Scammers Are Getting Smarter, and Financial Defenses Must Follow

Host Christine Benz introduced Piper as the author of Household Cyber Security, a CPA's Guide to Protecting Your Accounts and Personal Information.

The hosts also highlighted a simple tip from the book: setting up a guest Wi-Fi network separate from the main home network.

He said these operators probably work as a team with other skilled professionals, each with their own area of expertise.

Piper argued that defenders are therefore up against skilled professionals with powerful tools, and should recognize who the adversary is.

Piper said fraud usually works in two steps: first gaining the target's trust, then pushing a call to action.

He advised not clicking links in emails, not following QR codes, and not replying to unexpected messages about finances.

Calls from unknown numbers should go to voicemail. If a message might be real, the person should contact the institution independently by typing its URL, using its app, or calling the number on the back of the card.

Replying within an existing, legitimate message thread is acceptable, he said.

Piper said passwords should be long and unique, not reused across websites.

Pass phrases of several randomly selected words can be a workable alternative, he added, but common phrases are much weaker.

Piper explained the three factor categories: something you know, something you have, and something you are. Logins should combine two different categories.

At sign-in, the device unlocks with a fingerprint or face ID and signs a challenge with the private key, which the bank checks against the public key.

Piper said devices generate passkeys to predefined cryptographic standards, so they are strong and unique without user effort.

If a user is lured to a lookalike site, such as a fake chase.com, the device recognizes the wrong domain and withholds the credential.

Because the private key is hidden from the user, even a caller posing as a bank employee cannot obtain it by persuading the user.

Piper noted that multiple US and UK cybersecurity agencies and nonprofits are encouraging the move to passkeys.

He said the user experience will differ from household to household depending on the combination of devices and browsers in use.

Each large transaction or withdrawal should be confirmed by a second person of sound mind, and if a cognitive concern arises, another person should be brought in.

If no family member can take on that role, he suggested hiring a professional.

Host Amy Arnott noted that Bogleheads community members like the hourly advice model for its transparency, but it requires someone to initiate each meeting rather than running on autopilot.

Effective monitoring needs planned, budgeted, ongoing contact with a professional who reviews the accounts and can spot when something is off.