5.4: Hardening the Money

Hardening the Money

Follow any attack in this course far enough downstream and it lands in the same place: money. Credentials get stuffed to reach stored cards. SIM swaps exist to catch bank reset codes. Identity data from breaches becomes loans opened in your name. This lesson is five levers, each aimed at a specific move attackers make against the money itself. All five are free, and two of them almost nobody has heard of.

(A scope note: several of these are U.S.-specific, the freezes and the IRS PIN especially. The principles travel; the phone numbers don’t.)

Lever 1: The carrier PIN (the SIM-swap counter)

Lesson 3.1’s unfinished business. A SIM swap works by convincing your carrier’s support staff to move your number, and the counter is a carrier account PIN — called a security PIN, port-out PIN, or Number Lock depending on the carrier. It’s a code required before your number can be moved or ported, and it takes about three minutes to set in your carrier account’s security settings. Generate it, store it in the manager, and the “customer” calling to steal your number now needs a secret that doesn’t appear in any breach dump. Your phone number guards your 2FA fallbacks and half your resets. This PIN guards the number.

Lever 2: The credit freeze (the identity-theft counter, U.S.)

The endgame for breached identity data is often a loan, card, or account opened as you. A credit freeze blocks the play at the source: creditors can’t pull your file, so applications in your name die at the credit check. Freezing is free by law at all three bureaus — Equifax, Experian, and TransUnion — and you file with each of the three separately, about ten minutes total, online. Each gives you a PIN or account for unfreezing later, also free, temporarily or permanently, for the day you apply for something real. That’s the entire cost: remembering to thaw before financing a car. In exchange, the most common form of identity theft simply stops working on you. Freeze the three files, store the three PINs in the manager, done.

Lever 3: Transaction alerts (the tripwire on every card)

The breach-alert logic of 5.1, applied to money. Every bank and card app can push a notification per transaction, or above a threshold you set low or at zero. Fraudulent charges stop being something you discover in a statement three weeks later and become something your pocket buzzes about in real time — and fast disputes are easy disputes. Five minutes per card app, and the best alert-to-effort ratio in this module.

Lever 4: Virtual card numbers (one number per merchant)

Several banks and card issuers, and services like Privacy.com, can mint virtual card numbers: disposable numbers that charge your real account but can be locked to one merchant, capped, or cancelled on their own. You’ll recognize the pattern — it’s 5.2, applied to payment. The number stored by the pet-supply store can’t buy anything anywhere else, and killing it costs you nothing. Where your bank offers this, use virtual numbers for online merchants, especially the small ones your card data trusts furthest.

Lever 5: The IRS IP PIN (the tax-fraud counter nobody knows, U.S.)

The sleeper of the list. Tax-refund fraud is straightforward: someone with your Social Security number — and the breach economy is swimming in them — files a return as you, early, and takes the refund. You find out when your real return bounces. The counter is the IRS Identity Protection PIN: a six-digit code, free from irs.gov (search “IP PIN”), without which no e-filed return in your name is accepted. It was originally for confirmed victims only, but it’s been open to everyone for years, and almost nobody has enrolled. Enroll once, and the IRS issues a fresh PIN each season through your account. Think of it as the credit freeze’s twin, for the one identity number you can’t rotate.

The pass

Carrier PIN set. Three freezes filed, PINs in the vault. Every card app buzzing per transaction. Virtual numbers where offered. IP PIN enrolled. Call it forty-five minutes across a weekend, once, aimed at the exact plays that turn “my data leaked” into “my money left.” One lesson remains before the checklist: the audit of everything you’ve said yes to since 2015.