Your digital wealth needs a lock. Ten ways to protect yourself online

You wouldn’t leave your front door open or hand a stranger your bank statements. Yet our digital habits can create the equivalent risks, often without us even noticing. For anyone with savings, pensions and investments, digital security is part of protecting wealth. Criminals do not always need to breach a bank’s systems. Sometimes, persuading a customer to click, disclose a code or authorise a payment is enough. The good news is that you do not need to become a technology expert. These ten practical steps provide a useful starting point.

1. Treat your email as the master key

Your email account often holds the keys to other accounts because password-reset messages arrive there. Give it a strong, unique password that you never use elsewhere. Review the recovery email address and telephone number, too. An old recovery address you can no longer access could make regaining control much harder.

2. Stop recycling passwords

Reusing one password across shopping, social media and financial accounts creates an avoidable weakness: one compromised account can expose others. A reputable password manager can generate and store different passwords, so you do not have to remember them all. Protect the manager itself carefully, including its recovery arrangements. Where you must remember a password, three unrelated words can help create something long and memorable.

3. Use passkeys or two-step verification

Where available, consider passkeys, which let you sign in using your device’s security, such as a fingerprint or face recognition. They offer protection against phishing. Otherwise, enable two-step verification on important accounts. Never approve an unexpected login request or share a verification code with someone who contacts you. Keep recovery codes somewhere secure.

4. Make updates automatic

Software updates are not just about new features. They also fix security weaknesses. Enable automatic updates for your phone, computer, browser and applications. Replace devices that no longer receive security updates, even if they still appear to work perfectly. Install applications through official stores and be cautious about unexpected requests to download software.

5. Hang up and call back to spot phone scams

A caller knowing your name, address or investment provider does not prove they are genuine. Neither does a familiar number appearing on your screen. If an unexpected caller discusses money or account security, end the conversation and contact the organisation independently, using your banking app, statement or another trusted source. A genuine organisation can accommodate a security check.

6. Verify payment requests and spot safe account scams

An email announcing new bank details should trigger a check, particularly when paying a solicitor, builder or investment provider. Confirm the instructions through an established contact route, rather than replying to the same email. Urgency, secrecy and requests to bypass normal procedures are reasons to pause. Your bank will not ask you to transfer money into a “safe account” to protect it.

7. Check the firm with the FCA Firm Checker

Fraudsters copy genuine financial businesses, including their websites and regulatory details. Before investing, use the FCA’s Firm Checker to verify the firm’s permissions and contact information. Then contact the business through those independently checked details. A genuine firm reference number on a glossy proposal is not enough: it may belong to the business being impersonated.

8. Agree a family routine to beat AI voice scams

Artificial intelligence can imitate familiar voices, making an apparent emergency call from a relative more convincing. Agree that unexpected requests for money will always be checked by calling the person on their usual number. A family codeword can provide another safeguard but should not replace that independent check. Be thoughtful about publishing personal details that could help someone construct a believable story.

9. Protect the device in your pocket

Your phone may provide access to email, banking and investment accounts simultaneously. Use a strong screen lock, enable the device’s lost-phone features and hide sensitive notification previews. Maintain backups of important documents and photographs and understand how to recover them. Keep essential recovery information accessible somewhere other than the phone itself: losing one device should not mean losing every route back into your accounts.

10. What to do if you suspect fraud or a scam

If you suspect fraud, contact your bank immediately through a trusted route. Preserve messages and payment details and report the incident through the appropriate police fraud-reporting service. Forward suspicious texts. If an account is compromised, secure it from a trusted device. Above all, act promptly rather than allowing embarrassment to delay you.

Make security part of managing your wealth

Ask your wealth manager how payment requests, changes of bank details and sensitive documents are verified. Agree the process before an urgent situation arises. Good digital security is largely about consistent habits. A few sensible checks today can help protect the wealth you have spent decades building.