Cybersecurity Fireside Chat: Practical Steps to Help Protect Your Information

A transcript of the discussion is provided for convenience and has been edited to correct transcription errors and improve readability.

Tanya Walliser

All right. Good afternoon, everybody, and thank you for joining us today on our webinar on cybersecurity. For those who don’t know me, I’m Tanya Walliser. I’m a partner and Senior Financial Advisor here at Condor. I’m joined today by my colleague Michael Cuozzo, a financial advisor here at Condor as well.

And we’re pleased to have two special guests from Schwab with us today, Jeff Rubin and Paul Ewing, who bring extensive experience helping investors, financial institutions, and individuals navigate the ever-evolving cybersecurity landscape.

As technology becomes more integrated into our daily lives and finances, understanding today’s threats and learning practical ways to protect ourselves has never been more important.

On behalf of all of us at Condor Capital, thank you for taking the time to be here today.

We appreciate your interest in this important topic, and we’re excited to learn from Jeff and Paul today. So Jeff and Paul, thank you for joining us.

And the floor is yours. Paul, why don’t you tell us about yourself?

Paul Ewing

Yeah, thanks.

Jeff and I are really happy to be here.

So Paul Ewing, I’m based in Minneapolis.

I’ve been in the industry for 30 years now, have been working with advisors for about 19 years, and probably in the last 10 years, lots of cybersecurity.

So, lots of experience, and actually, this is a favorite topic of mine.

Jeff?

Jeff Rubin

Yeah, no, it’s a pleasure to be here.

Thank you, Tanya, Michael, and all of Condor. We get so many benefits out of technology.

Most of us have one of these things, and we are on a webcast right now.

But the flip side of that coin is securing yourself and cybersecurity.

So it’s a really important topic, and my goal today is to have everyone in attendance come away with at least one, two, maybe three things that you can activate in your life going forward to make you feel and be more secure online.

And by way of introduction, I’ve been at Schwab for about three years, but I’ve been in the industry for about 15 now.

And just like Paul, I’m excited to talk cybersecurity with you all.

Michael Cuozzo

Awesome.

Well, thank you guys so much for joining us.

We’ve got a lot of great questions that viewers submitted ahead of time and a couple of themes that we’ll hit on today.

So I’m sure a lot of these questions will get answered, even if we don’t address them specifically.

One thing I want to start with is email, which is one of the things we talked about leading up to this webinar.

We hear that email is one of the biggest cyber threats. We get phishing emails, phishing links, and suspicious attachments.

Paul, maybe you can tee this up. Can you explain a little bit about why that is and what we can do to better protect ourselves email-wise?

Paul Ewing

Great question, great place to start.

Thanks, Michael.

I will.

I’ll double down on the Q&A box.

If you have a question about anything we’re talking about today, there is a Q&A box in the Zoom console here.

So please drop that question in there and we’ll make sure we can get to it.

But email. We call it Public Enemy Number One. It is really the easiest attack vector that exists for bad actors and fraudsters.

And so that’s why we think of email as Public Enemy Number One.

It’s so prevalent, everyone has it, and it’s a very easy way for bad actors to gain access to us.

And Michael, you mentioned, you know, phishing emails and emails that are hitting your inbox.

By definition, a phishing email is an email sent by a fraudster who is trying to get you to react to it.

A lot of times those emails are invoking some amount of urgency.

They may be tied to current events.

It may be email that’s related to the holidays.

Nonetheless, the email is sent so that it provokes you into engaging with it.

By engaging with that email, a lot of times, it contains a fraudulent link that takes you somewhere you shouldn’t go, or it may be asking you to give up some information or to log in.

It may also have an attachment that looks familiar.

Maybe it’s a file extension you’re unfamiliar with.

But it has something in there that the content of that email is going to say “open this attachment” or “click on this”, “click on this attachment”.

So it’s all about the act of engagement and that phishing email, like I said, is it’s easy to deploy, it’s easy for them to send, and now in the age of AI, it’s very convincing.

They look exactly like a legitimate email sometimes.

The days of the broken English and being able to spot those right away are gone.

And so what that email is going to look like is it’s going to look good.

And so that puts you in a position where you need to be looking for what’s not right about this.

And some of the easy tells are just the email address that it’s coming from.

If you hover over with your mouse or with your finger, look at the sender. They can make it look like it’s coming from anybody, but once you hover over the email address, it will show what’s the URL, where this is actually coming from. Does it actually reconcile with what the subject of that email is?

Is it a familiar URL, or is it something you do not recognize?

So that’s one of the tells on the links that may be embedded in that email.

Again, hover over those hyperlinks.

It will tell you where it’s going to send you or show you where it’s going to send you.

If it doesn’t make sense, if it’s really long, if it doesn’t match the URL, it’s probably not taking you to a legitimate site.

A lot of times too, they’ll be a phone number.

“Hey, give us a call.”

“Reach out.”

Never call off of an email suggestion.

If you are curious or want to investigate further—let’s say it’s from your bank, and it has a phone number in there. Don’t use that phone number.

Use the phone number you have, or you know, or on the back of your credit card.

There’s a lot of times those phone numbers are taking you just to a call center, and of course, a fraudster is going to want to connect with you and create some urgency and ask for information and for you to give up something personal or identifiable.

So that’s the reason email is, you know, it’s so easy, everyone has it, and there’s a lot that we need to be paying attention to on email.

Jeff, what else would you add there?

Jeff Rubin

Yeah, I would just say that I love treating all email as guilty until proven innocent.

It is Public Enemy Number One. By and large, we all have emails, and many of us have gravitated toward free services such as the Yahoos and Gmails of the world that, by default, don’t come with a lot of security set up.

So taking some time to actually dig into the security parameters and permissions that you can set up behind the scenes in your instance of your email is worth spending some time because that is all available to you today.

And if it’s not something you’ve taken a peek behind the curtain at yet, definitely encourage you to do so.

But again, Public Enemy Number One.

Paul Ewing

Yeah, there’s some other things too that, you know, with our email, it was, you know, we go back to the beginning of email.

It was never designed to be secure.

So, and if you had the same email address for years and years, I know I’m guilty of that.

You probably had it at a period of time where you thought it was safe, and it was secure.

And what that means is you’ve probably got some good stuff in that inbox that the bad guys would love to have.

Maybe you can put this into the one action to do after this webinar is do a little email hygiene in your inbox. What I mean by that is, maybe it’s a deleting of your Sent folder, maybe it’s a research of old documents that are a part of that inbox, or maybe a folder or filing system you have.

Ultimately, if a fraudster gains access to your email box, what they’re looking for is information about you: sensitive information, documents that have signatures, you know, all of this information that historically you might have sent back and forth via email in years past.

Unless you’ve done some cleanup, it’s still in your inbox.

And so the bad guys are looking for that information and if they do gain access to that email box, that’s exactly what they’re going to be looking for and they’re going to take it and they’re going to use it against you.

And to just to piggyback on that a little bit, something else that bad actors we find do at times, they can gain access to your email and then they can just sit dormant.

If they don’t initially find some big-ticket piece of data that they’re looking for, like a Social Security number, a bank account number, whatever it is, they can just continue to retain that access to your email and until a transaction or something comes up that they want to get their hands on or hands involved in.

So we do see that happen a lot.

And if you had logged in with your email to an old computer or a public computer at some point in time and you’re still logged in there and they still have access, well, they might just be waiting until that real estate transaction comes through your email and you’re going back and forth with a real estate agent or with your bank.

And so it’s important to be cognizant of that time horizon in which they could be engaged in your email for.

Tanya Walliser

That’s interesting, Jeff, because, you know, that brings into the question, it’s not just your email inbox, it’s the inbox of the person you sent that information to that’s also storing that information and those signatures.

And I guess on that topic, you know, at Condor, we have a secure portal for our clients.

Is that something you would more recommend for communicating that kind of stuff?

Jeff Rubin

Yes. I would absolutely encourage the use of your secure portal.

By definition it’s encrypted already.

So that’s definitely a secure way to be uploading your tax files or your statements or conversing with your advisors.

Definitely one of the ways I’d encourage securing yourself is communicating in that fashion as opposed to attaching it as a part of an email and sending it to your advisor.

Would not recommend that route.

Paul, anything else on that one?

Paul Ewing

No, I was just going to say that I’m glad you brought up the portals.

Because we need to have in this age of, you know, digital transactions, we need to have a way to communicate securely.

As Jeff said, sending it and attaching it to an email, even if you password protect it, that’s not secure. There are tools out there that can brute-force or break those documents and break the passwords easily.

Using the portal is the best and most secure way to transmit sensitive information like that.

Michael Cuozzo

Yeah, definitely.

And good point.

And that’s, you know, definitely why we, you know, always encourage that, whether it be with us, your accountant, your attorney, what have you.

You know, obviously, our clients have a username and password to their portal.

They all have to use two-factor authentication to get into our portal.

So maybe like along those lines, you know, maybe we want to talk about passwords a little bit and how our clients can kind of protect themselves with their passwords, right?

A lot of us, myself included—we’re guilty of putting passwords in the Notes app on their phone.

Or maybe using the same password in multiple places, right?

And you might even get an email from Google saying, “Hey, your password was found in a security breach,” or something like that.

Paul, maybe you could touch on some best practices for the listeners out there when it comes to passwords?

We got some questions as well about, you know, our password managers, something that you want to be using.

Maybe you can shed some light on those things.

Paul Ewing

Yes, certainly. This is another one of my favorite topics.

So passwords are, you know, by definition a username and a password.

Traditionally—and this was guidance given by the National Institute of Standards and Technology; this was years ago—I think you all remember the “hey, let’s have at least an 8-character password.”

Let’s make sure it’s got, you know, capitals and numbers and symbols, and then that was going to be secure.

And then, you know, maybe you change that password every 60 or 90 days.

And so what we all ended up doing was we’d come up with a really complex password, right?

And we’d use that over and over again.

So, you know, just as you said, Michael, use it on the same site or different sites, but the same password.

And then when that 90 days hits, well, I’ll just put a number at the end or a symbol at the end and the root of the password will still stay the same.

Guidance around managing passwords has definitely changed.

It has evolved, and the guidance now is that a longer password is best and trumps even a complex password.

So an 8-character password, even with complexities, there’s technology out there that can brute-force break those passwords in a matter of seconds.

As you take the length of that password out longer and longer, the technology generally takes much longer to crack it.

And so as you’re getting out to 15 and 20 characters long, that’s where you want to be.

And it should be a completely random password.

And as I’m saying this, you’re probably thinking, “Well, how the heck am I going to remember all these passwords?”

And which is true, it can be a challenge.

This is where technology can help us, that being a password manager.

And so as you think about what a password manager is, this is simply a technology that—again, we suggest that you pay for this technology.

Don’t sign up for the free versions where it’s going to keep track of your usernames and passwords for all of the different sites that you visit.

And it will help create those long passwords for those sites, the random long passwords.

Once you’ve got your livelihood of passwords all loaded into this technology, now you only need to remember one password, and that’s your master password.

So again, make that one even longer if you can, but you only have to remember the one.

There are some strategies around passwords where, if you’re not going to use technology, there’s a strategy called passphrase.

You can combine random words or create a sentence that makes sense to you but not to someone else.

And that could be a way to manage a password, you know, outside of using technology.

Don’t use your Notes [app], don’t create a file in Excel file, even if you’re password protecting it and naming it something crazy.

Not recommended.

I pick on my mom all the time on this topic because she has a little black book that she bought at a Hallmark store.

And that’s where she’s got all of her passwords.

And you know, I give her a hard time about that.

But I will tell you we have on 2 occasions have tried to set her up on a password manager and we’ve struggled for a long time.

Eventually I was like, ‘Okay, Mom, your black book will have to work for now.’

But me saying that in recommending or suggesting that you use a password manager, it’s effort to get it set up and you know it takes a little bit of time and you know, I probably have like over 300 passwords in my password manager.

You guys, you know, individually might have something similar.

As you set it up, start with the most sensitive and important passwords.

Your banks, financial institutions, social media sites, your personal email passwords. Those are high-value targets, and their passwords should be the most secure.

Having a unique password for every login is important. But certainly work your way into it, and over time, the password manager will take care of those passwords for you and hopefully make managing those passwords much easier.

Now we always get the question of which password manager should we use?

I’ll tell you which ones I’ve used, but there are also ways to find out which password managers to consider.

I personally use 1Password, spelled with the numeral 1. I’ve also used Dashlane in the past.

Those are both I feel great password managers.

If you’re looking for a new or replacement password manager, a quick internet search for best password manager of 2026 well-reviewed will usually surface a number of articles.

CNET and PCMag are publications that always produce an annual best-of list.

Look at the look at the best ones, the top ones that are highly rated, and ones that like I mentioned before, you’re going to pay for.

And this, is as I mentioned, paying for this service.

That paying service usually gets you access to more passwords to save but also the ability to save more passwords and sync them across multiple devices.

So you may have access to your password manager on your computer and on a mobile device or maybe on your iPad, you can set it up in all three different places.

And as you change those passwords, they all sync back to the cloud and essentially that’s what you’re paying for.

And then ultimately you’re paying for security of that service.

And so, you know, a couple bucks a month is definitely worth it.

And some of these providers as well have next-of-kin type services.

So if you pass away, what happens to all your passwords?

You can direct who has access and when they have access.

I like 1Password because it has a really good family plan.

And so all my kids have access to their own security vaults, and then we can share some passwords if we need to.

And I really like that feature.

And some of these will also add like dark web searches and VPN access.

So, you know, a lot of times they package this all up to make it more appealing.

But when you’re paying for it, you’re getting those extra services.

Jeff Rubin

The big thing with this is that, if you are not using one today, it’s a change in how your workflow on the internet is. The change from your current state to migrating to that password manager—there’s a little bit of uplift to get it set up. But once you have it and are using it, it is not difficult to use.

It generally appears as a plug-in on your internet browser, whether that’s Edge, Chrome, or whatever you’re using.

You can typically click on it in your browser, and you’ll be able to launch into whatever website, and these managers will populate username and password, and you’ll be able to just go right in.

It can be a quicker, more efficient, and more secure experience than keeping them in an Excel document or on a sticky note on your computer.

Tanya Walliser

Awesome, thank you guys.

We have a question here from someone.

Is there a secure email service that you would recommend?

I know you talked about the free ones like Yahoo and Gmail.

I’m now being asked whether there is a secure email service one you would recommend.

Paul Ewing

Not really. Like I said, email was never designed to be secure, and the only way that email is truly secure is when it is encrypted end to end.

And so that means you’re now dependent on the recipient also having that encryption capability.

And that’s really the hardest part to manage of a secure email, the encryption.

And the way that would work is you’d have to configure your email to the recipient.

And then there is a key that would secure the handshake between the sender and the receiver.

So there’s really not one that I would suggest or recommend.

I’d suggest use a portal if you need to send something sensitive.

Jeff Rubin

Yeah, and that’s why it’s important to be layering on these additional security measures like a password manager, like enabling two-factor authentication, right, to validate not only your experience, but also kind of where you’re sending it out to as well.

Michael Cuozzo

One thing I was going to say, and Jeff, you touched on two-factor authentication. Portals and password managers like 1Password are going to require two-factor authentication.

Someone in the chat mentioned that their password manager requires them to re-enter their password every few weeks.

We’ve heard this from a lot of our clients that it’s kind of a pain to do like the two-factor authentication, but you know, I’m sure there’s good reason behind that as well.

Can you talk a little bit to that and maybe any like vulnerabilities there might be in the two-factor authentication?

Jeff Rubin

Yeah, I mean I really suggest turning on two-factor authentication wherever possible.

It’s just an additional security layer that’s going to again, identify you as that individual trying to access your email or wherever you’re logging into.

And it’s there for your security.

It can serve an annoyance at times, but ultimately it is trying to protect you.

Paul Ewing

And I have those frustrations as well.

You have to update it every couple of weeks.

And really that is just for you, for your computer or your device to actually gain access to the password manager.

So it will typically recognize that you’re on a login page and you can click on the username and password and there’s usually a little box that says turn on my password manager.

All it’s enabling is it’s refreshing the password so that it can access it easier.

But you know, some of the two-factor could be a face or a fingerprint, you know, that’s a biometric second factor.

You know, I think we get a lot of the push notifications on an app that might be a way for a login to occur that certainly happens with Schwab Alliance.

You can use that as a mechanism to authenticate a login.

Also, the logging in of your social media, there’s at times, if a bad actor has your username and password, you will get that notification.

Or maybe you’ll get a text message.

And there’s an attack strategy of just peppering you with those second factors until you’ve had enough of it and fatigue sets in.

And then you either give up that information or you hit the notification and say, yes, make this stop.

If you are getting a bunch of notifications like that for second-factor or PIN, know that someone has your username and password and is hoping you give it up or give in.

That is an indication that you should change the password for that login right away because someone has got those credentials.

And one other thing is that, yes, these can serve as an annoyance at times, but what I would be thinking about is if I’m interacting with my bank or another vendor that’s kind of not prompting me or doesn’t have that enabled in some capacity, that’s kind of a red flag is to, hey, what’s really going on with their security?

Well, why don’t they have something that I’m interacting with?

Tanya Walliser

Yeah, I know we actually have a question about Schwab specifically, but you know, Schwab uses voice recognition when you call in. With AI out there being able to duplicate voices, you know, can you talk to Schwab’s ability to kind of verify clients in the same day and age?

Paul Ewing

Yeah, absolutely.

At Schwab, ‘My Voice Is My Password’.

So that is that’s been a way to gain access to your accounts for quite a few years now.

And in this age of AI where voices are cloned and deepfakes are created with your voice, we get this question all the time.

There’s some concern, right?

Because my voice is out there.

If someone has a copy of my voice or me saying something, they can certainly create that login.

I will reassure everyone that, to my knowledge, we have not had a breach involving clients accessing their accounts through their voice.

Just know that that’s not the only metric that we are tracking when you’re logging in with your voice.

So there’s a bunch of other things that are happening behind the scenes, whether it’s where you’re logging in from or how you’re logging in from and patterns and everything else that goes into it.

It is not just a single copy of your voice or you saying, ‘At Schwab, my voice is my password.’

There’s a whole bunch of other things going on behind the scenes.

Hopefully, that helps you feel more comfortable using that.

I will also say, I think I saw this is in the questions.

What are some other ways to protect my access?

Certainly, you can create a word as your password for if you wanted to call in to Schwab Alliance.

I will caution that if you do not remember the verbal password was to unlock your account, you may have to come in to a branch and present ID to unlock that. It’s certainly a great way to add another layer of protection.

But if you forget the word, you’re going to have to come in and validate who you are before we unlock your account.

Jeff Rubin

And on the AI topic, one thing I’ll just note is that yes, it can seem like it is so prevalent and so new, but Paul and I both receive monthly emails about all the different frauds and scams that are happening.

And what is still landing and hitting people 95 plus percent of the time is what’s happening in email and things of that nature.

It’s a tiny fraction where AI is really the conduit by which a bad actor is gaining that access and tricking a client.

Jeff Rubin

Yeah.

And really think of AI as just an enabler into the attacks that we see all the time.

They’re just making them that much better, that much more sophisticated.

But it’s still old school, it’s still through email.

It’s the low-hanging fruit.

It’s the easy targets.

It’s just now a lot more convincing because you’ve got AI sitting there making it look that much better.

Tanya Walliser

Awesome.

One thing that you know, talking about email being Public Enemy Number One, you know, I know that Schwab, every time you open an account, you buy and sell security, you get a prospectus, there’s something in the mail.

So can we talk about paper statements and mail fraud a little bit?

Paul Ewing

Oh, sure.

Yeah, it’s not very sophisticated, but it happens all the time.

If I were to rank the types of fraud that we see at Schwab, it’s in the top four, mail fraud.

A lot of times, it’s a check in the mail or the mailbox that gets stolen, washed, and then re-submitted or re-presented. Maybe the payee has changed or the dollar amount has changed.

But usually, at least in the past years, it was your tax payments that went with a paper check.

That is only noticed when you get a letter from the IRS saying, hey, you owe and where is it?

And then you go back and do a little investigation to find that, oh, this check, it did clear, but it didn’t pay to the IRS.

It paid somewhere else.

And now not only have you lost the money out of your account, but now you’re also getting penalties and, and what not from the IRS.

That we see quite often.

So the best advice there is, you know, take it to the post office.

I bring it into the building and put it into the chute.

I know it’s easy just to drive up and drop it in the blue box, but…

Jeff and I were on a call a couple of years back where we had someone from the U.S. Postal Service, and they were telling us how frequently the little skeleton keys get stolen from our postal carriers.

And you know, they’re going after those keys and they’re breaking into the post boxes and stealing what’s inside.

They’re looking for what looks like payments for bills.

I feel like I’m picking on my mom again.

Birthday cards.

My mom would always send some money to my kids in their birthday cards.

One year, you know, no cards came and we still never got it.

And there was I think a $100 bill in there.

So, you know, they’re looking for checks and cash and it’s so low-tech, but it happens more frequently than you can imagine.

Jeff Rubin

Even though we’re talking about all this cybercrime is happening on this side, it’s still more secure to be going through Schwab Alliance, sending a wire, as opposed to dropping a check in the mail at the end of the day.

Be erring on the side of using technology and doing it in a safe fashion.

Michael Cuozzo

Awesome.

Yeah, I got a couple more questions here.

Let’s see.

Oh, this is an interesting one actually.

Just to hop back to email real quick, somebody said I’m receiving emails that look like legitimate inquiries, but when I respond, the sender email is invalid.

What’s the purpose of seeking that reply?

You guys familiar with that?

Paul Ewing

I’ve never heard that, but it’s definitely suspicious.

What I would suggest is, well, first of all, there’s no way to stop these emails.

But if you wanted to cut it down a little bit, one way to do it would be marking them as junk or moving them to a junk folder.

Over time, typically your mail systems learn that, oh, anything from this sender, just send it straight to junk.

I’m not familiar with, you know, if you can’t reply to it, then what… Other than there might be a link or an attachment that’s a part of that email that they’re hoping that you’re going to engage with.

But that would be what I suspect because it doesn’t really matter if you’re replying back.

However, if you do reply back, all that’s doing is alerting whoever sent that, that this is a live email box.

It’s a good one.

Someone’s paying attention to it.

And this is now…you’re going to be a target. And you’re going to get even more emails because they know that someone’s in that mailbox and paying attention and engaging.

So you’re going to be a target for that.

Another thing that you should be aware of is unsubscribing. So, “hey, there’s an unsubscribe to this email, I’ll unsubscribe.”

Well, a lot of times that unsubscribe, you have to give up some information.

You may have to reconfirm your email address. Also, it’s now alerting the sender of that email that this is a live one, this is a good inbox.

So you’ll be targeted more that way.

So again, rather than unsubscribing, just move it to junk. Hopefully, it will slow down, and you won’t get much after that.

Michael Cuozzo

Awesome.

Tanya Walliser

We have a bunch of questions coming through about the safety of online transfer payment systems like Zelle, Venmo, PayPal.

What are your thoughts on those? Jeff?

Jeff Rubin

Yeah, go ahead.

Paul Ewing

I’ll go on this one.

So yes, they are more secure than what we were talking about with sending a check in the mail.

However, you actually want to know and be paying attention to who you’re sending those transactions to.

So I use Zelle, I use Venmo, and PayPal, you know, for transactions between friends of mine, it’s really easy to move money around.

I think a lot of those systems have built-in security around the validation of who you’re sending it to.

So if you can, you know, take a picture of their little QR code that validates who they are or validate their phone number and their email.

A lot of those systems provide a second factor that you have to give that information so that you actually know who that recipient is.

But super convenient, easy way to do it, and typically very secure,

Michael Cuozzo

Right, more secure than the mail, I’d say.

Paul Ewing

Absolutely.

Michael Cuozzo

And speaking of mail as well, you know, I know one other thing we wanted to touch on is kind of like receiving paper statements, confirmations, right?

Like a lot of our clients are set up to still receive their statements on a monthly basis from Schwab, whatever other custodians they might use.

Maybe you guys can talk a little bit about obviously, well, we know that the mail is obviously a threat.

You know, Paul, like you mentioned the cards not showing up, you know, obviously the same thing could potentially happen with your statement.

So what could our clients do to kind of protect themselves in that area?

How could they set things up to be more secure?

Paul Ewing

Yeah, I would say enable electronic delivery wherever you can. Credit card statements, bank statements… The less mail coming with sensitive information.

And I know that a lot of times the account number is, you know, partially redacted, but there could be some sensitive information that would be in your mailbox and could be stolen.

So yeah, I always recommend: receive it digitally, receive it via email

And then if you do have documents that you’re receiving paper-wise, just shred them.

That’s usually—I have a shredder.

I love it.

You know, it’s basically, I go straight from the mailbox to my shredder.

It feels like, and it’s kind of like my digital inbox too.

Most of my day is spent just deleting emails.

And, you know, when I get my paper mail, I’m shredding it.

And I always say just delete it if you’re unsure, especially when we were talking about phishing emails.

And if it is a legitimate contact, usually it will come back. There’ll be a second request, or it will be, “oh you weren’t responding to our emails, so we sent you a letter.”

If it is truly important, someone will be able to get a hold of you.

Otherwise, I’m deleting and shredding everything.

Jeff Rubin

Yeah.

And when you are opting into that electronic delivery as opposed to mail, just be mindful and have that good email hygiene.

Hey, that email is still coming through.

Let’s make sure we’re putting it in a folder.

Let’s make sure we’re deleting it. There is still some personal hygiene that goes along with that opt-in that you need to be mindful of.

Paul Ewing

Yeah.

And at one time I felt like, if I’m getting these electronically now I’m just going to print them and save them.

I don’t even do that anymore.

Most of your statements are archived.

I mean, with Schwab, they’re archived for 10 years.

If you need to go back and look up a statement from that long ago, it’ll be there digitally.

Don’t print them and save them again, you’re just opening yourself up for, you know, more risk that way.

Tanya Walliser

Absolutely.

So I know we don’t have a ton of time left, but one question that I think is really important is the question around using public Wi-Fi at a hotel or anywhere and just kind of how do we keep ourselves safe when that’s what we’re using?

Jeff Rubin

Yeah, I generally discourage the use of public Wi-Fi, Wi-Fi on planes. You never know who else is on that Wi-Fi and is trying to gain control of your computer.

The more that you can use a VPN type of environment or—most of us have personal hotspots that we have on our cellphones that we can enable and use as well when we’re on the road.

Those are different methods, methods by which I’d suggest leaning into as opposed to public Wi-Fi because you never know who else is on that network and what they can do once they’re on that network with you.

Paul Ewing

Yeah, it’s the unknown of the security of that Wi-Fi that’s the biggest concern there.

And so as Jeff mentioned, you know, spin up a hotspot, use cellular as a mechanism for connecting.

That’s definitely more secure.

Jeff mentioned the VPN and I might have mentioned VPN earlier too.

So virtual private network, that’s what VPN stands for.

Essentially, what a VPN allows you to do is connect securely to the internet.

So it creates an encrypted tunnel between your device and the internet.

Anything that’s passing between there can’t be seen.

If you’re not using a VPN and you connect to public Wi-Fi, and you don’t know the security and you don’t know who’s controlling it, there could be bad actors sitting in there, seeing the traffic of what’s coming and going.

And so that’s the big risk of using, you know, public Wi-Fi. Along those same lines too, you know, I would be cautious of, and I see this all the time at the airport where, oh, you need a charge on your phone?

Well, we’ve got a cable right here that you can plug into or just plug into this USB in this charging station.

So again, that could be a way for bad actors to send something to that device through the USB.

So if you are charging or you need to charge, use the old plug and plug it into an outlet. Don’t plug it into some random USB or USB-C at the airport or at the hotel.

Those are always a no-go for me.

Michael Cuozzo

Wow, that’s a good one.

I never would have even thought of that honestly, so I’m gonna be more careful.

Tanya Walliser

The number of random chargers I’ve plugged into…

One thing that I thought was a good question.

Can you speak to the importance of software maintenance and keeping the technology we use at home up to date?

Jeff Rubin

Yeah, absolutely critical. For software we have installed on our computers, the reason that we’re even getting indications that they should be updated in the first place is because a bad actor has found a way to breach the security of that software, and they’re releasing an update so that you have a patch you can put into place to make it more secure. And they’ve kind of remedied what the bad actor got through to.

So you want to stay on top of those updates.

The more you can enable automatic updates to happen, lean into that as well, but you don’t want to be ignoring those by any means.

Paul Ewing

Yeah, and I’ll double down on that.

Setting the automatic updates is super important on your devices.

So whether it’s a mobile device or a laptop or a desktop. My wife is always saying, Oh, my phone is running slow.

And I say, well, did you do the latest update?

And it’s, “No, I haven’t done the update.”

So that might also like speed up your device, make things run a little bit smoother.

Also, don’t forget about the category of devices that we call the “Internet of Things”.

Anything connected to the internet—so it’s your cameras, personal devices, your thermostats in your home… Those all have what we refer to as firmware updates.

So those are updates as well that need to be applied. So there’s patches.

A lot of times when you’re setting those devices up, you can just select auto update and it will just do it for you.

But you know, those are devices that could be vulnerable and are devices that need updates.

Michael Cuozzo

All right, excellent.

Now we have a few more minutes here and one question we’ve got a couple of times, and this was submitted a few times before the webinar as well, is surrounding ways to prevent fraudulent transfers, right? Either to or more likely from your Schwab account, or if you’re sending a wire.

Can you guys give us some thoughts on that, like best practices, things to watch out for when it comes to transferring money?

Paul Ewing

Yeah, I’ll start. Definitely know who you’re transferring to, and by me saying that is, don’t just take instructions via email.

Make sure that you are validating those instructions over a phone call or in person.

Jeff mentioned this earlier where the bad actors, if they gain access to your email, they’re sitting in there, they’re waiting for that transaction to occur.

They will get in there and redirect the wire instructions.

And that can also happen at a title company or you know, for a real estate transaction.

We see that all too frequently where we ask advisors, especially on third-party wires, to authenticate that yes, I have called this client and verbally confirmed these instructions, and they’re off the hook because the client didn’t do the same on their side of the transaction. So they are just giving bad instructions that got authenticated, but they were not valid.

And so, in a sense, that transaction is fraudulent, and the bad actors got the money, and the client was out, because everyone followed the instructions and validated and authenticated, but the one piece that was missing was the client not authenticating it.

Make sure that you are double and triple-checking and validating those instructions because your advisor is going to call and ask to validate those instructions as well.

Don’t do it over email.

Pick up the phone, call the person directly, and get those instructions validated.

Jeff Rubin

I would also suggest leaning into these already established encrypted methods.

Using Schwab Alliance, using your client portal with Condor.

These are already encrypted and secure methods that you should be interacting and communicating in. So lean into those. If you’re in your email, and you get an email from the title company, the bad actor will see that email, delete it, and with AI, spin up an identical email to what it looked like. Just change the routing instructions, and then that’s what’s sitting in your email inbox.

And so that’s why that outbound call, that second validation is really critical.

I’ll also mention, and maybe this is a no-brainer, but legitimate transactions are gonna be in USD, not in Bitcoin, not in gift cards.

So if you are asked to make payment with something other than the ol’ mighty dollar, that’s a red flag.

Tanya Walliser

All right, I think that we’re running out of time here.

We’re bumping up to that one hour mark.

I know there are a lot of questions we didn’t get to. Any Condor-specific questions people are asking about—our portal and such like that—feel free to reach out to your advisor directly and we will address those questions.

But Jeff and Paul, I want to thank you so much for taking your time with us today and lending us all of this information on such an important topic today.

Paul Ewing

I’m glad to be here.

Jeff Rubin

Yeah, thank you for your time.

Michael Cuozzo

Yeah, and just as a reminder, if you know anyone who might benefit from this chat, it was recorded.

So we’ll be posting the recording of this afterwards on our social media.

We may email it out as well.

So keep an eye out for the recording.

But yeah, Jeff and Paul, thank you guys so much for joining us today.

We really appreciate the advice and the insight.

And to everybody else, we hope you have a great rest of your day.

Tanya Walliser

Bye everybody. Thank you.

Paul Ewing

So long.

Jeff Rubin

See you.