Portfolio managers emphasize sound investment strategies to help grow retirement savings. For DIY investors, though, investment security has become just as important as diversified holdings, asset allocations and long-term growth.
Today, anyone with a computer or smartphone can manage their retirement savings. Nearly every type of 401(k), 403(b) and IRA account is accessible online. That makes it easy for plan holders to rebalance funds, adjust contributions or request withdrawals. Unfortunately, online accounts also are a target for cybercriminals looking to cash in on someone else’s hard work.
“Having a compromised email account is a nightmare,” says John Joyce, CEO of CRS Technology Consultants. “Losing your retirement? That’s life-changing.”
John was recently a featured guest on Gulf Coast News for a Tech Bytes segment addressing investment security. News anchor Alex Howard prefaced the TV segment by noting “the biggest risk being your own investor is actually not the strategy… it’s the security of your account.”
The TV segment, titled “DIY investing: Security risks and how to protect your retirement savings,” explained DIY investing and offered tips to protect online retirement accounts.
What is DIY investing?
For generations, individuals relied on investment advisors and portfolio managers to oversee retirement planning. These highly trained, credentialed professionals are experts in financial strategy, risk management, tax liabilities and market conditions. In many cases, the amount of one’s nest egg determines when, or if, someone can afford to retire.
“Everyone wants to stretch those dollars as far as they can go,” John says. “Professional investment advisors and portfolio managers know what they’re doing, and that’s a good thing… but they aren’t free. Their expertise comes at a cost.”
When investment firms established online portals, many account holders began taking a more active role in their finances. Today, top providers like Fidelity, Vanguard, Charles Schwab, Principal and Empower still offer one-on-one counseling with trusted advisors. However, savvy investors can essentially cut out the middleman and manage their own retirement savings. Providers offer multiple investment options and are transparent with the performance of stocks, bonds and mutual funds. Investors can track historical performance of each holding, moving funds based on trends, projections and gut feelings.
What are the risks of DIY investing?
Wealth managers and financial advisors regularly acknowledge that every investment is a risk. Digital security, though, may be a bigger risk.
“With these self-use tools, you can take your dollars and try to turn them into more, which sounds great, except you don’t necessarily have all the same resources as those large investment companies to protect those assets,” John warns.
He’s referring to digital security. Much like a brick-and-mortar bank has impact-resistant windows, an alarm system and a steel vault to protect cash and valuables, wealth management companies have top-of-the-line firewalls, antivirus programs, encryption software and teams of IT specialists to ensure the digital vault is sealed. Individuals who access their retirement accounts via a web browser or smartphone app lack those security features.
Investment management companies are hyper-focused on digital security to protect customer data. An investment firm’s IT team could consist of network engineers, security analysts, incident response experts and web developers.
Many businesses offer company-sponsored retirement plans and match employees’ contributions, but essentially outsource retirement planning to third-party firms. Still, businesses can help safeguard employees’ financial futures through education. Circulating tips such as those listed below provide valuable insight as employees manage their financial futures.
Focusing on investment security
Businesses can establish monthly or quarterly “tech talks” or “tech tips” for their employees. These informal educational sessions can offer tips for employees to safeguard their retirement savings.
Rule No. 1 – encourage employees to avoid using their work computer for personal use, including banking and investments. Hackers are continuously targeting businesses, so keeping personal accounts off company hardware is a great preventative measure.
John also advises businesses to include these two considerations when broaching the topic of employees’ personal account security:
Where you log on:
- Do not use public Wi-Fi at coffee shops, airports, libraries or shopping malls.
- Only use a secure connection at home.
- John’s advice: “Always use your own computer. You want to make sure it’s a protected device that has the right security measures in place.”
How you log on:
- It should never be as easy as entering your username and password.
- If it’s easy for you to get in, it’s easy for cybercriminals to get in.
- John’s advice: “You should never be able to just put in a password and access your money. Things like multi-factor authentication and biometrics, and all these steps can be used to protect you and protect your dollars.”
Recently, there has been a surge of cyberattacks, but these are different. Hackers are no longer just going after usernames and passwords for online accounts, and this is becoming a major concern for businesses.
“Rather than attack accounts on the cloud, they’re going old school,” John says. “They’re going for your device.”
Why?
“Your device is already trusted. It has all your passwords saved in it. It’s just a few clicks away from your dollars. Protecting that device is suddenly just as important as anything else.”
Called “RAT” attacks, McAfee offers this explanation:
“A Remote Administration Tool (RAT) is a type of software that allows a user to control a computer system from a remote location. This can be an incredibly useful tool for IT professionals who need to solve technical issues on remote servers or for individuals who want to access their home computers while they are away. However, in the wrong hands, a RAT can become a formidable weapon. Cybercriminals use RATs to gain access to and control over unsuspecting users’ computers. This can lead to theft of personal information, disruption of user activities, and even large-scale cyber-attacks. It’s important to understand the potential threats posed by RATs, as well as how to protect yourself and your computer from being exploited through these tools.”
To enhance investment security, John offers the following advice:
- Only use your own personal device, not a shared device or computer at the library or work. Businesses should remind employees that work computers are for work, not personal use.
- Install and activate a VPN. This hides your data even if it’s exposed.
- Type URLs of financial management companies directly into the address bar. Online searches could display an imposter site.
- Double-check the address bar to make sure it’s secure, usually indicated with “https” or a lock symbol.
- Use a strong, complex password, not just the minimum requirement of having a combination of letters, a numeral and a special character.
- Enable multi-factor authentication. This can include text confirmation or facial recognition to verify identity.
- Ignore emails or texts that say your account needs to be verified or has been compromised. This is an ongoing scam. Only change passwords by logging directly into a website.
Following these steps does not guarantee a hacker won’t gain access. The key, however, is to minimize the risks. John equates it to a business locking its front door. Burglars could still pick the lock or break a window, but you’ve made it more difficult to enter. Cybercriminals are looking for the easiest way to steal data, including money. The more difficult you’ve made it, the more likely they’ll look elsewhere.
LISTEN: Solid State Podcast
