CFO Corner Week 40: 5 Things to Lock Down Before You Spend a Single Holiday Dollar
October is Cybersecurity Awareness Month, and it arrives right before the busiest shopping season of the year — which is exactly when scammers get busiest too. According to the Federal Trade Commission, Americans reported losing a record $15.9 billion to fraud last year. This week's CFO Corner is a five-item checklist to lock down your money before holiday shopping starts.
The Reframe Protecting your money is part of managing your money. Budgeting, saving, and investing can all be undone by one bad click. Think of this as the security system on the rest of your financial plan — not the exciting part, but the part that keeps the exciting parts safe.
The myth to clear up "I'd notice a scam" isn't a strategy anymore. The old giveaways — typos, awkward grammar, off-looking logos — are mostly gone. Senders can be faked and fake sites look identical to real ones. What protects you is a set of rules you follow every time, not your ability to spot something "off."
The Five Things to Lock Down
The three phishing red flags. Unexpected + urgent + asks you to click, pay, or "verify." When all three show up together, stop. Never use the link or phone number in the message — go directly to the company's app or website.
Fake delivery texts. The Postal Service only texts about a package if you signed up for tracking on that specific package, and those texts don't include links. If you're expecting something, look up the tracking number on the carrier's site yourself. Forward scam texts to 7726 (SPAM) to report them.
How you pay. Gift cards, wire transfers, crypto, or payment-app transfers to strangers are always a red flag. Shop online with a credit card rather than debit: if a $400 purchase turns out to be fake, a credit card dispute puts the bank's money on the line while it's investigated — with debit, that $400 is already gone from your checking account while you wait.
Lock down your identity — pick your level. Everything below is free. See the full checklist at the end of these notes.
Level 1 (the 15-minute version): Turn on transaction alerts, freeze your credit at the big three bureaus, lock your phone number with your carrier, and pick a family safe word to beat AI voice-clone scams.
Level 2 (the full lockdown): Freeze the specialty bureaus that payday lenders, banks, and phone/utility companies check — a big-three freeze doesn't cover them — and get an IRS Identity Protection PIN.
What about LifeLock and similar services? They aren't scams — some include credit and payday loan locks, plus identity restoration help. Before paying for one, check your employer benefits; many offer identity protection for free. But you can place freezes yourself at no cost, so freeze first. A paid service earns its keep if you want someone else watching and handling the cleanup.
What to do if something looks off. Don't engage. Call your bank using the number on the back of your card. Change passwords on anything exposed and turn on two-factor authentication. Report it at ReportFraud.ftc.gov, or IdentityTheft.gov if your information is being used.
The honest reality check None of this makes you scam-proof. Careful people get caught every day — usually because a message landed at the wrong moment. If it happens, don't let embarrassment slow you down: the faster you contact your bank, the more you can usually recover. The goal is to be a harder target and to catch problems fast.
This week's homework
Do the 15-minute version today: transaction alerts on, credit frozen at the big three, phone number locked.
Pick your family safe word this week — in person, never by text.
Want the full lockdown? Work through the checklist below, one freeze at a time. And whatever level you choose: never use a link from a text about money or a package. Always go direct.
The Lockdown Checklist
Transaction alerts: Turn them on in your bank and credit card apps so you're notified every time a card is used.
Freeze the big three: Equifax, Experian, and TransUnion. Free, doesn't affect your score, and you can lift it in minutes when you apply for credit.
Lock your phone number: Blocks a scammer from moving your number to their phone and receiving your bank's security codes. In your carrier's app: Verizon → Number Lock + SIM Protection; AT&T → Wireless Account Lock; T-Mobile → SIM Protection.
Family safe word: The FBI recommends a secret word or phrase to verify family members on the phone. Choose it in person and never text or post it. No word? Hang up and call back on the number you already have.
Level 2 — the full lockdown (for anyone who wants to go all the way)
A freeze at the big three doesn't cover these specialty bureaus. All are legitimate consumer reporting companies on the CFPB's official list, and all offer free freezes. Save each PIN they give you in your password manager.
Clarity Services, FactorTrust, and DataX — checked by payday lenders and rent-to-own stores. Freezing them helps block a payday loan in your name. (Clarity; find FactorTrust and DataX contact info on the CFPB list above.)
ChexSystems — checked by banks before opening a checking account. Freezing it stops someone from opening a bank account as you. (Freeze here) Note: you'll need to lift it before opening a new account yourself.
NCTUE — checked by phone, cable, and utility companies. (Freeze here) Lift it before setting up new service, like when you move.
Innovis — the lesser-known "fourth" credit bureau. (Freeze here)
LexisNexis Risk Solutions — used for identity checks across many industries. (Freeze here)
IRS Identity Protection PIN — a free six-digit code that blocks anyone from filing a tax return with your Social Security number. You get a new one each year. (Get yours here) Timing tip: the IRS online tool is generally unavailable from mid-November to mid-January, so fall is a good time to do it.
Reflection prompt: Think about the last time a message made you feel like you had to act right now. What would it look like to give yourself permission to wait?
