Recognizing threats, protecting accounts, exercising consumer rights, and building a personal financial safety plan
Every financial system that moves money also creates opportunities for people to steal it. This chapter introduces the threats that target financial accounts, personal information, and consumer trust — and it introduces the legal protections, technical tools, consumer rights, and personal habits that reduce those risks.
Students who finish this chapter will be able to recognize common fraud and scams, protect their accounts and identity, respond effectively when something goes wrong, and build a personal financial safety plan that stays practical without making them afraid of everyday financial technology.
You receive a phone call. The caller says he is from the Social Security Administration and that your Social Security number has been suspended due to suspicious criminal activity. To clear your name, you must pay $500 in gift cards immediately or you will be arrested. He tells you not to tell anyone. What do you do — and how did you know what to do? By the end of this chapter, recognizing this threat and knowing exactly how to respond will be second nature.
Financial safety is not a topic reserved for wealthy people, elderly people, or careless people. Fraud, scams, and identity theft affect people of every income level, age, background, and level of education. The Federal Trade Commission receives millions of consumer fraud reports every year. Billions of dollars are lost annually to financial crime in the United States alone — and that figure undercounts what actually happens, because many victims never report what happened to them.
For someone with a small savings account and limited income, losing even a few hundred dollars to fraud can mean missing rent, skipping a car payment, or draining an emergency fund it took months to build. Financial crime does not only threaten wealthy people with large investment portfolios. It threatens anyone who has a bank account, a debit card, a Social Security number, or a phone number.
It is tempting to assume that careful, educated people never get scammed and that victims must have been careless. This is not accurate. Financial criminals are often highly sophisticated. They study human psychology, exploit trust, and adapt constantly. Scams that would seem obvious in calm analysis can be deeply convincing in the moment — especially when they target urgency, fear, excitement, grief, or love.
Recognizing that fraud is a systemic problem — not only a personal failure — is the first step toward understanding it clearly. At the same time, individuals have meaningful power to reduce their own exposure. Good habits, account monitoring, strong authentication, and rapid response when problems appear make a significant difference. The goal is not to become fearful of all financial technology. It is to understand risk accurately and respond to it proportionately.
Fraud is the intentional deception of a person or institution for financial gain — misrepresenting facts, concealing information, or creating false impressions to take money or property. Fraud is a crime under both state and federal law. A scam is a fraudulent scheme: a specific organized method of committing fraud. The words are often used interchangeably in everyday language.
Most scams share a recognizable structure. Understanding the pattern makes individual scams easier to identify before harm is done.
If someone contacts you claiming to be from a bank, government agency, or other institution, and asks for money or personal information — do not respond to that contact directly. End the call or interaction. Look up the institution's official phone number independently from their official website or the back of your card, and call it yourself. Scammers depend on controlling the communication channel. Cutting that channel defeats a major part of their approach.
Identity theft occurs when someone uses another person's personal information — Social Security number, name, date of birth, account numbers, or other identifying data — without permission, typically to commit financial fraud or access financial accounts. Identity theft is not one single crime; it is a category that includes many different schemes.
| Type of Identity Theft | What the Criminal Does |
|---|---|
| New account fraud | Opens new credit cards or loans in the victim's name |
| Tax identity theft | Files a fraudulent tax return to steal the victim's refund |
| Account takeover | Takes control of existing bank or investment accounts |
| Medical identity theft | Uses stolen health insurance information to receive medical care |
| Benefits fraud | Applies for government benefits using the victim's identity |
| Synthetic identity fraud | Combines real and fake information to create a new false identity, often using a real SSN |
Data breaches occur when criminals gain unauthorized access to databases held by companies, hospitals, government agencies, or financial institutions. An individual can be a victim of a data breach without ever making a mistake, because the failure happened at the institution that held their data.
Physical theft includes stolen mail (bank statements, tax documents, credit card offers), stolen wallets, and information taken from trash or mailboxes. Skimming devices are hardware attached to ATMs or gas pump card readers that capture card data when a card is swiped. Account takeover uses stolen or guessed passwords to access existing accounts and lock the real owner out.
Phishing is a type of attack in which a criminal sends a fraudulent communication — typically an email, text message, or social media message — that appears to come from a legitimate source in order to trick the recipient into revealing sensitive information, clicking a malicious link, or downloading harmful software.
| Attack Type | Channel | Description |
|---|---|---|
| Phishing | Broad fraudulent emails impersonating banks, retailers, government agencies, or tech companies | |
| Spear phishing | Targeted attack using personal details to appear more convincing to a specific individual | |
| Smishing | SMS text | Phishing via text message — fake delivery alerts, bank warnings, prize notifications |
| Vishing | Phone call | Phishing via voice call — impersonating bank fraud departments, IRS, or tech support |
| Pretexting | Any | Fabricated scenario designed to establish credibility before extracting information |
From: [email protected]
Subject: URGENT: Your Chase account has been locked
Dear Valued Customer,
We have detected suspicious activity on your account. Your account
has been temporarily locked. You must verify your information within
24 hours or your account will be permanently closed.
[Click Here to Verify Your Account]
chase-bank-verification.com, not chase.com. "Dear Valued Customer" — not the account holder's name. 24-hour deadline creates panic. "Click Here" link destination is unknown. Threat of permanent closure prevents calm evaluation.1. Pause. Urgency is the attacker's tool. Pausing defeats it. 2. Do not click links or open attachments. 3. Evaluate the sender's actual email address — is it genuinely from the institution it claims? 4. Look at the URL before clicking — hover to reveal the destination. 5. Contact the institution independently using their official phone number or website. 6. When in doubt, delete. If the message is legitimate, the institution will contact you again.
Passwords are the most common method of protecting access to financial accounts, email, and personal information. A weak or reused password is one of the most common pathways through which accounts are compromised. In a credential stuffing attack, criminals take username-password combinations exposed in a data breach and test them across many other websites — because people frequently reuse the same password in multiple places.
| Principle | Why It Matters | Example |
|---|---|---|
| Length | Longer passwords are dramatically harder to crack. A 16-character passphrase is typically stronger than a short password with symbols. | "BlueRiverTableGlass" vs. "P@ss1!" |
| Uniqueness | Every important account needs a different password. A breach at one service should not compromise all others. | Different password for bank, email, each card |
| Avoid obvious info | Names, birth dates, phone numbers, and addresses can often be found on social media and used to guess passwords. | Not "Max2007" or "JohnSmith1985" |
| Randomness | Predictable patterns (Summer2024!, Password1!) offer less protection than they appear to. | Use a password manager to generate truly random passwords |
Remembering dozens of unique, strong passwords is not realistic for most people. Password managers are applications that generate, store, and fill strong passwords securely. They require only one strong master password to access all others. Using a password manager is significantly more secure than reusing passwords or writing them in a note on your phone.
Multifactor authentication (MFA), also called two-factor authentication (2FA), adds a second verification step beyond the password. Even if an attacker obtains the correct password, MFA requires something additional before access is granted. MFA should be enabled on every financial account that offers it — and also on email accounts, since email is often used to reset passwords for financial accounts.
| MFA Method | How It Works | Security Level |
|---|---|---|
| SMS text code | A one-time code is sent to a registered phone number | Better than none; can be intercepted via SIM swapping |
| Authenticator app | App generates time-limited codes on the device without a phone network | More secure than SMS; recommended |
| Hardware security key | Physical device (USB or tap) that must be present to complete login | Highly secure; less common in consumer use |
| Biometrics | Fingerprint or face recognition as device login layer | Convenient; as secure as the device itself |
For each important account (bank, investment, email, tax, Social Security), verify:
When entering any sensitive information online — a password, a credit card number, a Social Security number — the connection between the browser and the website should be encrypted. The indicator of this encryption is the HTTPS prefix in the web address and a padlock icon in the address bar.
HTTPS tells you the connection is encrypted. It does not tell you that the website itself is legitimate. A phishing website can have HTTPS. The padlock means the connection to that website is secure — it does not mean the website is who it claims to be. Always verify the domain name carefully before entering any credentials or payment information.
| URL | Legitimate? | Why |
|---|---|---|
www.bankofamerica.com | ✓ Real | Genuine domain with correct spelling |
www.bankofamerica-login.com | ✗ Fake | Hyphenated domain — the real domain is bankofamerica-login.com, not bankofamerica.com |
www.bankofamerica.com.secure-login.net | ✗ Fake | The actual domain is secure-login.net — bankofamerica.com is just a subdomain |
www.bank0famerica.com | ✗ Fake | Zero substituted for the letter "o" |
Open public Wi-Fi allows other users on the same network to potentially observe network traffic. Avoid conducting financial transactions on public Wi-Fi if possible. Use a personal mobile data connection or a VPN (Virtual Private Network) if public Wi-Fi cannot be avoided. Never conduct sensitive financial transactions on shared or public computers.
The fastest response to unauthorized activity in a financial account comes when the account holder notices it quickly. Every day that passes before unauthorized charges or withdrawals are reported is another day the attacker may continue — and, in some cases, a day that affects the legal protections available to the account holder. Active monitoring also catches errors that are not fraud: a merchant charging twice, an automatic subscription that was cancelled, or a bank fee applied incorrectly.
| Alert Type | What It Catches |
|---|---|
| Transaction over a threshold (e.g., any purchase over $50) | Large unauthorized charges |
| Login to the account | Unauthorized account access |
| Password or contact information change | Account takeover in progress |
| New payee added for bill pay | Redirected payments |
| Balance below a minimum (e.g., below $100) | Overdraft risk; large unauthorized withdrawals |
| Card used online or internationally | Card number theft |
| Failed login attempts | Password guessing attempt underway |
Credit reports show whether new accounts, inquiries, or public records have appeared in the consumer's name. Reviewing credit reports regularly catches identity theft that has already opened new accounts. Under federal law, every consumer is entitled to one free credit report per year from each of the three major credit bureaus through AnnualCreditReport.com. Reviewing one bureau's report every four months — rotating among the three — provides year-round monitoring at no cost.
| Frequency | Action |
|---|---|
| Real-time | Receive and review account alerts via text or email |
| Weekly | Quick check of account balances and recent transactions |
| Monthly | Full statement review for all financial accounts |
| Every 4 months | Pull one credit bureau report (rotating across Equifax, Experian, TransUnion) |
| Annually | Full review of all three credit reports, insurance policies, and account permissions |
| When something seems wrong | Investigate immediately — do not wait for the next scheduled review |
Consumers in the United States are protected by a significant body of federal law governing financial accounts, payment disputes, credit reporting, and lending practices. These protections establish rights, procedures, and timelines that consumers can use to recover from financial losses caused by fraud, unauthorized transactions, and errors.
| Law or Agency | What It Covers |
|---|---|
| EFTA — Electronic Fund Transfer Act | Consumer rights regarding electronic transactions — debit card charges, ATM withdrawals, electronic bill payments. Limits liability for unauthorized electronic transactions. |
| FCBA — Fair Credit Billing Act | Credit card billing disputes. Gives consumers the right to dispute charges and limits liability for unauthorized credit card charges to $50. |
| FCRA — Fair Credit Reporting Act | Credit reporting accuracy. Gives consumers the right to access credit reports, dispute inaccurate information, and require investigations. |
| CFPB — Consumer Financial Protection Bureau | Federal agency that supervises financial institutions and accepts consumer complaints about banks, credit card companies, debt collectors, and credit bureaus. |
| Timing of Report | Consumer Liability |
|---|---|
| Before any unauthorized transactions occur | $0 |
| Within 2 business days of discovering the loss | Up to $50 |
| 3 to 60 days after discovering the loss | Up to $500 |
| More than 60 days after statement containing the unauthorized charge | Potentially unlimited — may lose all funds taken |
The same fraud can cost $50 or thousands of dollars depending solely on when it is reported. This is why monitoring accounts and reporting problems quickly is so important — the liability limits under the EFTA are tied directly to how fast the consumer acts.
The FCBA caps credit card liability for unauthorized charges at $50 regardless of when reported — and most major card issuers offer zero liability. More importantly: the consumer does not have to pay the disputed charge during the investigation period, meaning the consumer is not out of money while the dispute is resolved. With a debit card, the money has already left the account. This difference is one reason financial professionals often recommend using a credit card (paid in full monthly to avoid interest) for everyday purchases rather than a debit card.
Reporting financial crimes and problems serves two purposes: it helps the individual resolve their specific situation, and it provides information to agencies that investigate fraud, protect consumers, and build cases against criminal enterprises. Many victims feel embarrassed and do not report what happened — but this means criminals continue operating without consequences, and consumer protection agencies have less data with which to identify patterns and warn others.
| Problem Type | Where to Report | Contact |
|---|---|---|
| Fraud and scams | Federal Trade Commission (FTC) | ReportFraud.ftc.gov · 1-877-382-4357 |
| Identity theft | FTC — Identity Theft Recovery | IdentityTheft.gov |
| Phishing emails | Anti-Phishing Working Group & FTC | [email protected] |
| Social Security fraud | SSA Office of Inspector General | oig.ssa.gov · 1-800-269-0271 |
| IRS tax fraud | Internal Revenue Service | irs.gov/report-phishing · 1-800-908-4490 |
| Investment fraud | SEC & FINRA | sec.gov/tcr · finra.org/investors |
| Bank complaints | Consumer Financial Protection Bureau | consumerfinance.gov/complaint · 1-855-411-2372 |
Call the number on the back of the card or on the official account statement — not a number found in a suspicious email or through an internet search (which might lead to a fake support number). Ask to speak with the fraud department specifically. Request a case or reference number for every call. Follow up in writing through the institution's official secure message system or by certified mail.
A personal financial safety plan is a set of proactive habits, decisions, and records that reduce exposure to fraud and scams and enable a fast, organized response when problems occur. It is not a complicated document — it is a checklist of protections put in place, and a record of the accounts, contacts, and resources to use if something goes wrong.
Know what financial accounts exist — checking, savings, credit cards, investment accounts, retirement accounts — and where each one is held. This allows quick identification of unauthorized accounts, ensures all accounts are monitored, and provides contact information needed for rapid response.
| Account | Institution | Account Type | Last Reviewed | Alert Status |
|---|---|---|---|---|
| Primary checking | [Your bank] | Checking | [Date] | Alerts on |
| Emergency savings | [Your bank] | Savings | [Date] | Alerts on |
| Credit card | [Card issuer] | Credit | [Date] | Alerts on |
When fraud is discovered, time matters. Having contact information readily available — without needing to search the internet under stress — enables faster response and preserves stronger legal protections.
| Institution / Agency | Phone | Website |
|---|---|---|
| Bank fraud department | Number on back of card | Bank's official URL |
| Credit card fraud department | Number on back of card | Card issuer's official URL |
| Equifax | 1-800-525-6285 | equifax.com |
| Experian | 1-888-397-3742 | experian.com |
| TransUnion | 1-800-680-7289 | transunion.com |
| FTC Identity Theft | — | identitytheft.gov |
| FTC Fraud Report | 1-877-382-4357 | reportfraud.ftc.gov |
| CFPB | 1-855-411-2372 | consumerfinance.gov/complaint |
Financial safety habits can sound overwhelming when listed together. In practice, most require setup time once and then become automatic. Setting up account alerts takes five to fifteen minutes per account — once. Installing a password manager and generating new passwords takes an hour or two — once. Enabling multifactor authentication takes a few minutes per account — once. After setup, the ongoing habits — checking statements, reviewing credit reports, recognizing suspicious messages — take modest time and become routine. The goal is not constant anxiety about financial threats. It is informed, calm vigilance.
Using the components in this section, build a personal financial safety checklist. Include: (1) a list of at least four financial accounts with institution name, account type, and alert status; (2) an authentication audit for each account; (3) a monitoring schedule; (4) an emergency contact list; (5) a brief document security plan. For privacy — do not include actual account numbers, passwords, or PINs. Use institution names and account types only.
Consumer liability depends on how quickly unauthorized charges are reported after discovery.
Maximum liability: $50Maximum liability: potentially the full $600 — and any additional unauthorized charges after day 60Keiko's account is accessed without authorization on March 1. She receives her account statement on March 10 showing a $420 unauthorized charge. She reports the charge on March 22. How many days passed between receiving the statement and reporting? What is her maximum liability under the EFTA? Explain your reasoning.
Each statement contains a financial safety error. Identify the error and explain the correct understanding.
What is the error? What should this person have understood about HTTPS?
Why is this reasoning wrong? What does email MFA actually protect, and what additional step is needed?
What are the specific consequences of this delay under the EFTA? What should this person have done instead?
Why does password length not compensate for reuse? What specific attack does this leave the person vulnerable to?
What risks does this create? Where should the Social Security card be kept instead?
Chapter 9 begins Part III: Saving, Interest, and Credit. Having built a foundation in banking systems, payments, records management, and financial safety in Part II, students are now ready to explore how money grows over time and how saving connects to resilience, goals, and long-term financial well-being. Chapter 9 introduces emergency funds as the first financial priority for most households — not because savings are more important than other goals, but because having liquid reserves available in a crisis prevents a temporary problem from becoming a permanent financial setback. Students will learn the mechanics of emergency funds, liquidity, short-term and medium-term savings goals, sinking funds, automatic saving, and the different types of savings accounts available. Chapter 10 will then introduce the mathematical engine behind saving and borrowing: interest, compound growth, and the time value of money.