Many of us spend weeks choosing the best investing and investment account, comparing fees and reading reviews and then hardly think about the email address attached to it. Most people only wake up to this when it's too late and the numbers show why.
FINRA report clearly mentions that account takeovers at brokerage firms are on the rise. To give it some context, see the FBI data - it has received over 5,100 complaints about account takeovers since January 2025. The reported losses cross $262 million. For anyone investing online, many of these begin with someone clicking on a fake message or having a password stolen, which means the email account is where most of the protection has to start.
Use a Unique Password for Your Email
Start with the email password, because every ‘forgot password’ link on a brokerage site sends its reset mail to that inbox. Many people realize this only after their Gmail account got hacked and the reset notices start piling up. Moolock's blog on Gmail safety says that the password usually isn't cracked in some clever way either. A new infostealer called Storm appeared on cybercrime networks in early 2026 and stolen cookies from tools like it get packaged and sold to other criminals. This is also how a password from some old forum you joined years ago ends up opening your Gmail, because criminals simply try the same combination everywhere.
Most people can't remember a different long password for every site, so a password manager like Bitwarden or 1Password does it for them and all you need is one master password. FINRA gives the same advice about having a separate password for each account. Google's Security Checkup page is worth a visit too, since it lists the devices that are signed in and the apps that can see your mail.
Switch to Passkeys or a Security Key
Among all the email security best practices, this is the one that has changed the most in recent years. A code sent by text message used to be the standard answer, but FINRA lists SIM swapping, where a criminal takes over your phone number, as a warning sign when SMS is used for login.
NIST says one-time codes aren't phishing-resistant, so if you type the code into a fake page that looks real, the criminal gets it too and can use it straight away. Passkeys and security keys like a YubiKey don't work like that, as they only respond to the real website and nothing else.
Gmail supports both of them and your broker may as well, so it's worth looking in its security settings. One more thing – the backup codes you get while setting this up are best printed and kept in a drawer at home, because keeping them in the same email account defeats the whole purpose.
Keep Your Browser Updated
Here's something that surprises a lot of people – even a strong two-factor login can be skipped. For anyone investing online, infostealer malware can copy session cookies and let attackers into accounts without knowing the password, so no code is asked at all.
In September 2026, researchers described JSCeal, a Windows malware that goes after Google session cookies in this way. Google's answer is Device Bound Session Credentials, which reached Windows users in Chrome 146 in April 2026. It ties the session to the hardware, so a stolen cookie is useless elsewhere. macOS support was planned for a later release, so Mac users should watch for it.
It only works if the browser is current, so automatic updates are basically part of investing and financial account protection now. Where the software comes from matters too, since infostealers mostly get in when somebody downloads something from a site they shouldn't have trusted.
Treat Inbox Floods as an Alarm
Suppose you open your email and find hundreds of newsletter confirmations in an hour, from sites you've never visited. It's tempting to call it spam and clean up. But this is called subscription bombing and it's used to bury the one message that matters, like a password reset or a withdrawal notice.
A report mentions floods of over 1,500 emails per hour and FINRA lists a sudden pile of spam right after a login attempt as a sign of takeover. One of the more overlooked secure email practices is to search the inbox and the spam folder for ‘password’ and ‘withdrawal’ before deleting anything. Then log into the brokerage directly to check and do it quickly, because a flood can start overnight.
If someone calls offering to fix the flood and asks for remote access, say no, because Schwab's guarantee says activity by a person you let into your device isn't covered.
Open Your Broker's Site Yourself
Phishing is still the biggest way in. A report that studied account takeover signals across almost 200 US financial institutions found credential phishing behind 55.2% of them and it noted that generative AI has made copying a real login page cheap and easy. That's why the old advice about spotting typos doesn't help much anymore, since the fake emails read quite well now. So the better habit is to skip the link completely.
Open the broker's app, or use a bookmark that you saved yourself and see if the same problem is showing up there. If an email says a transfer has a problem, call the number printed on the broker's official website and not the one given in the message.
Even typing the broker's name into a search engine isn't entirely safe, because FINRA warns that criminals use search results to send people to fake login pages. If you're wondering how to protect your brokerage account from hackers, this habit alone removes a big part of the risk.
Review Your Inbox Settings
Some of the changes a hacker makes are so quiet that you would never notice them without looking, so it's worth going through the settings every few months. A reminder on your phone for January and July helps. Here's what to go through:
-
Forwarding rules and filters in the email account
-
Recovery phone number and recovery email
-
Devices and sessions that are currently signed in
-
Apps that have access to the mailbox
-
The email address and phone number saved with your brokerage
The last one matters more than it sounds, since FINRA lists unauthorized changes to the email or phone number on file as a warning sign. If an attacker swaps the contact email at the brokerage, every alert goes to them.
While you're there, turn on login and withdrawal alerts and actually read them. The big brokers' guarantees also come with conditions – Fidelity's, for one, doesn't apply when unauthorized activity isn't reported promptly.
Conclusion
None of these habits is hard and most of them can be done in a single afternoon. The attacks have changed a lot in the last few years, with stolen cookies, fake signup floods and AI-written lures, so the inbox needs to be protected as seriously as the account it unlocks. If only one thing gets done this week, make it the passkey or security key on the email account.
