Online Security: Protecting Your Money on the Internet

What you'll learn

• How online banking and payment apps actually move money behind the scenes
• The top risks (phishing, weak passwords, public Wi‑Fi) and how to block them
• How to create strong passwords and use two‑factor authentication (2FA)
• How to estimate the cost of a security mistake vs. low‑cost prevention
• Steps to secure accounts you can open at 18 (checking, brokerage, Roth IRA)
• How security choices connect to economics ideas you learn in social studies
• A simple action plan you can finish in under an hour

Concept explanation

Online money moves through accounts identified by usernames, email addresses, or phone numbers. To access an account, a service must verify “you are you.” This is called authentication. Most services start with something you know (a password). Stronger services add something you have (a phone, security key) or something you are (fingerprint/Face ID). Using more than one factor is called multi‑factor authentication (MFA).

Criminals try to trick you into giving up access. Common tricks include phishing (fake emails or texts that look real), fake websites that capture passwords, and social engineering (persuading support agents or friends to share codes). If they get into your bank or payment app, they can move your money quickly, sometimes within minutes.

Security is also about protecting your identity. If someone steals your Social Security number, birth date, or other personal data, they can open accounts in your name. That can damage your credit score right when you need it for student housing, a phone plan, or a first car.

The good news: a few habits—unique passwords, password managers, 2FA, careful Wi‑Fi use, and account alerts—reduce most risk. Think of security like wearing a seat belt. It doesn’t make driving risk‑free, but it dramatically reduces harm if something goes wrong.

Why it matters

At 18, you can open checking accounts, investment accounts, and a Roth IRA. You might start a part‑time job, receive scholarships, or save for college. Losing even a few hundred dollars to fraud can derail plans—like textbook money or a security deposit. Some losses are reimbursed, but not always, and the process can take time.

This also connects to economics:

• Incentives: Criminals target easy wins. Your goal is to make your account a hard target.
• Opportunity cost: Time spent enabling 2FA now may save hours (and money) later.
• Cost‑benefit analysis: A $20 security key or a free password manager can prevent losses that are 10x–100x larger.

Finally, your digital reputation matters. Colleges and employers expect basic cybersecurity hygiene, especially if you handle data in campus jobs or internships.

Calculation method

Let’s make security decisions with simple math.

1. Password strength (entropy)

• Entropy estimates how hard a password is to guess. More characters and more variety increase entropy.
• A rough formula for the number of possible passwords is:

• If your password uses lowercase letters only (26 characters) and is 8 characters long:

• If you use lowercase + uppercase + digits + symbols (say 95 common characters) and 12 characters:

• Takeaway: Jumping from 8 to 12 characters with a larger character set increases difficulty massively. That’s why password managers that generate long, random passwords are powerful.

2. Expected loss vs. prevention cost

• Suppose there’s a 5% yearly chance your payment app gets compromised with a $300 loss.
• Expected loss = probability × cost.

• A password manager (often free) plus 2FA (free) reduces your compromise probability. Let’s say to 0.5%.

• If a $20 security key drops risk further to 0.2%:

• Decision logic: Paying $20 once to reduce expected yearly loss by about$14.40 can make sense, especially if you use multiple accounts.

3. The cost of delay

• If $500 is stolen from your college savings for 6 months before recovery, you lose potential interest.
• At 5% annual yield (e.g., a high‑yield savings account), 6 months interest on $500 is:

• Even if you recover the principal, delayed access costs you time and potential growth.

Case study

Maya, age 18, works 12 hours/week at $16/hour and uses a payment app to split rent with a roommate and get paid for tutoring. She keeps$700 in checking, $800 in a high‑yield savings account for textbooks, and$300 in her payment app.

One evening, Maya gets a text: “Your bank detected suspicious activity. Verify now.” The link leads to a site that looks real. She enters her username and password. Seconds later, a push notification asks her to approve a login—she taps “Approve” without thinking. Within minutes, $280 is sent from her payment app to an unknown contact.

What went wrong?

• The text was phishing. The website captured her credentials.
• The attacker triggered a login and Maya approved the push (a social‑engineering trick called “MFA fatigue”).

Recovery steps she took the next day:

1. Contacted the payment app and bank support; reported unauthorized transfer.
2. Changed her bank and app passwords using a password manager, created 20‑character random passwords.
3. Switched from push‑based 2FA to app‑generated codes and added a hardware security key where supported.
4. Enabled transaction alerts and daily transfer limits.
5. Checked her credit reports and placed a free fraud alert.

Outcome:

• The payment app could not reverse the peer‑to‑peer transfer, but the bank flagged the linked debit as suspicious and reimbursed half.
• Total out‑of‑pocket loss: $140 plus time on support calls.
• Opportunity cost: If that $140 was meant for textbooks, she might need extra work hours to cover it.

Lesson: A few changes—password manager, stronger 2FA, alerts, and skepticism about links—could have prevented the loss.

Practical applications

Use this checklist as you open and manage accounts at 18.

Banking and payment apps

• Use a password manager to create unique, 16–24 character passwords for your bank, payment apps, and email (email is the key to resetting other accounts).
• Turn on 2FA everywhere. Prefer app‑generated codes or a hardware security key over SMS when possible.
• Enable instant alerts: transactions, new devices, password changes.
• Set transfer limits: daily and per‑transaction caps that fit your needs.
• Lock cards in the app when not in use; unlock to spend. Many banks support this.

On campus and on the go

• Public Wi‑Fi: Avoid logging into financial accounts on open networks. If you must, use your phone’s hotspot or a trusted VPN.
• Shared computers: Never check financial accounts on public or library computers. If you must, use private browsing, do not save passwords, and log out.
• Phishing defense: Don’t tap links in texts/emails claiming “urgent” money issues. Go directly to the app or type the official site address.

Identity protection

• Freeze your credit with each bureau once you start using credit; it’s free and blocks new accounts in your name. Temporarily lift it if you need to apply for credit.
• Use unique emails for important accounts (e.g., a dedicated address for banking) to reduce exposure if one site is breached.
• Minimize oversharing: Don’t post your school ID, dorm address, or birthday publicly.

Investment accounts at 18

• Brokerage and Roth IRA: Treat these like bank accounts—long, unique passwords and strong 2FA.
• Paperless statements to reduce mail theft; keep digital statements in a secure cloud drive.
• Turn on trade confirmations and money‑movement alerts (deposits/withdrawals).

If something goes wrong

• Act fast: Change passwords, revoke sessions/devices, contact support, report unauthorized transactions.
• Document everything: dates, times, screenshots, case numbers.
• File reports with your bank/app and consider reporting to relevant consumer protection agencies if needed.

Common misconceptions

Summary

Glossary

Authentication: Verifying your identity before granting account access, often via passwords and 2FA.

Two-factor authentication (2FA): Security that requires two proofs of identity, such as a password plus a code or security key.

Multi-factor authentication (MFA): Using two or more independent authentication factors (knowledge, possession, inherence).

Password manager: An app that creates and stores strong, unique passwords and fills them in securely.

Phishing: Fraudulent messages that trick you into revealing passwords or codes on fake sites.

Encryption: Protecting data by turning it into unreadable code unless you have the key.

VPN: A virtual private network that encrypts your internet traffic, useful on untrusted networks.

Credit freeze: A free lock on your credit reports that prevents new accounts from being opened in your name.

SIM swap: When someone hijacks your phone number to intercept SMS codes and reset accounts.

HTTPS: A secure version of HTTP; the browser shows a lock icon when a site connection is encrypted.