Investor Security Center

Investment fraud and account takeover are among the most damaging financial crimes, and they increasingly rely on convincing websites, professional-sounding calls and messages that imitate trusted brands. This Investor Security Center brings together practical, non-technical guidance to help you protect your online banking and brokerage accounts, recognise the warning signs of a scam and act quickly if something goes wrong.

RTIBK has no client portal or logins

Before anything else, a clear statement about us. RTIBK is an independent, educational publication. We are not a bank, broker or investment adviser, and we do not offer accounts of any kind. That means:

• There is no RTIBK client portal, customer login or investor dashboard.
• We will never ask you to create an account to invest, deposit or withdraw money.
• We will never ask for passwords, one-time codes, card numbers or remote access to your device.
• We will never ask you to send money or pay a fee for any reason.

You can read more about who we are and how we work on our About page.

How to protect your online banking and brokerage accounts

Your real financial accounts — with your bank, brokerage or retirement plan provider — are valuable targets. Most account takeovers exploit weak or reused passwords, intercepted codes or compromised devices. A few habits dramatically reduce that risk.

Turn on two-factor authentication

Two-factor authentication (2FA) requires a second proof of identity in addition to your password. Even if a criminal learns your password, they cannot log in without that second factor. Enable it on every financial account that offers it, and on the email account linked to those accounts, since email is often used to reset passwords.

Not all second factors are equally strong. Authenticator apps and hardware security keys are generally more resistant to interception than codes sent by text message, which can be exposed through SIM-swap fraud. If text codes are the only option, they are still far better than no second factor at all. Ask your mobile carrier whether you can add a PIN or port-out lock to your phone number.

Use passkeys where available

Passkeys are a newer sign-in method supported by many banks, brokers and major technology platforms. Instead of typing a password, you confirm your identity with your device's fingerprint reader, face recognition or screen-lock PIN. Because a passkey is tied to the genuine website, it cannot be typed into a fake one, which makes it highly resistant to phishing. Where your provider offers passkeys, consider enabling them.

Use a password manager

Reusing passwords is one of the most common ways accounts are compromised: when one website suffers a data breach, criminals try the same credentials everywhere else. A reputable password manager generates and stores a long, unique password for every account, so you only need to remember one strong master password. Protect the password manager itself with 2FA.

Keep your devices clean

• Update promptly. Install operating system, browser and app updates as soon as practical; many fix actively exploited vulnerabilities.
• Lock your devices with a strong PIN, password or biometric, and enable remote locate-and-wipe features.
• Install apps only from official stores, and download your bank's or broker's app via links on its verified website.
• Avoid public Wi-Fi for financial activity unless you use a trusted connection, such as your mobile data.
• Never install remote-access software at the request of someone who contacted you. Legitimate banks do not need to control your screen.
• Review account alerts. Turn on notifications for logins, new payees, withdrawals and changes to contact details.

Protect your identity information

Limit what you share publicly online, such as your date of birth, address and the names of family members, which can help criminals answer security questions or impersonate you. Shred financial paperwork, review your statements regularly, and in countries where it is available, consider checking your credit report or placing a credit freeze.

How to recognise investment scams

Investment scams come in many forms — fake trading platforms, crypto schemes, "recovery" services, bogus bonds, romance-driven investment pitches and impersonations of real firms. The details change, but the warning signs are remarkably consistent.

Be especially cautious of so-called recovery services that contact people who have already lost money, offering to retrieve it for an upfront fee. These are frequently run by the same criminals, or by others targeting known victims.

Spotting fake bank websites and clone firms

A clone firm scam occurs when criminals copy the name, address, registration number and branding of a genuine, authorised firm to appear legitimate. Fake bank and broker websites can look almost identical to the real thing. Use these checks before trusting any financial website.

1. Check the domain carefully. Look for misspellings, extra words, hyphens or unusual endings (for example, a genuine brand name followed by "-secure" or "-login", or a different country domain). Type the address yourself or use a saved bookmark rather than clicking links in messages or ads.
2. Check the regulator's register. Search the official register of the relevant financial regulator — such as the SEC's and FINRA's BrokerCheck tools in the United States, the FCA's Financial Services Register in the United Kingdom, or national competent authority registers in the European Union. Confirm the firm is authorised for the activity it is offering.
3. Use contact details from the register, not the website. Clone firms often list genuine registration numbers but their own phone numbers and emails. Contact the firm using the details on the official register to verify who you are dealing with.
4. Check warning lists. Many regulators publish lists of unauthorised firms and known clones. The FCA Warning List and similar lists from other regulators are good places to look.
5. Be wary of new or anonymous websites. Sites with no verifiable physical address, generic stock photography, poor grammar or reviews that all sound the same deserve extra suspicion.
6. Remember that a padlock is not proof. The padlock icon only means the connection is encrypted; scam websites can have one too.

Impersonation calls and messages

Criminals often pose as your bank's fraud team, a government agency or even the police. They may know some of your details and create a sense of emergency: "your account is compromised, move your money to a safe account now." A genuine bank will never ask you to move money to a "safe account", reveal a one-time code, or share your full password or PIN.

If you receive such a call, hang up. Wait a few minutes, or use a different phone if you can, then call your bank using the number on the back of your card or on its official website. Caller ID can be faked, so the number displayed is not proof of identity.

What to do if you are targeted

If you think you have been contacted by a scammer, or if you have already shared details or sent money, act quickly. Speed can make a real difference to the chance of stopping a payment.

1. Stop all contact with the person or website. Do not send further money, even if promised a refund.
2. Contact your bank or payment provider immediately using an official number. Explain what happened, ask them to stop or recall any payments, and secure your accounts.
3. Change your passwords, starting with email and financial accounts, and enable 2FA. If you installed remote-access software, disconnect the device from the internet and have it checked.
4. Keep records — screenshots, website addresses, phone numbers, emails, transaction references and dates.
5. Report the scam to the appropriate authority where you live (see below).
6. Watch for follow-up scams, especially "recovery" offers.

Where to report

If a scam uses the RTIBK name, please also let us know through our contact page so we can warn other readers. We cannot recover funds or investigate crimes, but reports help us keep this guidance current.

Being targeted is not a sign of foolishness. Scams are run by organised, well-resourced groups, and anyone can be caught off guard. Reporting promptly helps protect you and others.

Investor security checklist

For more on how RTIBK operates, see our Disclosures & Editorial Policy. To keep learning about investing itself, visit our Insights.