By Dan Petty
Introduction
Ten years ago, account security advice for a financial advisory firm fit on an index card. Use a long, complex password. Don’t reuse it. Don’t click phishing links. Turn on multi-factor authentication (MFA).
All of it still applies. But two parts of that advice are under pressure: phishing is getting harder to recognize, and attackers are getting better at defeating the traditional MFA.
For years, “don’t click phishing links” was something you could actually do, because phishing announced itself—broken grammar, a logo pulled at the wrong resolution, a sender address that fell apart under inspection. Those tells are gone. AI produces convincing phishing copy in anyone’s voice, at scale, and it keeps getting better at it.
A phishing email today can arrive from a client’s real, compromised mailbox, reference the trade you discussed last week, and ask for something that fits the relationship. There is nothing to notice. Which is why the defense shouldn’t depend on noticing.
Two-factor authentication has a different kind of problem. The code didn’t get weaker; it became worth stealing, and the tooling to steal it is now off-the-shelf. We’ll come to that below.
Why advisory firms are targeted
Most security guidance is written for individuals protecting their own money. That is not your situation.
An advisor credential is a key to many households’ accounts at once. The blast radius of one compromised login isn’t one client—it’s the book. Advisory firms draw attention out of proportion to their size for exactly that reason. That is not a reflection of how carefully a firm operates. It reflects the value behind the login.
The industry data says the exposure is widespread. In the FIDO Alliance’s State of Passkeys 2026 study, 57% of organizations still rely on phishable authentication methods for employees’ primary day-to-day sign-in, and a third of people surveyed experienced an account compromise or received a breach notification in the past year.
The limits of one-time codes
Which brings us to the last line on that index card. The standard answer to a stolen password—a six-digit code, or OTP—is now something attackers have learned to steal.
A modern phishing kit sits between you and the real site, relaying in real time. You enter your password; the kit passes it along. The real site sends a one-time code; the fake page asks for it, and you type it in, because you were expecting to be asked. The kit forwards it and keeps the session.
Nothing about that looks wrong from where you’re sitting. The code is real, and you used it correctly. The only difference is who ends up signed in.
SMS codes have a second problem on top of that: a SIM swap moves your phone number to someone else’s device, and the code follows the number. Authenticator apps close this second gap, but not the first one: a code you can read is a code you can be talked into typing somewhere.
The pattern underneath all of this: any credential you can read, copy, or repeat is a credential that can be taken from you. Passwords, SMS codes, authenticator codes, backup codes. All of them are things you know and can therefore hand over—usually without realizing you have.
What a passkey does differently
A passkey is not a stronger password. It’s a different kind of credential—one with no shared secret at either end. The standard behind it was developed through the FIDO Alliance and is built into Apple, Google, and Microsoft platforms.
Passkeys use public key cryptography. When you create a passkey, your device generates a cryptographic key pair: a public key and a private key. The public key goes to Altruist. The private key stays in your device’s secure storage and never leaves it. To sign in, you unlock the device in front of you using biometric authentication—such as Touch ID, Face ID, Windows Hello, or a device PIN—and it proves it holds the private key without sending the key anywhere.
As a result:
- There is no shared secret. We hold only the public half, which is useless to anyone who takes it. There’s nothing to guess, so brute-force attacks have no target, and credential-stuffing attacks—where passwords leaked from data breaches at one company get replayed against accounts everywhere else—have nothing to work with against a passkey. Your biometric data never reaches us—it stays on your device.
- There is nothing to hand over. No code arrives on your phone, and none appears on your screen for you to type somewhere else. There is no step where a convincing stranger can talk you out of something, and nothing for a SIM swap to redirect.
- It will not work on a fake site. This is what makes a passkey phishing-resistant: it is cryptographically bound to the domain it was created for. On a lookalike domain, your passkey simply does not function. The browser won’t offer it. The protection doesn’t depend on you noticing anything.
Passkeys don’t close every door. Session hijacking after a legitimate sign-in, malware on the device itself, and social engineering aimed at your operations staff rather than your login are all still live risks—we cover the wider picture in “Essential cybersecurity strategies for independent investment advisors.” Passkeys close the one that gets used most.
What this looks like at Altruist
We’re starting with the second factor. Today, a passkey takes the place of the six-digit code: you enter your password as usual, then approve the sign-in with a fingerprint or facial recognition instead of typing in digits. That one substitution makes your second factor phishing-resistant: it closes the phishing attack described earlier, which depended entirely on the code.
Setup takes about a minute. In Account Settings, go to Profile → Security, click Edit on “Manage Security Settings,” then choose “Set up Passkey.”
If your firm uses hardware security keys, such as a YubiKey or Google Titan, those are supported too.
Register a second device
Don’t stop at one. Register a passkey on every device you work from (or a hardware security key, if that’s what your team uses), and you’ll still be able to sign in when one of them isn’t available.
If you use a password manager—iCloud Keychain, Google Password Manager, 1Password, or Bitwarden—your passkeys likely sync across your devices already, which makes that account worth securing properly in its own right. If you don’t have synced passkeys, sign in on each device and add one there.
You can manage all of this in your account settings. Keep in mind that any method still enrolled there stays usable, and one-time codes stay phishable whether or not you have a passkey—an account is only as strong as the weakest way in. Once you have passkeys on more than one device, consider removing SMS and authenticator codes from your account. Until then, keep them—they’re your way back in if a passkey isn’t available.
Do the same for your email
Your email inbox holds a lot of sensitive information. Password resets land there. So do wire instructions, client requests, and enough context for someone to impersonate you convincingly.
If your email provider supports passkeys (Google and Microsoft both do), turn them on there too. If it doesn’t, at least move off SMS codes to an authenticator app. This change will go a long way in protecting you from fraud.
What comes next
Passkeys are optional at Altruist today, and one method among several. We think they should be the one you use, and over time, we expect one-time codes to become the fallback rather than the default.
None of this asks you to become a security expert, and none of it has to happen at once. The most useful thing you can do this week takes two minutes. Set up a passkey. Then set up a second one.
Questions, or locked out: [email protected]. Step-by-step instructions are in Secure Login and 2-Step Verification.
