How to Build Your Family’s Digital Defenses

Cyberfraud is becoming more opportunistic. Although tactics range from simple to elaborate, strengthening your family’s digital safety, and therefore its financial safety, does not have to be complicated.

Most schemes aim to convince victims to take action: reset a password, approve a payment, or wire funds. Many scams also begin with access to sensitive information, making it important to secure accounts and personal identities for yourself and your loved ones. 

For example, access to something as simple as your phone number and information about a friend or family member’s location, collected from public sources and social media accounts, can enable a hoax call that creates urgency, such as a travel emergency. Deepfakes also enable impersonation. These AI-generated recreations of a person’s likeness and speech can make scam communications more persuasive. Timing adds credibility: a tax notice during filing season or a charitable appeal following a disaster can seem logical.

Modern lifestyles make it difficult to eliminate exposure to fraud, but you can deprive perpetrators of information and opportunity. By raising cybersecurity awareness among family members of all ages, you can reduce risk.

We outline four areas to focus on, starting with securing access to your accounts. We suggest working through these areas and actions with your family. Select a section to learn more.

Personal Accounts

Family and Identity

Money Movement

Digital Assets

1. Protect Access to Your Accounts

Think of your personal accounts as the front door to your financial and personal life, and your primary email as the key.

If a criminal gets into your email, they may be able to use it to reset passwords and recover access to other accounts, including those tied to your banking, investments, payments, social media, and digital assets. 

A secure sign-in process can help keep that door locked, protecting your private information and limiting the potential impact of a compromised account. Consider the following steps to strengthen your account security:

Use Passkeys When Available

A passkey is a simpler, more secure alternative to a password. Instead of typing a password or waiting for a security code, you sign in using the same method you may use to unlock a phone, tablet, or computer, such as facial recognition, a fingerprint, or a device PIN. 

A passkey is made for one account and one website or app, so it can’t be used to sign in anywhere else. Designed to resist phishing, passkeys help reduce the risks associated with stolen passwords, password reuse, fake login pages, and fraudulent requests for security codes. 

Your device or a trusted credential manager stores your passkeys. Passkeys often sync securely across personal devices, so they are available when you replace a phone or use another device connected to the same account.

When you approve access to a passkey using your fingerprint or face, the website receives confirmation that your device successfully verified you. It does not store your biometric information.

Creating a Passkey

While the exact steps will vary by provider, creating a passkey generally follows these steps:

• Start with your primary email account and other sensitive accounts.
• Open the provider’s official application or type its website address yourself.
• Sign in and go to Security, Sign-In, Login & Security, or Account Settings.
• Look for Passkeys, Create a Passkey, Add a Passkey, or Passwordless Sign-In.
• Select where the passkey should be saved (your phone, tablet, or computer, your device’s built-in password manager, another trusted password manager, or a physical security key).
• Follow the prompt to unlock your device using your face, fingerprint, or device PIN.
• Sign out and test the passkey.
• Confirm that you still have a secure backup or account recovery method.
• Repeat the process for other important accounts that support passkeys.

Common Examples*

Google

• Open your Google Account.
• Select Security & sign-in.
• Under How you sign in to Google, select Passkeys and security keys.
• Select Create a passkey.
• Unlock your device when prompted.

Google advises creating passkeys only on devices you personally own and use. Anyone who can unlock a device containing your passkey may be able to access the associated account.

Microsoft

• Open your Microsoft account.
• Go to Advanced Security Options.
• Select Add a new way to sign in or verify.
• Select Face, Fingerprint, PIN, or Security Key.
• Follow the instructions and confirm where the passkey will be saved.

On a Windows device, locally saved passkeys can be reviewed by opening Settings, selecting Accounts, and then selecting Passkeys.

Apple Devices

When an Apple-supported website or application offers a passkey:

• Sign in to the account and open its security or account-management settings.
• Select Create a passkey, Save a passkey, or a similarly named option.
• Select Continue.
• Use Face ID, Touch ID, or your device passcode to approve the passkey.

On current Apple devices, passkeys can be reviewed and managed in the Passwords application. Passkeys saved through Apple can be made available on other devices signed in to the same Apple Account.

*The instructions above reflect the setup processes available at the time of writing and may change. Please consult your provider’s official website or support resources for the most current guidance.

Secure Your Passkeys and Be Prepared with Backups 

Passkeys can reduce many of the weaknesses associated with traditional passwords, but the devices and accounts that store them must still be protected. It is equally important to have a secure backup or recovery method in place:

• Create passkeys only on devices you own and control.
• Do not create a passkey directly on a public, borrowed, or shared device.
• Protect your devices with a strong device PIN or passcode, face or fingerprint recognition, and automatic screen locking, and keep software and security updates current.
• Protect the password manager account that synchronizes your passkeys.
• Maintain at least one secure backup or recovery method.
• Review your saved passkeys periodically.
• Remove passkeys associated with lost, stolen, sold, or unused devices.
• Do not scan a QR code or approve a passkey sign-in at the direction of an unexpected caller.
• Contact the provider through its official app or website if you receive an unexpected passkey notification.

Adding a passkey does not always remove an existing password or older recovery method. Continue to protect those alternatives, including your recovery email, phone number, and primary device account.

Use Multifactor Authentication When Passkeys Are Not Available

For many websites and apps, a passkey can replace both the password and the separate security step required during multifactor authentication, depending on how the provider has implemented passkeys. However, not every website or application supports passkeys. 

For accounts that still require passwords, use a unique password for each account and enable multifactor authentication (MFA, also known as two-factor authentication, 2FA, or two-step verification) as it adds another identity check before anyone can sign in. MFA can help your account stay protected, even if your password has already been stolen. That said, not all MFA methods offer the same level of protection:

• Security keys and other phishing-resistant methods tend to be the strongest. A security key is a small physical device you use to confirm that it’s you. 
• Authenticator applications are a strong, practical alternative. These are apps on your phone that generate sign-in codes. 
• Codes sent by text message or call are better than using a password alone, but they are more vulnerable to phishing and phone number takeover attacks. 

To set up MFA:

• Begin with your primary email account, then move on to your other important accounts, including financial, payment, and social media.
• Open the provider’s official application or website.
• Go to Security, Sign-In, or Login Settings.
• Look first for a passkey option.
• When passkeys are not supported, select Multifactor Authentication, Two-Factor Authentication, 2FA, or Two-Step Verification.
• Choose the strongest method available.
• Add at least one secure backup method.
• Download or print recovery codes when offered, and store recovery codes appropriately.
• Sign out and test the new sign-in process.

Protect Your Mobile Phone Number 

Your phone number may be used for security codes or account recovery. Ask your mobile carrier whether it offers an account pin, a number transfer or port-out lock to prevent someone from transferring your phone number to another device or carrier without your permission.  These safeguards can make it more difficult for a criminal to take control of your phone number and intercept security codes.

Exercise Caution When Responding to Sign-in Prompts 

Never approve a sign-in request you did not initiate and never share a security code or password reset code to an unexpected caller — even when the caller claims to represent your bank, technology provider, or fraud department. If you receive an unexpected prompt:

• Deny the request.
• Open the account through its official application or website.
• Review recent sign-ins and devices.
• Change the password if the account still uses one.
• Contact the provider using a number or support method you independently locate.

Return to menu

2. Protect Your Family and Identity

Even when your accounts are secure, criminals may not need to break in. A few personal details found online can be enough for someone to impersonate you or someone you trust.

The practices below can help you and your family confirm who you are communicating with, reduce the risk of impersonation, and control what strangers can learn about you online.

Establish a Family Verification Phrase

A criminal may already know family names, schools, employers, travel plans, or other details found online. Artificial intelligence can also be used to make an urgent call sound like a family member, executive, advisor, or other trusted person. 

A family verification phrase provides an additional safeguard to confirm the person you are talking to is who they say they are. Still, a familiar voice, phone number, email address, or video image should not be treated as proof of identity. We recommend slowing down and contacting the person using a phone number or method you already know.

[H4] Choosing a Phrase 

• Choose at least three unrelated words.
• Avoid words connected to family names, pets, schools, birthdays, addresses, vacation destinations, favorite teams, or information found on social media. 
• Do not reuse a password, PIN, or security question answer.

[H4] Sharing the Phrase Securely

• Share the phrase directly with immediate family members and other trusted people who may receive an emergency request.
• Share it in person or during a call you initiate.
• Avoid placing the phrase in an ordinary family group text or email chain.
• Store it in a secure password manager or another protected location if a written record is needed.
• Change the phrase immediately if it may have been disclosed.
• Review it periodically, especially after major family changes.

[H4] Using the Phrase Appropriately

Agree that the phrase will be required for any unexpected request involving:

• Money or cryptocurrency
• Account access
• Passwords or security codes
• Sensitive personal information
• An emergency involving a family member
• A sudden change in phone number or contact information
• A request for secrecy
• An unusual request supposedly coming from an advisor, attorney, physician, or other trusted professional

When using the agreed-upon phrase:

• Ask the caller or sender to provide the phrase.
• Do not say the phrase first.
• Do not offer clues.
• End the communication, even if the person provides the correct phrase.
• Contact the person using a phone number or method you already trust.
• Confirm the request with another family member when possible.
• Refuse any demand to keep the situation secret.

[H3] Freeze Your Credit Across Bureaus 

Another way criminals use personal details is to apply for credit using your identity. A credit freeze restricts access to your credit report. Because lenders generally review a credit report before opening a new account, a freeze can make it harder for an identity thief to establish new credit in your name.

Credit freezes are free, do not affect your credit score, and remain in place until you lift them. A credit lock, identity protection package, or credit monitoring service may involve a fee or operate differently and should not be confused with a freeze.

A freeze must be placed separately with Equifax, Experian, and TransUnion. Freezing with only one is not enough. A credit freeze helps protect against new account fraud, but it does not prevent someone from misusing an existing account. It remains important to continue reviewing financial statements and account alerts.

[H4] How to Freeze Your Credit

• Directly visit the official website for each credit bureau (Equifax, Experian, and TransUnion).
• Create or sign in to an account with the bureau.
• Find Credit Freeze, Security Freeze, or a similarly named option.
• Verify your identity.
• Place the freeze.
• Save the confirmation and account information securely.
• Repeat the process with the other two bureaus.
• Confirm that all three freezes are active.

[H4] When You Need to Apply for Credit 

A freeze isn’t permanent. If you need to apply for credit, you can lift it for a limited time and restore it afterward:

• Ask the lender which credit bureau it plans to use.
• Sign in directly to that bureau.
• Temporarily lift the freeze.
• Select a limited period when possible.
• Complete the application.
• Confirm that the freeze has been restored afterward.

[H4] Consider a Freeze for Your Child

Parents and guardians can request a credit freeze for a child under age 16. The process requires additional identity and guardianship documentation, but it can help prevent someone from using the child’s identity to establish credit.

[H3] Review Your Social Media Exposure

Social media can provide criminals with the details they need to build a convincing story. Family relationships, travel plans, employers, photographs, hobbies, and birthdays can all be used to support impersonation, fraud, password guessing, or account recovery.

The goal is not necessarily to avoid social media use. It is to make a deliberate decision about what strangers can see about your life. Consider limiting who can see your posts and contacts so scammers have less information to use.

[H4] Review Your Public Profile

Open a private or incognito browser window:

• Search for your full name, email address, phone number, home address, or common usernames.
• Search for immediate family members as well.
• View each social media profile as someone who is not connected to you.
• Note any information that could be used to identify, locate, or impersonate you.

[H4] Evaluate Account Settings

Open the platform’s Privacy, Audience, Visibility, or Security settings and review:

• Who can see your posts
• Who can see your friends or connections
• Who can find you using your email address or phone number
• Who can tag or mention you
• Whether tags require approval
• Who can send direct messages
• Whether search engines can display your profile
• Whether your precise location is shared
• Whether contacts are being uploaded or synchronized
• Which applications have access to the account

[H4] Consider Adjusting Account Information, Including Your:

• Full birth date
• Personal phone numbers and email addresses
• Home address
• Children’s schools and activities
• Detailed family relationships
• Photographs of identification cards, tickets, boarding passes, or financial documents
• Real-time travel plans
• Regular schedules and locations
• Answers commonly used for security questions
• Photographs that reveal access badges, keys, security systems, or sensitive screens

[H4] Additional Best Practices for Secure Social Media Use:

• Post vacation photographs after you return.
• Avoid announcing that a home will be empty.
• Review photographs for documents or information visible in the background.
• Ask family members not to post sensitive information about you without permission.
• Do not accept connection requests simply because the person appears to know someone you know.
• Verify unexpected requests for money outside the platform.
• Treat investment opportunities introduced through social media with caution.
• Delete unused accounts rather than leaving them unattended.

Return to menu

[H2] 3. Protect the Movement of Money

Peer-to-peer (P2P) payment services like Venmo and Zelle make it easy to send and receive money, but once a payment has been sent, it can be hard to recover. This section covers how to use these applications safely, and when a different payment method may be a better option. 

[H3] Using P2P Applications Carefully

Sending money through a payment application is like sending cash. These services are safest when used with people you know and trust.

[H4] Before Sending Money 

• Use P2P payments primarily with friends, family members, and other people you know.
• Confirm an unexpected request outside the application.
• Ask the person to send you a payment request for a first-time recipient.
• Confirm the recipient’s username, phone number, email address, or QR code.
• Send a small test amount before a larger first-time payment.
• Ask the recipient to confirm receipt of the test payment.
• Review the recipient and amount again before selecting send.
• Never send money while an unexpected caller is directing you through the process.

[H4] Secure Your Account

Payment applications are often connected to bank accounts, cards, email addresses, and mobile devices, so securing the account itself is essential. Strong sign-in protections, current recovery information, and privacy settings can help reduce the risk of unauthorized access, mistaken payments, or exposure of personal financial activity.

• Use a passkey when available and keep any account password strong and unique.
• Turn on MFA, sign-in verification, an application PIN, or biometric access.
• Protect the email account connected to the payment service.
• Turn on notifications for payments sent and received, new device sign-ins, password or profile changes, and bank transfers. 
• Consider having a dedicated checking account for P2P apps with money limits
• Review connected bank accounts and payment cards.
• Remove payment methods you no longer use.
• Review remembered or trusted devices.
• Set payment activity to private when the platform supports it.
• Disable unnecessary contact syncing or account discoverability.
• Review the application’s privacy and security settings after major updates.

[H3] Review Venmo Settings 

Set transactions to private. Open Venmo, select Me, then Settings, then Privacy. Set the default privacy level to Private and review the visibility of past transactions. The private setting limits payment information to the participants in the transaction. 

Protect access to the application. Open Settings. Turn on the application passcode or biometric lock. Review remembered devices and remove anything you do not recognize. Confirm that your phone number and email address are current. Venmo states that it will not ask users to provide a six-digit sign-in code by phone, text, email, or chat.

Be cautious about an unexpected payment. If you receive money from someone you don’t know, do not spend it, send it back, or move it out of the application. Contact Venmo support through the official application and block the sender when appropriate. Venmo advises users to contact support rather than independently returning an unexpected payment.

[H3] Review Zelle Practices

Zelle specifically describes its service as a way to send money to friends, family, and others you trust.

• Access Zelle through your bank or credit union’s official application or online banking service.
• Confirm that the recipient’s phone number or email address is the one enrolled with Zelle.
• Review any warning displayed by your financial institution.
• Never send money to yourself at another account because a caller says doing so will protect your funds.
• Contact your financial institution immediately if you believe a payment was unauthorized or fraudulent.

[H4] Limit the Money Exposed 

For applications that hold a stored balance, avoid treating the application like a savings account. Move excess funds to an insured bank or credit union account. Money held in some non-bank payment applications may not receive the same federal deposit insurance protection as money held directly at an insured institution.

Some families choose to link P2P services to a separate checking account used only for routine payments. This can limit exposure if the payment account is compromised. Discuss this option with your financial institution and make sure automatic overdraft transfers are turned off or not linked to your other accounts. Otherwise, money could be pulled in automatically, which counteracts the protection. 

[H4] Avoid Using Ordinary P2P Payments For:

• Goods from an unknown seller
• Event tickets from a stranger
• Rental deposits to an unverified person
• Investments
• Cryptocurrency purchases directed by an unfamiliar person
• Taxes or government fees
• Law enforcement payments
• Requests to move money to “protect” an account
• Payments demanded by an unexpected caller
• Any transaction where the recipient insists that P2P is the only acceptable method

When purchasing goods or services, use a payment method that offers appropriate purchase protections.

Return to menu

[H2] 4. Protect Digital Assets

Like payments made through P2P apps, digital asset transfers often move quickly and can be difficult, or potentially impossible, to reverse. Protecting the keys that control them (whether on your own or with support from a third party), verifying transfers, and being aware of potential scams are critical.

[H3] Understand Who Holds Your Keys

The keys used to access and transfer digital assets are held in one of two ways:

• Custodial account: A provider or custodian, such as a cryptocurrency exchange or financial institution, holds the keys and controls the systems that authorize transfers. You rely on this third-party provider to keep your assets safe. 
• Self-custody: You hold the keys yourself, through a private key or recovery phrase. No one else is involved, meaning you are responsible for securing and recovering your assets. 

[H4] Key Considerations for a Custodial Account

Before selecting or continuing to use a custodian, consider asking:

• How the custodian safeguards private keys
• Whether it uses online, offline, or cold storage
• Who can access customer assets
• Whether a third party provides any part of the custody service
• Whether customer assets are held separately or combined
• Whether the provider may lend or otherwise use customer assets
• What withdrawal protections are available
• How account recovery works
• What happens if the provider fails
• What privacy protections apply
• What fees apply when transferring or closing the account

[H4] Securing a Custodial Account

If, after considering the above, you opt to work with a third party, the following steps can help you secure your account:

• Consider using an email address that is not publicly shared.
• Protect the email account with a passkey, security key, or the strongest MFA the platform supports.
• Use a unique password stored in a trusted password manager if a password is still required.
• Avoid relying only on text message authentication.
• Enable withdrawal address allowlisting when offered.
• Enable a withdrawal lock, approval delay, or waiting period when available.
• Turn on alerts for:
  • Sign-ins
  • New devices
  • Password changes
  • MFA changes
  • New withdrawal addresses and withdrawals
  • Connected applications
  • API activity
• Review active sessions and devices.
• Review connected applications and API keys.
• Remove anything you do not use or recognize.
• Add a PIN and port-out lock to your mobile phone account.
• Bookmark the provider’s official website rather than finding it through a search advertisement.
• Never install remote access software at the direction of an unexpected caller.
• Never move cryptocurrency because someone claims your current account or wallet is unsafe.

[H4] If You Choose Self-Custody

Self-custody means you are responsible for safeguarding and accessing your digital assets. While it may reduce reliance on a third-party provider, it is not inherently safer. Rather, it replaces provider-related risks with personal security and operational responsibilities.

This option is only appropriate if you are comfortable setting up, maintaining, backing up, and recovering your digital assets. For substantial holdings, it may also be worth considering whether professional custody, multiple approval requirements, or another carefully designed arrangement would better support your objectives. Before choosing an approach, coordinate with qualified legal, tax, estate planning, financial, and security professionals.

[H4] Securing a Self-Custody Wallet

• Obtain a hardware wallet directly from the manufacturer or a trusted authorized source.
• Inspect the packaging and device for signs of tampering.
• Initialize the wallet yourself.
• Do not use a device that arrives with a recovery phrase already written, printed, or configured.
• Record the recovery phrase offline.
• Never:
  • Photograph it.
  • Store it in ordinary cloud storage.
  • Email or text it.
  • Place it in a digital contact record.
  • Enter it into an unfamiliar website.
  • Give it to technical support.
  • Provide it to an artificial intelligence assistant or chatbot.
• Store the recovery material in a secure physical location.
• Consider maintaining a second protected backup in a separate controlled location.
• Do not label the backup in a way that advertises what it contains.
• Install wallet software and firmware only through the manufacturer’s official process.
• Before holding a meaningful amount, confirm that you understand the legitimate recovery process.
• Verify transaction information on the hardware wallet’s own screen, not only on a connected computer or phone.

A recovery phrase can restore control of a wallet. Anyone who obtains it may be able to control the assets. Regulators advise investors never to share private keys or recovery phrases.

[H3] Verify Every Cryptocurrency Transfer*

Cryptocurrency addresses are long, and a transfer to the wrong address or network may not be recoverable. Before sending:

• Verify the correct cryptocurrency.
• Confirm the intended recipient through a trusted channel.
• Verify the correct blockchain network.
• Use a saved or preapproved address when possible.
• Compare the destination address carefully.
• Verify the address on the hardware wallet display when using one.
• Send a small test transaction.
• Wait for the recipient to confirm receipt.
• Send the remaining amount only after the test succeeds.
• Never accept a changed wallet address through an unverified email, text message, or direct message.

*This section does not represent a view on whether cryptocurrency is an appropriate investment.

[H3] Be Mindful of Cryptocurrency Scams 

Stop when someone:

• Promises guaranteed or unusually consistent returns.
• Contacts you unexpectedly through social media, a dating site, or text message.
• Claims to have contacted you by mistake and then attempts to develop a relationship.
• Introduces an investment after developing a personal or romantic relationship.
• Directs you to an unfamiliar trading website or application.
• Adds you to an investment group on WhatsApp, Telegram, or another messaging platform.
• Tells you to keep the opportunity secret or not to consult family members or financial professionals.
• Pressures you to act immediately.
• Requires cryptocurrency to resolve a government, tax, legal, or technical problem.
• Sends you to a cryptocurrency kiosk or Bitcoin ATM.
• Requires additional taxes or fees before you can withdraw supposed profits.
• Offers to recover previously lost cryptocurrency for an upfront fee.

Federal authorities warn that cryptocurrency investment fraud frequently begins through unsolicited social media contact, text messages, dating sites, messaging groups, or fake investment platforms. Victims may see convincing but false account balances and then be asked to pay additional fees or taxes when they try to withdraw funds. 

No government agency, bank, investment firm, or law enforcement organization will direct you to a Bitcoin ATM to protect money or resolve an account problem.

[H3] Create a Continuity and Inheritance Plan

Cryptocurrency can become inaccessible when no one else knows that it exists, where it is held, or how it should be handled after the owner’s death or incapacity. Work with appropriate tax, estate planning, financial, and security professionals to document:

• What assets exist
• Whether each asset is held by a custodian or in self-custody
• Where trusted instructions can be found
• Who is authorized to act
• How access can be provided when legally appropriate
• How the owner’s identity and death or incapacity will be verified
• How the plan will be updated after a wallet, provider, or account changes

Do not place a private key or recovery phrase in an ordinary email, shared document, or unprotected record. Separate the inventory and instructions from the information that directly unlocks the assets.

Digital assets can create unique security and continuity risks. Before holding or transferring them, understand who controls access, how recovery works, how transfers will be verified, and who can act if the owner becomes unable to do so.

Return to menu

[H2] Developing Consistent Cybersecurity Practices

Protecting your family from fraud begins with a series of small steps. The protections outlined in this guide should not be a one-time exercise. Revisit them periodically, particularly as your family, accounts, and circumstances change, and consider how they fit into your broader cybersecurity strategy.

As always, remember to pause and verify through a channel you trust before acting on an unexpected request. Your Bessemer advisor can help you identify which steps are most relevant to you.