I recently received three questions with similar themes, albeit distinct topics:
- “Do you think it’s wise to split assets between different brokerage firms? Having everything at one is more convenient, but I wonder if having some fraud/cyber diversification between custodians outweighs the convenience.”
- “I have heard people suggest using one email account for most things and a second email account that is used for nothing other than bank and brokerage accounts. Do you think that would meaningfully improve security?”
- “A family member suggested having a completely separate computer, which is used ONLY to log into financial accounts. Is that a good idea?”
Broadly, I’d describe all three of these things as reasonable practices to adopt. Each of these three practices, if implemented well, would reduce risk by some degree. But I don’t think any of these three practices is mandatory, nor would I put them at the top of my list in terms of things people should be doing.
Using Multiple Brokerage Firms
Yes, spreading your money out across multiple brokerage firms does limit the potential harm if a thief is able to access one of your accounts and the brokerage firm’s reimbursement policy does not make you whole.
However, “the thief only stole half of our money” is still an absolute disaster scenario for most households. And having accounts at multiple brokerage firms increases what cybersecurity experts refer to as the “attack surface.” That is, it increases the number of possible ways in which a bad guy could carry out an attack. The more brokerage firms you use, the more accounts you need to keep secure.
The most critical risk-reduction tools are security practices that help keep the accounts secure, rather than diversifying across multiple firms.
Separate from fraud, one point that I do think is worth considering is the “a technical glitch has temporarily locked me out of my account” scenario. In our household, even with only a single brokerage firm, that wouldn’t really be a problem. We don’t use our brokerage firm for banking purposes. We have a bank account with BankA, a credit card with BankB, and a second credit card with BankC, which collectively could be used to satisfy spending for quite a while. But for people who, for example, use a single brokerage firm and use that brokerage firm as their bank account as well, being locked out for even a matter of days could be a big issue.
Using a Designated Financial-Accounts-Only Email Address
Having a separate email account for the “financial stuff” has a few potential benefits:
- It reduces the ramifications in the event that your “normal” (i.e., non-financial) email account is someday accessed by a malicious party.
- It can make phishing emails easier to spot. For example, if an email from “Vanguard” ever shows up in your non-financial email inbox, it should immediately be treated as suspicious.
- Many companies use your email address as the username, so if you use your most critical email address in fewer places, it’s less likely that any thieves will be aware of it.
As above though, you now have multiple accounts that you need to keep secure.
Having separate email accounts also creates some degree of hassle, in that you now need to separately check two email accounts. (And if you try to circumvent this hassle by having the financial-only email account forwarded to your main email account, you’ve substantially undermined the security benefit, because somebody who gains access to your main email account would then also have access to the financial emails being forwarded there.)
Another way in which you could accidentally eliminate much of the security benefit from having separate email accounts would be to list your main email account as a recovery option for the financial email account. In such a case, an attacker with access to your main email account might be able to get into your financial email account by using its “forgot my password” process, which would send a link to your main email account.
So again it’s a situation in which there is some additional protection to be offered, but that protection comes at the cost of convenience, and you now have more accounts to secure. (And it’s possible, if poorly set up, to not really achieve any additional protection via having that separate email account.)
And again, the most critical protections are the things that keep your email account(s) secure in the first place, rather than having additional accounts. For instance:
- If you use gmail, look into their Advanced Protection Program.
- If you use Apple, look into the Security Keys for Apple Account setting.
- On your mobile device, use the “Require Face ID” feature (or your device’s equivalent) to lock your email app, rather than allowing anyone with access to your unlocked phone to open it.
Using a Designated Finance-Only Computer
The idea of having a separate device that is used only to log into financial accounts is again damage mitigation. It makes it a less-bad situation if you somehow end up with malware on your “main” (non-financial) device.
Of course there’s some degree of financial cost, in that you need to own an additional device at all times. (And it’s critical that the finance-only device be current, rather than one that has reached end-of-life status.)
And you now have an additional device that you have to make sure is kept secure, up to date, etc. (Also, if you only turn this computer on every few weeks, for instance, it’s likely to be out of date as soon as you power it up. So it would be important to follow a rule of turning it on and then checking for updates immediately, before logging into anything.)
In addition, the security benefit from having a separate finance-only device could be undermined somewhat if you use the same cloud accounts for both devices.
And once again, the most critical things you can do are security practices that make it less likely that you end up with malware on your device in the first place, rather than practices that make it less bad in the event that you do end up with malware. For example:
- Keep your OS and browser up to date.
- Create a non-administrator user account for day-to-day use.
- Only install software via reputable sources and only when the developer shown is a trusted party. (Ditto for browser extensions.)
What is the Best Age to Claim Social Security?
Read the answers to this question and several other Social Security questions in my latest book:
 | Social Security Made Simple: Social Security Retirement Benefits and Related Planning Topics Explained in 100 Pages or Less |
Disclaimer:Your subscription to this blog does not create a CPA-client or other professional services relationship between you and Michael Piper or between you and Simple Subjects, LLC. By subscribing, you explicitly agree not to hold Michael Piper or Simple Subjects, LLC liable in any way for damages arising from decisions you make based on the information available herein. Neither Michael Piper nor Simple Subjects, LLC makes any warranty as to the accuracy of any information contained in this communication. The information contained herein is for informational and entertainment purposes only and does not constitute financial advice. On financial matters for which assistance is needed, I strongly urge you to meet with a professional advisor who (unlike me) has a professional relationship with you and who (again, unlike me) knows the relevant details of your situation.
You may unsubscribe at any time by clicking the link at the bottom of this email (or by removing this RSS feed from your feed reader if you have subscribed via a feed reader).
