Securing the accounts that protect your money

The account you are not protecting is the one that matters

Ask most people which of their accounts is the most financially sensitive and they will name a bank. It is a reasonable answer and it is usually wrong.

The most financially sensitive account you own is almost always your primary email address, closely followed by your mobile phone number. Not because either holds money, but because both hold the ability to _reset_ things that do. Every "forgot password" link, every one-time code, every account recovery flow, every new-device confirmation eventually lands in one of those two places.

This produces a structure worth naming: your financial accounts are not independent. They hang off a small number of control points, and their real security is the security of the weakest control point, not the strength of any individual password.

Call that structure the **recovery chain**. An attacker who understands it does not attack your bank. They attack the thing your bank trusts.

Everything in this article follows from mapping and then hardening that chain. It is general education, not personalised security or financial advice, and specific products and bank procedures differ.

Mapping your own recovery chain

Before changing any settings, spend twenty minutes producing a map. Most people have never done this and are surprised by the result.

For each financial account you hold — bank, card issuer, investment platform, payment app, wallet, insurer, pension, government portal — write down four things:

1. Which email address is registered on it
2. Which phone number is registered on it
3. What the account recovery method is if you lose both the password and the device
4. Whether it holds stored payment details or the ability to move money out

Then invert the list. Group by email address and by phone number.

Two findings are typical.

**Finding one: concentration.** One inbox controls almost everything. That inbox is now the single most valuable target you own, and it is often the oldest, most exposed address you have — the one used for shopping, newsletters and forum signups since forever.

**Finding two: forgotten dependencies.** There is usually at least one account still pointing at an old email address you no longer read, an old phone number you gave up, or a work address you will lose when you change jobs. Any of these is a live hole: an inbox you do not monitor is one where a takeover produces no alerts, and a phone number you released may be reissued to someone else.

The map is the deliverable. If you do only one thing from this article, do this one. Hardening without a map means hardening the accounts you happened to think of.

Why the inbox is the master key

It is worth being concrete about what an attacker does after taking an inbox, because the sequence explains which defences matter.

They rarely start moving money. They start by making themselves invisible and permanent:

• **Search the mailbox.** Terms like "statement", "verification", "welcome to", "your account" enumerate every financial relationship you hold, along with account numbers and often full names and addresses.
• **Create hidden forwarding or filtering rules.** A rule that auto-forwards anything containing "code" or "verify" to their address, and a second rule that immediately archives or deletes those messages, means you never see the alerts generated by your own account being drained.
• **Add a recovery method of their own.** A second phone number or backup email on your inbox means that even if you change your password, they can reset it back.
• **Register new devices or app passwords** so that a password change alone does not evict them.
• **Only then** start password resets on financial accounts, one at a time.

Notice the implication. Changing a compromised inbox password is necessary and completely insufficient. Unless you also remove unfamiliar recovery methods, delete unfamiliar forwarding and filter rules, and sign out all sessions and devices, you have locked the front door while the attacker holds a key to the back.

This is also why "I did not receive any warning emails" is not evidence that nothing happened. Suppressing those emails is step two.

Phone numbers are a weak link that feels strong

Your mobile number feels like a physical possession. Technically it is an account with a telecom operator, and it can be moved.

The attack is generally called SIM swapping. Someone contacts the operator posing as you, supplies personal information gathered from breaches and social media, and asks for the number to be transferred to a new SIM. When it works, every text-message code you rely on now arrives on their device, and yours goes quiet.

Two practical consequences:

• **Text-message codes are a real improvement over a password alone, and they are the weakest of the common second factors.** Guidance on authenticator strength has long treated factors bound to a device or a cryptographic key as stronger than codes delivered over a channel that can be redirected or intercepted.Source^source
• **Sudden unexplained loss of mobile service is a security event.** If your phone drops to no service with no outage in your area and no billing issue, treat it as a possible transfer of your number and contact your operator immediately from another line — before assuming it is a technical fault.

Ask your telecom operator what additional protection they offer on the number itself, such as a port-out PIN, a transfer lock, or an in-person identity requirement for SIM replacement. This is a five-minute call that most people never make, and it protects an asset sitting underneath every account they own.

Four tiers of defence, in the order worth doing them

Security advice fails when it presents twenty equal-weight tips. These are not equal. Do them in this order.

Tier 1: Make the inbox unbreakable first

Everything else depends on this. On your primary email account:

• Set a long, unique passphrase used nowhere else. Length matters more than exotic characters; a memorable sequence of several unrelated words resists guessing better than a short string with symbol substitutions.Source^source
• Turn on the strongest second factor the provider offers. Prefer a hardware security key or a device-bound passkey where available, an authenticator app next, and text-message codes only as a fallback.
• Open the security settings and audit three lists: recovery email and phone, active sessions and devices, and connected third-party apps. Remove anything you do not recognise or no longer use.
• Check forwarding and filter rules explicitly. This is the setting attackers use and ordinary users never look at.
• Save the recovery or backup codes somewhere offline. Losing access to your own inbox because you secured it too well is a real and miserable outcome.

Tier 2: Separate the identities

Concentration is the vulnerability the map revealed. Reduce it.

Consider using a dedicated email address for financial accounts that is not used for shopping, subscriptions, social platforms or public posting. The point is not secrecy for its own sake — it is that an address which never appears in public places receives far less targeted phishing, and it appears in fewer breach datasets.

The same logic applies in a smaller way to phone numbers, if you can practically maintain a second one for account recovery only.

Be realistic about the cost. A second address you never check is worse than useless, because alerts will land there unread. Only adopt separation you will actually maintain.

Tier 3: Stop reusing passwords, using a manager

Password reuse is the mechanism that turns one company's breach into your problem. Credentials leaked from a low-value site are tried automatically against banks, email providers and payment platforms at scale. If the pair matches, the attacker did not need to break anything.

A password manager solves this properly because it removes the reason people reuse: memory. Use it to generate a unique credential per site, protect the manager itself with a strong passphrase and a second factor, and accept the trade-off honestly — you are concentrating risk into one vault in exchange for eliminating reuse across hundreds of sites. On the evidence of how compromises actually happen, that trade is usually worth taking.

A note on old advice: forcing yourself to change passwords every ninety days is no longer recommended practice, because it pushes people towards predictable variations. Change a password when there is a reason — a breach, a suspicion, a shared device.Source^source

Tier 4: Turn the bank into a sensor

Your bank can tell you about money movement faster than you will notice it. Configure it to.

• Enable transaction alerts at the lowest threshold you can tolerate, for card use, transfers and logins from new devices.
• Turn on alerts for _changes_, not just payments — new payee added, contact details changed, card issued, limit increased. Account takeover shows up in these before it shows up in transactions.
• Know where the freeze or lock control is in your banking app _before_ you need it, and know your bank's official fraud number without searching for it in a panic.
• Review which third-party services have ongoing access to your account or card.

Licensed banks operate within consumer protection frameworks and expect customers to report suspected fraud promptly; knowing the reporting route in advance is part of the defence.Source^source

The attacks these defences do and do not stop

Being precise here matters, because overconfidence is its own vulnerability.

**Strong authentication stops** credential stuffing from breaches, password guessing, and most opportunistic remote access. It substantially reduces the value of a stolen password.

**Strong authentication does not stop** you from approving something yourself. This is the gap most account takeovers now exploit, and phishing and social engineering remain a leading route to compromise precisely because they target the person rather than the mechanism.Source^source

Three variants are worth recognising by name.

Real-time relay phishing

You land on a convincing copy of a login page. You type your credentials. The fake site passes them to the real site instantly, which sends you a genuine one-time code. You type the code into the fake site. The attacker relays it and is now inside — using a code that was real, timely and correctly delivered to you.

The defence is not vigilance about codes; it is using a factor that cannot be relayed. Hardware keys and passkeys are bound to the genuine website's address, so they simply do not produce anything usable on a lookalike domain.Source^source

Push fatigue

Your phone shows repeated approval prompts you did not trigger, at inconvenient hours, until you tap approve to stop them. Treat an unexpected approval prompt as evidence that someone already has your password, and respond by changing that password rather than by dismissing the prompt.

The authorised push payment

The most damaging outcome for most households involves no technical compromise whatsoever. Someone convinces you, usually by phone, that your account is under attack and that you must move your money to a "safe account" they nominate. You authenticate correctly. You approve knowingly. The money is gone.

The structural defence is a rule you decide in advance, while calm: **no legitimate bank will ever ask you to move money to another account for safekeeping, and no legitimate bank will object to you hanging up and calling back on the number printed on your card.** Anyone who resists that callback has identified themselves.

Build a Break Glass sheet

When something goes wrong, the failure is usually order and speed, not knowledge. So write the order down in advance, on paper or in an offline note, and keep it where you can reach it without the device that may be compromised.

The sheet should contain, in this sequence:

1. **Primary email provider** — the recovery URL and where your backup codes are stored. This is first because every other reset flows through it.
2. **Telecom operator** — fraud or account-security number, and your account identifier.
3. **Each bank and card issuer** — the official fraud number as printed on the card, not one from a search result, plus the in-app freeze path.
4. **Investment and payment platforms** — support contact and how to lock withdrawals.
5. **Password manager** — recovery method.
6. **Government identity portal**, if one applies to you.

Add two lines of instructions to yourself: secure the inbox first, then freeze money movement, then work outward. And note the reporting route to your bank and, where relevant, to the regulator, so it is a lookup rather than a decision under stress.Source^source

Review the sheet when you change a phone number, a bank, or a job.

A worked example of the chain in motion

Suppose an old shopping site you used years ago is breached. Your email address and a password appear in a dataset.

That password happens to be a variation you also used on your primary inbox. Automated testing finds the match. Someone signs in to your email.

They add a recovery phone number of their own, create a filter that forwards anything containing "verification" and deletes it from your view, then begin resets on the three financial platforms they found by searching "welcome to" in your mailbox. Codes arrive, are forwarded, are deleted. You see nothing.

Now count where the chain could have broken:

• **A unique password on the inbox** ends it at step one.
• **A hardware key or passkey on the inbox** ends it at step one even with the correct password.
• **A separate financial email address** means the mailbox search returns nothing to attack.
• **Bank alerts on contact-detail changes** surface the intrusion before money moves, because "email changed" fires even when "payment sent" has not yet.
• **A Break Glass sheet** turns the response from an hour of frantic searching into a sequence of calls.

Five independent breaks, any one of which is sufficient. That is what layering means in practice, and it is why the order in Tier 1 through Tier 4 is the order it is.

What this does not promise

None of this guarantees safety. A determined, well-resourced attacker targeting you specifically is a different problem from the automated, opportunistic attacks that account for the overwhelming majority of losses, and this article addresses the second. Nothing here is a substitute for your bank's own guidance, nothing here is legal or financial advice, and outcomes on reimbursement depend on jurisdiction, product terms and the circumstances of the loss.

What these steps do is unglamorous and effective. They raise the cost of attacking you above the cost of attacking someone else, they remove the reused-credential shortcut entirely, and they ensure that when something does go wrong, you find out early and already know what to do first.

Start with the map. Then the inbox. Everything else is easier once those two are done.

Source^source: NIST Digital Identity Guidelines (SP 800-63) — https://pages.nist.gov/800-63-3/

Source^source: Central Bank of the UAE — https://www.centralbank.ae

Source^source: European Union Agency for Cybersecurity (ENISA) — https://www.enisa.europa.eu