Let your bank tap you on the shoulder
Checked
Without alerts, you might not learn that something went wrong with an account until you read your next statement. Alerts can shorten that wait. With a few settings in your banking app, your bank can tap you on the shoulder when something you've asked it to watch for happens.
Talk about it at home: jump to the Table Talks
What account takeover means
An account takeover is when criminals get into one of your accounts without permission. FINRA (the Financial Industry Regulatory Authority, a self-regulatory organization that oversees U.S. brokerage firms under the supervision of the SEC) describes it as criminals stealing customer information, such as usernames, passwords, or the security codes used for multifactor authentication, to gain access to personal accounts, including online financial accounts. Multifactor authentication (MFA) means logging in with two or more different kinds of proof, such as a password plus a code sent by text, or a password plus a fingerprint.
FINRA lists several common ways takeovers start:
- Phishing and smishing. A fake email (phishing) or text message (smishing) that looks like it comes from a real firm or a regulator and asks for information they would never request that way, such as an account number, password, credit card details, or Social Security number.
- Fake websites. Copies of a bank's login page or support center, reached through links in messages or even through search engine results.
- Phone tricks. A caller pretending to be from your financial institution to get your personal information or account details.
- Stolen logins. Usernames and passwords exposed in data breaches or sold online, or captured by malicious software that records what you type.
Do this now: Think of one account where you use the same password as somewhere else, and plan to change it this week.
Signs something is wrong
FINRA says signs of a possible takeover include:
- transactions, money movements, or deposits you don't recognize
- missing money or investments
- changes to your address, email, or phone number that you didn't make
- notices about account changes you didn't request
- a flood of spam texts or emails right after you try to log in
- your mobile phone service suddenly stops working, especially if your account sends login codes by text (a tactic called SIM swapping, where a criminal tricks your phone company into moving your number to a device they control)
- missing statements or other account documents
- accounts or creditors you don't recognize on your credit report
Do this now: Open your banking app and look over the last two weeks of activity. If anything doesn't look right, tell your bank right away.
Turn on the alerts your bank offers
FINRA says most financial institutions offer optional text alerts, email alerts, or app notifications. The FDIC (Federal Deposit Insurance Corporation, the independent federal agency that insures deposits at FDIC-insured banks) says many banks offer several alerts. Between them, the two name these:
- Low balance: when your balance drops below a certain level (FDIC)
- Large transactions: when a transaction is over a certain amount (FDIC) or a purchase is over a set amount (FINRA)
- Transactions outside the United States (FDIC), or purchases made in a different state (FINRA)
- Account changes: whenever a change is made to your account (FINRA)
- Online transactions: for any online transaction (FINRA)
Alerts vary by bank, so check what yours offers. FINRA notes that paying attention to these notifications can help you spot unusual or unauthorized activity when it happens.
Do this now: Turn on at least two alerts tonight: one for transactions over an amount you choose, and one for any change to your account, if your bank offers it.
Your code is the second key
When you log in to your bank, you may get a verification code by text or email. The FTC (Federal Trade Commission) compares your password and that code to the lock on your doorknob and a deadbolt: unlock one but not the other, and you still can't get in. Scammers need both keys too. That's why scammers try to trick you into reading the code to them.
The rules here are simple, and they come straight from the sources:
- The FTC says never give your verification code to anyone else. It's only for you to log in, and anyone who asks you for it is a scammer.
- The CFPB (Consumer Financial Protection Bureau) says banks and credit unions never ask for account information by email or text.
- FINRA says a real firm or regulator would never ask for your account number, password, credit card information, or Social Security number by email or text.
Scammers may sound kind and helpful, and they may already know some things about you. That doesn't make them your bank.
Do this now: Make a personal rule: you never read a verification code to anyone, for any reason.
If an alert fires or something looks off
- Don't click. FINRA says not to click links in suspicious messages. Go directly to your bank's website or app instead.
- Call a number you trust. The FTC says to use the number on your statement or in your app, never one a caller gives you. The CFPB says to get the number from a different source than the message.
- Report it fast. The FDIC says to tell your bank right away about deposits or withdrawals you didn't make. If your bank spots a possible takeover, FINRA notes it may freeze the account to protect you from further losses.
- Change passwords. If an account is breached, FINRA says to change the username and password for it and for any other account that used the same login.
- Protect your credit. FINRA suggests you might also place a fraud alert or security freeze with each credit bureau. For identity theft help, FINRA points to the FTC's IdentityTheft.gov.
- Report code requests. The FTC says to report anyone who asks for your verification code at ReportFraud.ftc.gov.
Do this now: Save your bank's customer service number in your phone contacts, using the number on your statement, in your bank's app, or on the back of your card.
Shore up the front door
FINRA recommends a different password for each account and suggests you consider using a password manager to create and save them. It also recommends turning on multifactor authentication, which it says can significantly reduce the likelihood of a takeover.
Do this now: Turn on multifactor authentication for your main bank account if it isn't on already.
Teach it this week
Big idea: Alerts help you spot account trouble as it happens, and a verification code is a key you never hand to anyone.
Background for parents and grandparents: FINRA explains how takeovers happen and which alerts help on its page FINRA: customer account takeovers.
Table Talks (10 minutes)
- Start (2 min): Ask your family: if someone moved money out of your account today, how long would it take you to notice?
- Explain (3 min): Go over the common takeover routes, the signs of trouble, and the rule that anyone asking for your verification code is a scammer.
- Try it (4 min): For a made-up teen's checking account, kids and grown-ups choose three alerts from the list and talk through what each one would catch.
- Wrap-up (1 min): Everyone names the one thing they would never share, and the number they would call instead.
Talk it over
- Ask how each person currently finds out about activity on their accounts.
- Read the list of alert types together.
- Agree on a family rule: nobody reads a verification code to anyone.
- Tonight's action: each adult turns on one alert in their banking app.
No real passwords, codes, or account details should be shared during this activity. Free to use; please keep the source credit.
Education only, not financial, legal or tax advice. Not a registered investment adviser.
Sources
Primary sources
- FINRA: customer account takeovers, what they are and how to protect yourself, date checked: Oct 22, 2026
- FDIC Money Smart: manage my checking account (PDF), date checked: Oct 22, 2026
- FTC: what's a verification code and why would someone ask me for it, date checked: Oct 22, 2026 (alert dated March 7, 2024)
Supporting links
- CFPB: a bank asked me to "verify" my account by email or text, date checked: Oct 22, 2026
- FTC: IdentityTheft.gov, date checked: Oct 22, 2026
Sources for definitions and descriptions
- FINRA: about FINRA, date checked: Oct 22, 2026
- FINRA: SIM swapping risks to investors (October 29, 2024), date checked: Oct 22, 2026
- FCC: cell phone fraud, including SIM swapping and port-out scams, date checked: Oct 22, 2026
- FDIC: about the FDIC, date checked: Oct 22, 2026
- FDIC: deposit insurance, date checked: Oct 22, 2026