The Perimeter

A buddy of mine, a guy who runs a profitable little logistics company and is smarter than me about most things, called me in August sounding like he'd been punched.

Someone had opened a credit card in his name, then a second one, then tried to open a business line of credit using his EIN. They'd ported his phone number to a new SIM, which meant every "we just sent you a code" text was going straight to them. He found out because his phone suddenly said "No Service" in the middle of a Tuesday afternoon.

Total damage when the dust settled: about 11,000 dollars in charges he eventually got reversed, roughly 40 hours of his life on hold with banks, and a credit report that still looks like a crime scene.

He didn't click anything dumb. The thieves walked through doors he didn't know existed, doors most of us leave propped open by default.

October is Cybersecurity Awareness Month, which usually means your bank sends you a cheerful email about strong passwords and you delete it. I'd rather give you something you can actually run. So this week's System Drop is the perimeter I built around my own money, and the exact order I'd build it in if I were starting from zero this weekend.

The FTC said in March that consumers filed about 3 million fraud reports in 2025 and reported 15.9 billion dollars in losses. That's up from roughly 12.5 billion the year before, and the agency says reported losses have climbed close to 430 percent since 2020.

The FBI's internet crime unit tallied about 20.9 billion dollars in reported cybercrime losses for 2025, up 26 percent. For the first time it broke out AI as its own category: around 22,000 complaints and 893 million dollars in losses tied to AI tools.

Two details from the FTC data matter more than the headline. Text messages were the most common way scammers made first contact. And the biggest losses came from people sending money through ordinary bank payments. Not gift cards. Not crypto ATMs. Normal bank transfers.

Translation: the attack surface is your phone, your inbox, and your checking account. The boring stuff you touch every day.

Most people think about security as one thing. A password. Maybe a code. If the password is good, you're safe.

That's a nice front door lock on a building with the loading dock wide open.

I think about it as five rings, from the outside in:

Ring 1: Your credit files, which decide whether anyone can open new accounts as you.

Ring 2: Your government identity, meaning the IRS, Social Security, and the Postal Service.

Ring 3: Your phone number and your email, which are the master keys to everything else.

Ring 4: Your actual money accounts and the alerts on them.

Ring 5: The human layer, which is you, your spouse, and your parents picking up a phone call that sounds exactly like someone you love.

A thief only needs one ring open. You need all five closed. The good news: closing them is mostly a one-time job that keeps working while you sleep.

A credit freeze stops lenders from pulling your credit file, which means nobody can open a new card or loan in your name. It's been free by federal law since 2018. It doesn't touch your credit score. And you can lift it in about two minutes when you actually need to apply for something.

Everybody knows about Equifax, Experian, and TransUnion. Freeze all three. But almost nobody freezes the next layer, and that's where my buddy got burned.

Innovis. The fourth credit bureau. Smaller, still used by some lenders, still free to freeze.

ChexSystems. This is the file banks check when someone opens a new checking or savings account. Freeze it and nobody can open a bank account in your name to launder money through.

NCTUE. The exchange that phone, cable, and utility companies use. This is how thieves open phone lines in your name, which is often step one of a bigger play.

LexisNexis Risk Solutions. Insurers and some lenders pull from here. It also offers a freeze.

That's seven freezes. Budget about 45 minutes, because a couple of these sites look like nobody has touched them since 2009.

Two pro moves here. First, store every freeze PIN and login in your password manager the second you create it. Second, if you have kids, freeze their files too. Children's Social Security numbers are prized because nobody checks a ten-year-old's credit until they apply for a student loan at eighteen.

A fraud alert is not a freeze, by the way. An alert asks lenders nicely to double check. A freeze locks the door.

This one feels backwards, so stay with me.

A lot of people avoid creating online accounts with the IRS and Social Security because they figure fewer accounts means less risk. The opposite is true. If you haven't claimed your account, a thief with your Social Security number and date of birth can claim it for you, change your direct deposit, and read your whole earnings history.

Get an IRS Identity Protection PIN. Anyone who can verify their identity can sign up through their IRS Online Account. Once you have one, a tax return can't be filed under your Social Security number without that six-digit PIN. You get a new one every year. This is the single best defense against someone filing a fake return in February and pocketing your refund. Do it for your spouse and dependents too.

Create your my Social Security account. Then turn on every security option it offers. If you're truly never going to use it, the SSA lets you block electronic access entirely, so nobody can create an account or change your information online. Either way, the account should exist on your terms, not a stranger's.

Sign up for USPS Informed Delivery. You get a morning email with scans of the mail coming that day. Mail theft is still a huge deal for check fraud and new card intercepts. If a credit card envelope shows up in the scan and never shows up in your mailbox, you know about it the same day instead of next month. And just like the government accounts, if you don't claim Informed Delivery for your address, someone else can.

Total time for Ring 2: about 30 minutes.

This is the ring that hurts most when it fails.

Whoever controls your phone number and your primary inbox controls almost everything else. That's why SIM swapping works. The thief doesn't hack your bank. They talk a carrier rep into moving your number to their phone, then hit "forgot password" everywhere.

Lock your number at the carrier. T-Mobile calls it SIM Protection. Verizon calls it Number Lock. AT&T calls it Wireless Account Lock. The names change, the idea doesn't: nobody can port or swap your number without extra verification. While you're in there, change your account PIN to something that isn't your birthday or the last four of anything.

Upgrade your email. Your primary email should have the strongest login you own: a passkey or a hardware security key, not a text message code. If you're still using SMS codes on your main inbox, that's the first thing to fix this weekend.

Consider a separate email just for money. I use one address for banks, brokerages, and tax stuff, and I never give it to a store, a newsletter, or a contractor. It never shows up in a data breach dump with my shopping history attached, so it's a lot harder to target.

Kill text codes where you can. Anywhere a financial account offers an authenticator app or a passkey, switch to it. Text codes are better than nothing. They're just not much better than nothing when the number itself can be stolen.

The goal here is simple. If money moves, you hear about it in seconds, not at the end of the month when you finally glance at a statement.

Log into every bank, card, and brokerage account and turn on alerts for:

Then do a few things almost nobody does.

Set a verbal password with your bank. Most banks will add one if you ask. A caller who has your Social Security number and mother's maiden name still can't get past it.

Lower your peer-to-peer limits. If your Zelle or instant transfer limit is set to the maximum and you never send more than a few hundred dollars, drop it. You can raise it later in thirty seconds. A thief can't.

Add a trusted contact on your brokerage accounts. Brokerages are required to make a reasonable effort to collect this. It's a person they can call if something looks off. It doesn't give that person any access to your money.

Close the dormant stuff. That savings account from 2017 with 43 dollars in it is a door you forgot you had. Close it.

Now, here's the honest problem with alerts. Turn them all on and you'll get forty emails a week, and by week three you'll be ignoring all of them. Which brings me to the automation.

I route every bank and card alert into one place with Make.com. A scenario watches a dedicated label in my inbox, reads each alert, and logs it to a single sheet. Routine stuff, like my utility autopay hitting on the same day it always does, just gets logged. Anything that matches a short list of red flags pings my phone right away: a new payee, a contact info change, a login from a new device, or any transfer over a threshold I set. Took me about an hour to build. Now I read maybe two alerts a week instead of forty, and the two I read actually matter.

Rings one through four protect you from strangers who have your data. Ring five protects you from strangers who have your voice.

Voice cloning tools can build a convincing copy of someone from a few seconds of audio. If you've ever posted a video, left a voicemail greeting, or been on a podcast, the raw material is out there. The play is always the same: a panicked call from someone you love, a crisis, and a request for money right now.

So build three rules into your household, out loud, this week.

The safe word. Pick a word or phrase your family will use to verify a real emergency. Something that's never been posted, never been texted, never been said on a video. If the "grandson in jail" can't say it, it's not your grandson.

The callback rule. No money moves on an inbound call. Ever. If your "bank" calls about fraud, hang up and call the number on the back of your card. If your "CEO" calls asking for a wire, hang up and call the number you already have.

The 24-hour rule. Any request to move money that comes with urgency gets 24 hours. Real emergencies survive a day. Scams usually don't.

When I get a message I'm not sure about, I paste the text into Galaxy.ai and ask it to list every manipulation tactic it can spot: urgency, authority, secrecy, an unusual payment method. Strip out any account numbers first. It's not a replacement for judgment, but it's a fast second opinion when your heart rate is up, and that's exactly when your judgment is at its worst.

If you only do one thing from this issue, block 90 minutes this Saturday and run it in this order.

Minutes 0 to 15: Lock your phone number at your carrier and change the account PIN. This is first because it protects every reset that comes after.

Minutes 15 to 30: Upgrade your primary email to a passkey or security key. Review recovery options and delete any old phone numbers or backup emails you don't control anymore.

Minutes 30 to 75: Run all seven freezes. Equifax, Experian, TransUnion, Innovis, ChexSystems, NCTUE, LexisNexis. Save every PIN in your password manager as you go.

Minutes 75 to 90: Request your IRS IP PIN and claim your my Social Security account.

Next weekend, take another hour for Ring 4: alerts, verbal passwords, transfer limits, trusted contacts. Then have the safe word conversation at dinner. It'll feel a little silly. Do it anyway.

Don't spiral. Move in this order.

Call the fraud department of every affected account using the number on your card or statement, not any number in an email or text. Freeze your credit files if you haven't. File a report at IdentityTheft.gov, which builds a personal recovery plan and generates the official report you'll need for disputes. If money left your account electronically, also file at ic3.gov, and do it fast. Speed is the whole game in recovery. And if a fake tax return was filed, the IRS has a specific identity theft affidavit, Form 14039, to get that untangled.

Keep a log of every call: date, time, name, what they said.

My buddy said something after it was all over that I keep thinking about. "I spent ten years building this business and never spent one afternoon protecting what it pays me."

That's most of us. We'll spend weeks optimizing a portfolio for an extra half a percent and zero hours making sure nobody can drain it in an afternoon. Return on capital matters. Return of capital matters more.

Wealth that isn't defended isn't really wealth yet. It's inventory waiting for someone else to pick it up.

So build the perimeter. Ninety minutes. Then go back to making money with a little less to worry about.

Want the whole lockdown in one place?

I built The Perimeter Kit so you don't have to hunt for any of this. It includes the 90-minute Saturday checklist with direct steps for all seven freezes, a password manager template for storing every freeze PIN, the carrier lock instructions for the big three, the full Ring 4 alert settings list, the Make.com alert router blueprint with my red flag rules, a family safe word guide you can walk through at dinner, and a one-page "if you're hit" response card you can print and stick in a drawer.

Reply to this email with the word PERIMETER and I'll send it over.

One more thing.

The Grid Inner Circle is where we actually do this stuff together instead of just reading about it. This month we're running live build sessions on the alert router, and members can bring their own setup and get it pressure-tested before something goes wrong, not after.

It's 29 dollars a month. Or grab the lifetime seat for 499 dollars, one payment, with every future system, live call, and teardown included for as long as the Circle runs. That founding price goes away once the room fills, and if you're planning to stick around, it's the better deal by a wide margin.

Reply with the word LIFETIME and I'll send you the details and the link.

See you Wednesday.

Alex Rivera, Wealth Architect at Wealth Grid