Let's say my nest egg is in ETFs in a taxable account and an IRA with the same brokerage.

SIPC insurance may cover me "if the firm fails financially", and only up to $500,000. That is per institution, not account, so I may need multiple brokers.

SIPC will not protect against thievery and based on what I've read, if someone steals my password, logs in to my account, and transfers out all my money, that's my fault somehow, and I don't get the money back.

I could move everything over to several FDIC insured accounts, but then I'd get less return.

I could buy physical bars of gold and bury it, but there are obvious risks.

Are there best practices for protecting one's retirement account, or are we all really just depending on the computer security of our brokers?

Edit: I use 2FA on every account that allows it.

IMO the answer/comments so far that amount to "The bank won't get hacked" or "If your login is hacked somehow, it's your fault" are wrong. This is my view as someone with a twenty+ year background in computer security.

  • If you password is never written down, it can never be stolen. Some brokers have two step verification which requires more than just knowing your sign-in name and password. That may involve calling your home phone or utilizing a code generating electronic device. May 3, 2022 at 16:10
  • @BobBaerker thus they are unhackable? May 3, 2022 at 16:24
  • If they are hacked, would that be your fault or the broker's fault? May 3, 2022 at 16:46
  • Where's the relevance with blame? As far as I can tell SIPC doesn't pay me back if the bank is hacked. May 3, 2022 at 18:39
  • Protect against what, exactly? Absolutely nothing will protect your bank account against hyper-inflation, or stocks against collapse of the financial markets (possibly concurrent with hyper-inflation), so if those are in your risk model, you have complications.
    – user253751
    May 5, 2022 at 13:55

2 Answers 2


FDIC does not protect against identify theft either - only a theft against the institution itself (e.g. a bank robbery). If you are truly concerned about someone stealing your identity and draining your retirement savings, then I would make sure you have the highest safety level with your bank (two-factor authentication, phone apps, whatever) to protect from someone stealing your password. Yes it will be more inconvenient when just trying to get your balance, for example, but it may be worth it for extra peace of mind.

There is also identity theft insurance that typically costs about $20 per month, but it only covers the cost of recovering your identity - it does NOT reimburse you for the actual amount that was stolen. You'll have to rely on the police and institutions to actually recover the money.

My opinion is that it's wise to protect your accounts as much as is practical, but you're being a bit paranoid. two-factor authentication is much more secure than just a password since hackers would not only need to get your password, but need some form of authentication that is not floating around on the internet like your mobile phone app or your home phone number. Most institutions also alert you via several channels if anything changes that would compromise TFA (like your phone number).

  • I do use 2fa. My private information (and thousands of others') was stolen from the US government in the OPM leaks (google it, it's interesting.) They have everything about me and others who had secret/top secret security clearances. Are you sure I'm being paranoid? If the US government's clearance information can be stolen, why can't a bank be hacked? May 3, 2022 at 18:40
  • My point is that with 2FA, even with every scrap of private information about, you a hacker would still need access to some physical device in order to access your account (phone app, text message to your phone, call to your home phone, etc.) It's possible but it would require much more physical access than just knowing your password.
    – D Stanley
    May 3, 2022 at 18:56
  • We're getting off track a little but, you're assuming only intended mechanisms will be used to access the account / transfer funds. This often isn't the case. May 3, 2022 at 19:07

I have thought about that too, and not found anything better than using 2FA and unique long random string passwords (use a password safe, of course).

Don’t set your recovery questions to things that could be leaked - just invent another answer, and write it down in the password safe. For example, mother’s maiden name - use a random string or some made-up name. Thus a leak of your personal information doesn’t give it away.

In addition, note that most transactions take a minimum of four business days until your money is gone: a potential hacker needs to add a target checking account (typically 3 business days), sell investments and wait for settlement (T+2), and trigger a transfer out (another day). If you log on once a day (easy with the app), you have four chances to notice and call them.
Not great, but something.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .