What Hackers Can't Steal: The One Part of Your Retirement Savings That Lives Outside the Internet

Last updated: 2026-06-25

The bottom line up front: Every dollar in your online brokerage or IRA can be stolen without anyone ever touching your wallet. A hacker who gets your email password — or convinces your phone carrier to hand over your number — can drain a retirement account in under an hour. The best technical defenses help a lot, and you should use them. But there's also a part of this problem that technology can't fully solve: when your savings only exist as numbers on a server, they're permanently inside someone else's attack surface. Some retirees have responded by moving a portion of their savings into physical gold — a form of wealth that literally cannot be accessed by anyone who isn't standing in front of the vault.

---

Margaret, 68, spent 35 years saving. She was careful with passwords. She never clicked suspicious links. She had two-factor authentication on her brokerage account.

Then her phone stopped working one Friday afternoon.

By Monday morning, her account had been drained of $67,000.

What happened to Margaret isn't a story about a careless senior falling for a phishing email. It's a story about a specific cyberattack called SIM swapping — and it's happening to careful, security-conscious people every day.

This article explains exactly how these attacks work, what you can do to protect your digital accounts, and why a growing number of retirement-age adults have decided that keeping everything in digital form is a risk they're not willing to take.

How Retirement Account Takeovers Actually Work

You've probably heard warnings about hackers, but the technical reality is simpler — and scarier — than most people imagine. Here's how a typical retirement account takeover unfolds.

Step 1: They get your email password.

Data breaches happen constantly. Companies you've done business with over the past 20 years — retailers, hotel chains, health apps — have had their customer databases stolen. Stolen email-and-password combinations from those breaches are sold on the dark web for a few dollars each.

A criminal buys a list of a thousand stolen credentials. They try each one on popular email providers. Some of them work. Yours might be on the list right now, and you'd have no way of knowing.

Step 2: They reset everything else using your email.

Once someone is inside your email account, they own you financially. Your brokerage, your bank, your IRA account provider — almost every financial institution lets you reset your password via a link sent to your email address.

The hacker requests a password reset for your Fidelity account. The reset link goes to your email. They're already in your email. They click the link, set a new password, and now they're in your brokerage too.

Step 3: If you have two-factor authentication, they go around it.

Many people know to use two-factor authentication (2FA), where a code gets texted to your phone before you can log in. This is genuinely good protection — against most attacks.

But there's a workaround criminals use called SIM swapping.

They call your wireless carrier — Verizon, AT&T, T-Mobile — and pretend to be you. They claim they just got a new phone and need to transfer your number to a new SIM card. If the customer service representative doesn't verify their identity carefully enough, your phone number gets transferred to a phone the criminal controls.

Now their phone receives your 2FA codes. Your phone suddenly shows "No Service." And the criminal has everything they need to complete the takeover.

The whole process, once they have your email password, can take less than an hour.

This Is Not Rare

The FBI's Internet Crime Complaint Center consistently ranks investment and financial account fraud among the highest-loss crime categories it tracks. Losses reported to the FBI in a single recent year exceeded $4 billion — and experts estimate that less than 15 percent of victims actually file a report.

The elderly are specifically, deliberately targeted. Criminals share databases of people who have large retirement balances. There are criminal forums where stolen credentials are sorted by financial account balance before being sold.

The average victim of investment fraud is over 60. It's not because older Americans are less intelligent — it's because older Americans have more money.

What You Should Do to Protect Your Online Accounts

The technical defenses matter. Use them. Here's what actually works:

Use a unique, strong password on every financial account. If your brokerage and your email share a password, a breach of one is a breach of both. A password manager like 1Password makes this easy — you only need to remember one master password, and it handles the rest.

Switch from SMS two-factor to an authenticator app. Text-message codes are vulnerable to SIM swapping. An authenticator app (like Google Authenticator or Microsoft Authenticator) generates codes on your physical phone — they can't be intercepted by someone who's swapped your SIM, because the codes never travel over the phone network.

Set a PIN with your wireless carrier. Call your carrier and add an account PIN or "port freeze" — an extra layer of protection that requires anyone requesting a number transfer to know a separate code. This makes SIM swapping significantly harder. Most carriers offer this for free.

Enable account alerts on your brokerage. Most brokerages will send you an email or text whenever there's a login, a password reset, or a withdrawal request. Turn on all of them. A five-minute warning is sometimes enough to call your broker and freeze the account before money leaves.

Check Have I Been Pwned. Visit haveibeenpwned.com (a legitimate, free security tool) and enter your email address. It will tell you whether your email appeared in any known data breaches. If it has, change the passwords for every account that used the same email address — especially your primary email account itself.

These steps meaningfully reduce your risk. But they don't eliminate it. And that's worth sitting with for a moment.

The Problem That Technology Can't Fully Solve

Here's the hard truth about digital financial accounts: they are permanently connected to an infrastructure that criminals are constantly attacking.

Security experts talk about your "attack surface" — the total number of ways you can be reached by an adversary. Every financial account you have online adds to your attack surface. Your brokerage, your IRA provider, your bank — each one is a door into your savings. The locks on those doors have gotten better. But criminals are patient, and they have financial incentives to keep trying.

There is no technical solution that reaches a state of "perfectly safe." Every financial institution with an online presence has a cybersecurity team, and every cybersecurity team will tell you the same thing: it's not a question of if there's a breach, but when.

This doesn't mean you should keep cash in your mattress. It means it's worth asking: is there a form of wealth that lives outside the digital attack surface entirely?

The One Retirement Asset That Hackers Can Never Reach

Physical gold is, by definition, not online.

A hacker in Eastern Europe cannot reach into an IRS-approved vault in Delaware and take your gold bars. There is no password to steal, no SIM card to swap, no customer service representative to deceive. Physical precious metals exist in the real world, where the only way to steal them is to physically be there — and where the security is institutional and regulated, not dependent on whether you remembered to update your email password.

This is not a pitch against modern finance. It's an observation about the structure of risk.

When you own physical gold through a properly structured Gold IRA, the metal is held in a third-party, IRS-approved depository — places like the Delaware Depository or Brink's, with institutional-grade physical security, insurance, and regular audits. It is completely outside the digital threat landscape that defines almost every other form of retirement savings.

Gold also has a multi-thousand-year track record as a store of value. It tends to hold its purchasing power during inflationary periods and often moves independently from the stock market — which is why financial advisors sometimes recommend allocating 10–20% of a retirement portfolio to precious metals as a diversification tool.

The combination of physical security and financial diversification is why some cybersecurity-minded retirees have come to think of a Gold IRA not just as a financial product, but as an offline backup for a portion of their life savings.

What Is a Gold IRA, Exactly?

A Gold IRA is a self-directed Individual Retirement Account that holds physical precious metals — gold, silver, platinum, or palladium — instead of (or in addition to) stocks and bonds.

It works like any other IRA in terms of tax treatment:

• Traditional Gold IRA: Funded with pre-tax dollars. Taxes are deferred until you withdraw in retirement.
• Roth Gold IRA: Funded with after-tax dollars. Withdrawals in retirement are tax-free.
• Gold IRA Rollover: If you already have a 401(k) or traditional IRA, you can roll over some or all of it into a Gold IRA without a tax penalty, as long as the transfer is handled correctly.

The IRS has specific rules about what gold qualifies (it must meet minimum purity standards — 99.5% pure for gold bars) and how it must be stored (in an IRS-approved depository — you cannot keep it at home in a Gold IRA). A reputable Gold IRA company will handle all of this for you.

How to Find a Trustworthy Gold IRA Company

This is where the ClearShield part of the equation really matters.

The gold IRA space attracts scammers. We've written about this in depth — fake companies, lead-generation mills that sell your personal information to dozens of marketers, and high-pressure salespeople who prey on financial anxiety.

The safeguards to look for are the same ones you'd apply to any financial company:

• Real, verifiable business history. Look up the company on the Better Business Bureau (bbb.org) and check their rating. A+ is excellent.
• Transparent fee structures. Reputable companies tell you exactly what you'll pay for setup, storage, and annual maintenance — before you commit.
• No cold-call pressure. Legitimate companies give you information and time to make your own decision. If you feel pressured, hang up and walk away.
• Physical mailing address and licensed representatives. You should be able to verify the company exists as a real business.

One company that consistently appears at the top of independent gold IRA reviews is Augusta Precious Metals. They have an A+ Better Business Bureau rating, a demonstrated track record of customer service, and a transparent, no-pressure educational process. They specifically work with customers who are rollovers from existing retirement accounts — a common situation for retirees who have a 401(k) from a former employer they want to put to better use.

Augusta offers a free information kit and a one-on-one web conference with a financial education specialist who walks you through how the process works, what it costs, and what your options are — before you commit to anything.

Affiliate Disclosure: This article may contain affiliate links. If you make a purchase through these links, we may earn a small commission at no extra cost to you. We only recommend products we genuinely believe in. This helps support our work and allows us to continue providing free content.

---

Protect Your Accounts While You Research

While you're thinking through your options, here are the three most important steps you can take this week to protect your existing digital retirement accounts:

1. Log in to your primary email account and turn on login alerts. You'll get notified the moment someone tries to access your email.
2. Call your wireless carrier and ask to add a port freeze or account PIN. This takes about five minutes and dramatically reduces your SIM swap risk.
3. Log in to your brokerage and turn on withdrawal alerts. Any transfer request should trigger an immediate notification to your phone and email.

These steps cost nothing. They take less than 30 minutes combined. And they close the most common doors that criminals use to reach retirement savings.

---

ClearShield helps adults 55 and older navigate online safety with clarity and confidence. No jargon. No panic. Just practical steps that work.

Want a weekly security tip in plain English? Join thousands of seniors who get ClearShield's free newsletter — one email per week, no spam, unsubscribe any time.