OPEN
Learn about cybersecurity &
fraud to protect yourself.
Learn about cybersecurity &
fraud to protect yourself.
At Stifel, we are committed to helping you stay informed and protected. Explore this page for information on common cyber threats, fraud prevention tips, and resources to help safeguard your personal and financial information.
Click any topic below to learn more.
Unauthorized Account Access
Information on how criminals gain access to accounts and what warning signs indicate suspicious activity.
Common Scams
An overview of frequently used scams designed to steal money, personal information, or account credentials.
Senior Investor Protection
Guidance focused on helping older adults recognize, avoid, and report financial exploitation and fraud.
Our Security Program
A summary of the safeguards, monitoring, and controls in place to help protect accounts and personal data.
Phishing & Social Engineering
An explanation of deceptive tactics that trick individuals into revealing sensitive information.
Common Cyber Attacks
A breakdown of typical cyber threats used to compromise systems, data, or online accounts.
Payment and Money Movement Risks
Details on risks associated with transferring money and how fraudsters exploit payment channels.
What to Do If You Suspect Fraud
Clear steps to take immediately if you believe your account or information has been compromised.
Unauthorized account access (also called "account takeover") happens when someone gains access to your financial or online account without your permission and uses it to act as you. [ic3.gov], [investor.gov]
Criminals often try to get your login details (such as your username and password) through deception or by using stolen information.
They may send messages or create fake websites that look legitimate to trick you into entering your credentials or sharing security codes.
In some cases, they use information from data breaches or malicious software (malware) to gain access to accounts.
Once inside, they may change passwords, access personal information, or initiate transactions without your approval. [ic3.gov], [fbi.gov], [investor.gov]
Impersonation scams happen when someone pretends to be a trusted person or organization—such as a financial firm, government agency, or advisor—to try to get your money or personal information. [consumer.ftc.gov], [consumer.ftc.gov]
Scammers contact people through email, text message, phone calls, or social media while posing as a legitimate business, financial professional, or authority.
They may use real names, logos, or publicly available information to appear credible and gain your trust.
Messages often claim there is an urgent issue—such as a problem with an account—or offer help, prompting quick action without verification.
Some impersonators use spoofed phone numbers or look-alike email addresses so the contact appears to come from a legitimate source.
The goal is typically to convince you to send money, share personal details, or provide account access. [usa.gov], [investor.gov], [investor.gov], [consumer.ftc.gov], [consumer.ftc.gov], [usa.gov]
If you suspect you may have been the target of a scam, please contact your financial advisor as soon as possible.
Manipulative payout or advance fee scams (sometimes called sweepstakes or "you are owed funds" scams) involve messages claiming you have won money, received an award, or are owed funds—but require you to pay a fee or share information to receive it. [consumer.ftc.gov], [usa.gov]
These scams often begin with an unexpected letter, email, text, or social media message claiming you are entitled to a payment, prize, or settlement.
The message may appear official, using business names, logos, or government references to build credibility.
You may be asked to pay a fee in advance—such as for taxes, processing, or delivery—or to provide personal or financial information before funds can be released.
Scammers often create a sense of urgency or excitement to encourage quick action before you verify the claim.
The promised payment typically does not exist, and the goal is to obtain money or sensitive information. [usa.gov], [consumer.ftc.gov], [state.gov]
If you suspect you may have been the target of a scam, please contact your financial advisor as soon as possible.
"Safe account" or urgency-driven scams occur when someone falsely claims your account or money is at risk and pressures you to quickly move funds to a "safe" account they control. [consumer.ftc.gov], [ic3.gov]
Scammers contact you by phone, email, text, or social media while pretending to be from a financial institution, government agency, or other trusted organization.
They may claim there is suspicious activity, fraud, or a security issue involving your account to create concern.
You may be instructed to move money to another account, withdraw cash, or transfer funds to "protect" your assets.
These requests often come with urgency or warnings to act immediately, limiting your ability to verify the situation.
In reality, the "safe account" is controlled by the scammer, and the request is designed to move your money out of your control. [usa.gov], [consumer.ftc.gov], [consumer.ftc.gov], [state.gov]
If you suspect you may have been the target of a scam, please contact your financial advisor as soon as possible.
Tech support or brand impersonation scams occur when someone pretends to represent a well-known technology company or support service to convince you there is a problem with your device or account and get you to act quickly. [consumer.ftc.gov], [fbi.gov]
These scams often start with a pop-up message, email, text, or phone call claiming your device is infected or compromised.
The message may look like it comes from a trusted company and may include logos, warnings, or a phone number to call for help.
If you respond, the scammer may claim they can fix the issue and ask for payment or request access to your device.
In some cases, you may be asked to download software or grant remote access (control of your device from another location), which can allow the scammer to access information or accounts.
These scams rely on urgency and fear to prompt quick action without verification. [consumer.ftc.gov], [consumer.ftc.gov], [fbi.gov]
If you suspect you may have been the target of a scam, please contact your financial advisor as soon as possible.
Investment-related scams tied to social engineering involve someone building trust—often online—and then promoting a fake or misleading investment opportunity, such as cryptocurrency or alternative assets, to obtain money or personal information. [abcnews.com], [usa.gov]
These scams often begin with an unsolicited message, social media contact, or introduction through an online group or app.
The person may gradually build a relationship or present themselves as a knowledgeable investor or professional.
After trust is established, they introduce an investment opportunity that appears legitimate, sometimes using websites, documents, or online profiles that imitate real firms or credentials.
You may be encouraged to move funds to a specific account or platform, often outside traditional financial channels.
These schemes rely on trust, urgency, or the appearance of credibility to prompt action without independent verification. [usa.gov] [abcnews.com]
If you suspect you may have been the target of a scam, please contact your financial advisor as soon as possible.
A money mule scheme involves a person being used to receive and transfer money that came from fraud victims, often at the direction of someone else. [consumerfinance.gov], [fbi.gov]
Criminals recruit individuals—sometimes through online job offers, social media, or personal relationships—to move money on their behalf.
They may send money to the person (for example, by check or electronic transfer) and then ask them to quickly send some or all of it to another account or person.
The person may be told this is part of a job, a business transaction, or a personal request, without being told the money is stolen.
By moving funds through multiple people, criminals make it harder to trace where the money came from. [justice.gov], [consumerfinance.gov] [consumer.ftc.gov] [fbi.gov]
Senior investors can face increased risk of financial exploitation due to factors such as social isolation, changes in health, or increased reliance on others for assistance. Federal agencies recognize that awareness and early action are key to reducing the impact of scams and financial abuse targeting older adults. [federalreserve.gov], [sec.gov]
Financial exploitation of older adults can involve scams by strangers or misuse of funds by someone the individual knows, trusts, or by those with authority over a client's account. These situations can lead to significant financial and emotional harm, making education and awareness an important part of prevention. [federalreserve.gov], [justice.gov]
Helping protect client information is one of the many ways we care for our clients. Our security program is designed to help safeguard sensitive information, support secure operations, and strengthen resilience as threats continue to evolve. Stifel aligns its information security program to recognized frameworks, maintains written policies and standards, and applies layered safeguards intended to protect the confidentiality, integrity, and availability of information.
Protecting clients starts with a broad, layered approach to security. Stifel maintains written information security policies and standards, ongoing monitoring, secure development practices, access controls, encryption, and employee training and awareness activities. Together, these efforts are designed to help protect client information, support secure communications, and reduce the risk of unauthorized access or disclosure.
Security at Stifel is supported by formal governance and ongoing risk management. The Board of Directors, or its designated committee, provides oversight of information security risk and approves the firm's Written Information Security Program on an established cadence. Senior management is regularly informed of cybersecurity risks and significant security matters through defined reporting and escalation processes. Stifel also maintains an information security risk assessment program to identify, analyze, and prioritize threats and vulnerabilities, including risks related to third-party service providers.
Stifel uses multiple layers of technical, administrative, and operational safeguards to support a defense-in-depth approach. Depending on the need, these safeguards may include security monitoring and alerting, anti-malware protections, multifactor authentication, strong access controls, encryption, email and internet controls, physical security measures, patch and configuration management, secure file transfer, backup and recovery capabilities, and business continuity and disaster recovery testing. Stifel also classifies information based on sensitivity and business need so that appropriate protections can be applied.
Third-party providers are reviewed based on the services they provide and the level of risk involved. Stifel maintains a third-party risk management process that includes due diligence before onboarding and oversight throughout the vendor relationship. Where appropriate, this may include security assessments, monitoring expectations, contractual safeguards, and incident notification requirements. Stifel also maintains governance for cloud services and applies risk-based review and approval processes for third-party AI tools where applicable.
Stifel maintains a documented Security Incident Response program designed to identify, respond to, and recover from security incidents. The program includes defined processes for escalation, communication, and coordination across appropriate stakeholders, with notification processes aligned to legal and regulatory requirements where applicable. Resilience is further supported by backup, recovery, and continuity capabilities, along with exercises and testing intended to strengthen preparedness and reduce disruption.
Phishing and social engineering are tactics criminals use to trick people into sharing information, sending money, clicking unsafe links, or opening malicious attachments. These scams often create a sense of urgency, fear, or trust by pretending to be from a familiar person or organization.
The best defense is to slow down, look closely, and verify before you respond. A message may look legitimate, but small warning signs can reveal that something is not right.
Scam messages are designed to get a quick reaction. They may claim there is a problem with your account, a suspicious charge, a missed delivery, or an urgent request from someone you know. The goal is to make you act before you think.
Common warning signs include unexpected urgency, requests for passwords or verification codes, pressure to click a link right away, extremely long URLs, and messages that do not match the sender's normal tone. Be especially cautious if a message asks you to move money, share personal information, or bypass normal procedures.
When in doubt, do not use the contact information in the message itself. Instead, contact the company, advisor, bank, or family member using a phone number or website you know is real.
Email phishing is one of the most common online scams. Criminals send emails that appear to come from a trusted company, financial institution, coworker, or service provider. These emails often try to get you to click a link, open an attachment, or provide account details.
Some phishing emails are broad and generic, while others are highly personalized. They may reference a recent purchase, a known company, or even a real employee name to appear more believable. A fake email may also use a logo, branding, or formatting that looks professional.
Before responding to any unexpected email, take a closer look. Check the sender's email address, not just the display name. Hover over links before clicking if your device allows it, and be cautious with attachments you were not expecting. If the message seems unusual, go directly to the company's website or call them using a trusted number.
Example of a phishing email and its red flags:
Smishing is phishing by text message or messaging app. These scams often claim there is a problem with your bank account, a package delivery, a toll payment, or account security. Because text messages feel quick and personal, people are more likely to click without stopping to think.
A smishing message may include a shortened link, a fake tracking page, or a request to call a phone number. It may also ask you to reply with personal details or a one-time passcode. Even if the message mentions a real company, that does not mean it is legitimate.
If you receive an unexpected text, do not click the link. Instead, visit the company's website directly or contact them using official information you already trust. If the message appears to come from someone you know but feels unusual, verify it with them in another way before responding.
Example of a smishing message:
Vishing is a scam carried out over the phone. The caller may pretend to be from your bank, a government agency, a technology company, law enforcement, or even a relative in distress. They often use fear, urgency, or authority to pressure you into acting quickly.
Some scams begin with an email or voicemail asking you to call a number about a supposed charge, security issue, or account problem. When you call back, the scammer tries to gain your trust and convince you to share information, install software, or move money.
Be cautious of any caller who asks for account credentials, one-time codes, remote access to your computer, gift card purchases, or wire transfers. If a call feels suspicious, hang up and call the organization back using a number from its official website or your account statement.
Modern scams are becoming more convincing. Criminals may impersonate a trusted advisor, bank representative, government official, coworker, or family member. In some cases, they may use stolen photos, cloned voices, or AI-generated video and audio to make the message feel real.
A caller may sound like someone you know. A video message may appear authentic. An email may use familiar names and details. Even so, unexpected requests for money, account access, sensitive information, or secrecy should always raise concern.
If you receive an urgent request that seems emotional or unusual, pause before taking action. Verify the request through a separate trusted channel. For example, hang up and call the person back at a known number, contact your advisor through official contact information, or confirm the request with another family member. Verification is especially important when the request involves money movement, account changes, passwords, or personal information.
It is no longer safe to assume that a voice or video alone proves identity. Trust should come from independent verification, not just how convincing the message seems.
QR codes can be convenient, but scammers also use them to hide malicious links. A QR code posted in a public place, printed in a fake letter, or included in an email or text may send you to a fraudulent website designed to steal login information or payment details.
Because you cannot easily see where a QR code leads before scanning, it is important to be cautious. Do not scan codes from unknown sources, altered signs, or unexpected messages. If a QR code claims to take you to your bank, a payment page, or a login screen, consider typing the known website address yourself instead.
Be especially careful with QR codes tied to payments, parking, account verification, and password resets. A moment of caution can prevent you from entering information on a fake site.
Cyberattacks can take many forms, but most have a similar goal: to steal information, disrupt operations, gain access to accounts, or pressure victims into making payments or revealing sensitive data. Some attacks are broad and automated, while others are highly targeted and carefully planned.
Understanding the most common attack types can help individuals and organizations recognize risks earlier and respond more effectively. While the methods may change over time, the best protection still starts with awareness, strong security habits, and careful verification.
Artificial intelligence is making many tools more powerful, and cybercriminals are using it too. AI can help attackers create more convincing phishing emails, fake websites, realistic voice messages, and highly personalized scams. It can also help them move faster by generating large volumes of messages or adapting content to sound more natural and believable.
This means fraudulent messages may no longer contain obvious spelling mistakes or awkward language. A scam email may look polished. A phone call may sound realistic. A message may reference real names, companies, or events to appear trustworthy.
The most important safeguard is not to judge a message only by how professional or believable it looks. Instead, focus on whether the request is expected, whether it creates unusual pressure, and whether it can be verified through a trusted source. Even realistic content can be fraudulent.
Malware is malicious software designed to harm a device, steal information, or give criminals unauthorized access. It can arrive through unsafe links, infected attachments, compromised websites, fake software downloads, or other deceptive methods.
Ransomware is a specific type of malware that can lock files or systems and demand payment in exchange for restoring access. These attacks can affect individuals, businesses, hospitals, schools, and other organizations. In some cases, attackers also steal data and threaten to release it publicly.
Not every malware attack is obvious at first. A device may slow down, behave unusually, display unexpected pop-ups, or stop working properly. In other cases, the victim may not notice anything until files become inaccessible or suspicious activity is discovered.
Reducing risk starts with good security habits: avoid clicking unexpected links, be cautious with attachments, keep devices and software updated, and back up important information regularly.
A vulnerability is a weakness in software, hardware, or a system that attackers may use to gain access or cause harm. Criminals often look for known weaknesses in outdated software, unpatched systems, or poorly secured applications.
When a vulnerability is exploited, the attacker may be able to access data, run harmful programs, take control of a device, or move further into a network. Sometimes these attacks happen quietly in the background without the user seeing obvious warning signs.
This is one reason software updates are so important. Updates often include security fixes that close known weaknesses. Delaying updates can leave systems exposed longer than necessary.
For clients, the key takeaway is simple: Keep devices, apps, and operating systems current, and do not ignore security updates. Regular updates are one of the easiest and most effective ways to reduce exposure to common attacks.
Many cyberattacks focus on gaining access to accounts rather than attacking a device directly. Criminals may try to steal usernames and passwords, guess weak passwords, reuse passwords exposed in past data breaches, or trick people into sharing login details through phishing or impersonation.
Once an attacker gains access to an account, they may be able to view sensitive information, send fraudulent messages, reset passwords, make unauthorized changes, or use the account to target others. In some cases, a single compromised email account can lead to broader account takeovers elsewhere.
Identity attacks may also involve stolen personal information, fake login pages, or attempts to intercept security codes. Because of this, strong passwords alone are not always enough. Extra protections such as multifactor authentication can make unauthorized access much harder.
A good rule is to use strong, unique passwords for important accounts, enable extra verification when available, and never share your password or MFA code with anyone, even IT.
Not every cyber incident starts with a direct attack on the final target. In some cases, attackers go after a vendor, service provider, software provider, or another trusted third party first. This is often called supply chain or third-party cyber risk.
For example, a criminal may compromise a software update, exploit a weakness in a vendor's systems, or use a trusted business relationship to gain access or deliver fraudulent communications. Because these attacks come through a familiar source, they can be harder to detect.
Third-party risk is important because many organizations depend on outside providers for technology, communications, payments, and business services. A weakness at one provider can affect many clients or organizations at once.
For clients, the main point is that trust should still be paired with verification. Even communications or software connected to a known provider should be treated carefully if something seems unusual, unexpected, or inconsistent with normal business activity.
Payment and money movement risks involve situations where funds are transferred in ways that may be difficult to reverse once completed. Criminals often rely on urgency or deception to persuade individuals to move money quickly. [fbi.gov], [gao.gov]
Certain payment methods, such as wire transfers or peer-to-peer payments, are designed for speed and finality. When funds are sent as a result of deception, recovering them can be challenging, making prevention especially important. [gao.gov]
If you suspect fraud, acting promptly can help limit further harm and support reporting efforts. Federal agencies encourage individuals to report concerns even if they are unsure whether fraud has occurred.
Fraud is often underreported, which can make it harder for authorities to identify patterns and warn others. Reporting suspicious activity helps support investigation efforts and broader public awareness.
Unauthorized transactions — Activity you do not recognize or did not approve
Account compromise or identity concerns — Personal or account information may have been exposed
Phishing or suspicious communications — Messages asking for account details, passwords, or verification codes. Unexpected links or attachments
Stifel uses multiple layers of security designed to help protect client information and accounts, which may include:
Stifel will not:
How quickly should I report suspected fraud?
Immediately. Acting quickly can help limit further activity and ensure the situation is reviewed promptly.
What information should I gather before reporting?
Collect relevant details such as transaction records, account statements, emails, text messages, and any related communications.
Should I stop responding to suspicious messages or callers?
Yes. Discontinue communication and avoid providing any additional information or funds.
Where can I report fraud outside of my financial advisor?
You can report suspected fraud to government agencies such as the FTC and the FBI's Internet Crime Complaint Center (IC3), and you may also contact local law enforcement if appropriate.
What steps can I take to reduce risk going forward?
Regularly review your accounts, use strong passwords and available security features, and verify requests for money or sensitive information before taking action.
Unauthorized Account Access
Information on how criminals gain access to accounts and what warning signs indicate suspicious activity.
Common Scams
An overview of frequently used scams designed to steal money, personal information, or account credentials.
Senior Investor Protection
Guidance focused on helping older adults recognize, avoid, and report financial exploitation and fraud.
Our Security Program
A summary of the safeguards, monitoring, and controls in place to help protect accounts and personal data.
Phishing & Social Engineering
An explanation of deceptive tactics that trick individuals into revealing sensitive information.
Common Cyber Attacks
A breakdown of typical cyber threats used to compromise systems, data, or online accounts.
Payment and Money Movement Risks
Details on risks associated with transferring money and how fraudsters exploit payment channels.
What to Do If You Suspect Fraud
Clear steps to take immediately if you believe your account or information has been compromised.
Stifel is a diversified global wealth management and investment banking company focused on building relationships that help individuals, families, and organizations pursue their financial goals.
The iconic image of the bull and bear shows the dedication and spirit of each member of our firm. We are individually and collectively committed to using the forces of the market to benefit our clients.
This site is published in the United States for U.S. residents only. The services offered within this site are available exclusively through our U.S. Financial Advisors. Stifel Financial Advisors may only conduct business with residents of the states in which they are properly registered. The information on this web site is not an offer to sell or a solicitation of an offer to buy any security, nor shall any such security be offered or sold to any person in any jurisdiction in which such offer, solicitation, purchase, or sale may not lawfully be made. References to Stifel herein may apply to parent company Stifel Financial Corp. or any of its wholly owned subsidiaries, including Stifel, Nicolaus & Company, Incorporated, Member NYSE, FINRA, and SIPC.