banks' apps, steals two-factor SMS codes


Install at least the best free versions of antivirus software. Upgrade to paid versions if worthwhile. If not using antivirus at minimum ensure default software is enabled (e.g. Windows Defender)

Use either Kaspersky or AVG for free versions.

See:
> PCWorld - Kaspersky's stellar antivirus finally goes free


Do not open or respond to suspicious SMS texts, emails, browsing ads/pop-ups, phone calls or other contact methods. Definitely do not click links. Delete, ignore or report them.

See:
> MoneySmart - Requests for account information (phishing)


Familiarise yourself with types of scams affecting Australians and how to protect yourself

Review all of the types of scams on Scamwatch. And

See:
> Scamwatch - Types of scams
> MoneySmart - Scams


Understand malicious spam, phishing and how to prevent, ignore and deal with it

- Phishing is an attempt to maliciously obtain sensitive information using electronic communication
- Most phishing is via email, SMS, messenging apps and links/ads on low-security websites
- Do not ever enter your logins or user details anywhere except 100% safe, authorised places and ensure the address is legitimate
- Forward SMS scams and spam to ACMA on 0429999888

See:
> Phishing emails and other online scams on the rise, as Australians lose millions of dollars
> ACMA - Banks targeted by SMS phishing scam
> whistleOut - How to stop spam text messages
> Scamwatch - Phishing


Manage, store and use passwords securely

If lazy about creating and managing secure passwords - especially when 2FA isn't available - then use LastPass to manage your passwords but make sure you use LastPass to create more secure ones.

However, if most of your sites are using 2FA then you can get by with following good-enough password practices for these. For sites that don't use 2FA make sure you use unique, strong passwords and manage them effectively.

Personally, I allow Google Chrome to save passwords where possible but have 2FA enabled for logging in to my Google account on Chrome. This means on new devices (e.g. public computers) I will be prompted for 2FA security (password and mobile phone code).

See:
>
> PCWorld -LastPass review: This virtual vault makes password protection effortless


Use two-factor authentication (2FA) wherever possible. Implement effective 2FA practices

2FA is the most common implementation of multi-factor authentication that requires two independent pieces of security evidence to permit access. Typically this involves a password (something you know) plus a one-off code sent to, or generated on, something you have - like your phone or a remote security authentication" token (e.g. kept on a keychain).

Using an effective 2FA method properly is one of the most critical protective steps.

See:
> Lifehacker - Two-factor authentication articles
> Lifehacker - Ask LH: What Happens If I Use Two-Factor Authentication And Lose My Phone?


Use financial service providers that have top security and offer protective features like two-factor (2FA) authentication

Avoid wherever possible using financial service providers that don't provide top security or have known security issues. The minimum level of security you require should match the amount of funds at risk. For example, I would be reluctant to place more than 10% of my assets (or say $50,000) with any provider that didn't have 2FA security on transactions. In the few cases where I do make exceptions, I check there are alternate sufficient protections in place.


Use Linked Accounts sparingly and transaction limits, transaction alerts and credit/overdraft limits effectively

"Linked Accounts" is the typical name given to financial accounts you first verify ownership of and after that transactions to such accounts can be of larger amounts, require less security (e.g. no 2FA) or occur without delay. Given this, you shouldn't add all of your financial service accounts as Linked Accounts but only those that are necessary.

Transaction limits (e.g. a daily cap on maximum funds transfer out) can usually be adjusted and should be set so that if there is any chance of fraudulent transfer of funds you are not too exposed. For example, if an account is not 100% secure then the size of your daily transaction limit will cap your risk - assuming you check transaction alerts and take immediate action if you see a fraudulent one.

Transaction alerts are extremely important to set up, look at and take action when necessary as they are generated at the provider's end, usually sent to email (SMS may also be optional) and can't be modified by a hacker.

Depending on the number of transactions that occur and your willingness to monitor them, you can usually set your own alert threshold so that you aren't annoyed by $20 transactions but do see ones over say $500. If you see a suspicious transaction alert and immediately contact your bank/provider you can prevent any future ones and often will be able to stop/reverse payment of the first suspicious one too.

For credit cards and overdrafts, set your default credit limits as low as is practical. A credit limit of $25,000 is exposed for that amount, while one of $6,000 is exposed to a much lesser amount. This is rarely an issue if fully paying off any credit cards each month.


Take precautions when using public WiFi. Use SSL sites or a trusted VPN.

See:
> Gizmodo - How To Stay Safe On Public Wi-Fi


If using a VPN service make sure it's trustworthy and secure. Be very careful with free VPN services you don't know much about

If using a VPN you are taking a lot of risks if the VPN provider isn't trustworthy or their software has security flaws. So be careful in choosing the best ones (e.g. TunnelBear, ExpressVPN)

See:
> PCWorld - VPNs have a trust issue: Here's what TunnelBear did about it
> SecureThoughts - Best VPN for Australia


Further Info:

Scamwatch
> Protect yourself from scams

Stay Smart Online
> Protect yourself

ACMA
> eSecurity
> Blogs - Cybersecurity

PCWorld
> Security

Canstar
> Online Banking: What Scams Should You Look Out For?

SMH/The Age
> Consumer security