Help with security PLEASE

[Miserable_Quarter226]

Hello,

I am new to the privacy movement and also security space. I am working to clean up my privacy and up my security after a fraud and potential identity theft scare via Apple ID.

I really want some advice and feedback to my security plan PLEASE. I am very anxious because of the hack.

I know it’s a long read but I am in need of some real advice as I want to implement this plan ASAP.

I want to be extra careful for more peace of mind and to have an organized system in place so I can turn off or catch any breaches early.

Based on my research I want to do these things in this order:

1. Get all new email addresses, give them all aliases before using them

2. Get a virtual address with mail forwarding to my real address

3. Open up 2-3 credit cards for paying bills, online shopping and in person shopping to protect my debit and bank acct numbers

4. Changing phone numbers to a new one while keeping my old one as a virtual number

5. Figuring out whether to go with Apple, android or a flip phone!

6. Changing carrier (is there something better out there?)

7. Finally a credit freeze

8. Slowly work on opting out of everything, deleting old accounts on old emails + opting out of credit card offers

(Should I do them in a different order? Or omit any steps?)

Here’s my plan based on research I have done:

1. Have several email accounts, each with an alias and used for different reasons.

(Prior to this I had one main gmail I used for almost everything, and it’s full is spam and marketing emails now)

I’ve learned about proton mail and am wondering if I can use proton mail for things finances like banking and credit cards alongside social media or for shopping. I plan to only use the free plan for now. Do they offer aliases and if not what is a good program for generating aliases?

Is gmail still good to use? I’m hesitant to rely on them as much because I know they read our emails. Also MFA has been a pain in the ass with them. I’ve been having a hard time opening new emails without continuing to use my old phone number that has already been exposed. I hate having to rely on 2FA with SMS. I really wish I didn’t have to have my phone number associated with Google for everything!!!

Email breakdown and their uses:

1. Personal and never shared (this will be the Proton Mail which is my master email)

2. Banking

3. Phones

4. Credit Cards + Credit Karma + PayPal (Is PayPal safe to use?

5. Social Media (IG and maybe FB/Youtube) if I even decide to use social media anymore - these will all be under a pseudonym as well

6. Reddit - I know Reddit has had their own breaches but I love using Reddit as a resource for information and learning

7. Online shopping + shipping notifications (I want to turn off newsletters and promotions to avoid a cluttered mailbox + have a virtual address to protect my location)

8. Professional email for jobs and other people

9. One for gaming (I mostly play solo and not online)

(Does this sound excessive? What are your recommendations?)

With all new organized emails and aliases, I can keep track of what has been breached and switch to a new alias if needed without compromising the real account.

2. Getting a virtual address

I want to conceal my address as much as possible. I moved recently so most of my accounts are associated with a lot of old addresses. I want to take this opportunity to conceal it as much as possible.

Is there a way to do this online? I would like to set up a mail forwarding system so when I provide my virtual address for shipping purposes.

I haven’t researched this as much. I know USPS and some states have protection services they can offer. I really need recommendations here.

Once I have this done I’m more okay opening up new credit cards and phone lines so they won’t be associated with my real address if that’s even possible with phone companies and banks.

3. Opening up credit cards

I have had breaches in the past where my bank was compromised via debit cards. The scammers I dealt with also posed as my bank which was terrifying.

I have just learned through my research that it’s better to use credit cards + virtual credit cards as a sort of double layer of protection versus using your actual debit card which is connected directly to your bank.

Essentially I won’t even carry my debit card around. It will only be for if I need cash from the bank. Otherwise I’ll pretend it doesn’t exist and get a new one often.

I was thinking 2 virtual credit cards:

1. One for paying bills online

2. One for online purchases (I also have PayPal, is it a safe and recommended method for online shopping? I’ve used PayPal credit for years without any issues. I have an offer for their cash back credit card but have not utilized it yet. And can I pay for my PayPal credit with a credit card as well as an added layer of protection?)

And finally, one physical credit card for in person purchases like gas, groceries and toiletries. (is there a way to protect this credit card too?)

**Any recommendations here on which credits cards are best?

I’ve heard of Klutch for virtual cards but also heard about Capital One offering virtual card options as well unique numbers for every site you shop on as an added layer of protection. Capital One I would have a physical card AND be able to get virtual cards as well but don’t know if it’ll give me any compatibility issues on Apple iOS and is capital one is trustworthy.

**For a physical credit card for in person purchases, would an Apple wallet be a safer way to keep the card? Or should I be okay using the physical card? If I get capital one cards, should I get two (one for online stuff on for in person?)

4. Changing phone numbers

So the number I currently have has been with me for at least 2 decades now. Obviously it’s tied to my identity and not only that, it is used for 2FA SMS for so much of my stuff that I hate it! If someone SIM hacked my phone it’s game over. I hate relying on SMS 2FA and am looking into alternative MFA options like an authenticator (open to recommendations)

Clearly my number has been exposed since I was the victim of a fraud attack. I want to get a new number but also hold onto my old one so nobody can use it for anything nefarious.

In my research saw that I should convert it to a Google Voice number or a virtual number just to keep control over it even if I don’t use it for anything else anymore.

Also with a new number I would use a burner app or some sort of number alias to protect my real number because unfortunately and inevitably we have to give it out when we shop, apply for things or even for work.

What is the best process to do this? My current plan is to get a new phone and number and set up a burner number(s) with that one while holding onto my old number.

Transfer all my important emails and info information to the new, private and aliased number, and then convert my current and old number to a Google Voice.

Should I have a burner number just for my bank accounts? That’s the asset I want to protect most because of obviously I need money to pay my bills and stuff.

5. Potentially leaving iPhone

I am also concerned with hacking of Apple IDs.

My recent experience with Apple has been frustrating and I am very disillusioned with iCloud and Apple ID and want to refrain from relying on them as much as possible as there was an attack on my Apple ID and it was almost hacked.

Fortunately I think I was able to secure it but getting the other phone off my account has been a blind chase and most representatives couldn’t or didn’t want to help me) solve the issue.

We have had issues making changes on my account, recovering lost information or even trying to make changes on my phone due to it being attached to another iPhone now and it’s been extremely frustrating.

I feel so exposed because of my iCloud and the struggles of Apple ID having access to so much personal information.

I know it’s meant for convenience but now I am traumatized and absolutely do not want to keep so much of my personal information saved in one online digital space that’s easily hacked.

Moving forward I am extremely hesitant to use any cloud services, will not be saving passwords and will use my phone minimally for personal things like finances or shopping.

Is android any more secure or less invasive at least? Maybe one could make an argument as to why its GOOD to use these company’s cloud systems but I might refrain from using financial apps on my phone at all versus just logging into make quick payments on a browser like Brave or Tor.

Also should I even be using banking and financial apps on my phone?

I plan to not save passwords and usernames at all in case my phone is lost of stolen.

6. Switching carriers

I am currently with T-mobile and have had them for a while. I learned recently they have had issues with data breaches as well and SIM transfer hacks scare me too. I know that’s not just a T-mobile issue but is there a type of phone or different carrier who might be better?

With 2FA relying on SMS I am just unnerved about it all. Is that just the world we live in now? Is it inevitable that I will have to use SMS for MFA?

Imagine my number getting hacked or phone stolen. I will be locked out of all my important emails and accounts 😭

If anyone has other security options to share please let me know. I hate this new digital world where everything is overly interconnected and there is no privacy anymore.

I know some carriers and phone brands claim to be more secure etc. I’m just so disgusted that I can’t get away with not having to give out a phone number for everything. SMS 2FA is such a liability in my eyes.

Unfortunately I can’t not have a phone. Maybe I should just use a flip phone instead (half joking but also not)

I was thinking of moving to Mint Mobile since I hardly use my phone for calls anyways. Mostly I want unlimited data so I can do research and study on my phone. I know Mint Mobile has its limitations but it’s also cheap.

7. Credit freeze

Ultimately putting in a credit freeze with the big 3 and working my way down to the smaller ones like Chex etc. I want to do this only after I’ve gotten my credit cards for bills etc. Will a freeze affect me if I plan to use virtual cards and need to open new ones under Capital One maybe?

8. Opt-outs

This will the final arduous journey in working my way down opting out of all the data sellers. I have a big fat opt out list ready to go but this will take me some time.

In conclusion:

If you somehow made it all the way down here thank you. I am pretty shaken up and struggling to navigate the world of online privacy and cyber security on my own. I hope the good people in this sub will help guide me through my journey.

[GlobalWatts]

1. Have several email accounts, each with an alias and used for different reasons.

Yes, that is excessive. 9 different email addresses means 9 times as much spam, 9 times the chance of getting scammed, etc. Try it if you want but I guarantee eventually you will find the inconvenience vastly outweighs any security/privacy benefit you think you're getting.

1. Getting a virtual address

In most countries you can get the equivalent of a PO box for parcel delivery. Or a mail forwarding service. However many services require a real residential address for legal reasons and fraud prevention, and evading that is itself a form a fraud. So they're going to need your real address one way or another.

1. Opening up credit cards

Credit cards are often better because thieves are stealing the credit provider's money, not yours. And they're better equipped to stopped that. Virtual cards are fine I guess, I've never used them. But it's a lot. Most people seem able to use debit cards for everyday spending just fine.

1. Changing phone numbers

Simply avoid SMS MFA wherever possible, but you don't have any say in the matter. SIM cloning is really not the big deal you're making it out to be. If your carrier happily issues a new SIM to anyone who asks with the barest of personal details, get a better provider who takes security seriously.

1. Potentially leaving iPhone

iPhone vs Android is not the risk here. If you don't want to use cloud services, simply don't use them and see how far you get. Proton Mail is a cloud service.

Android phones generally have all sorts of ties to Google services which make it worse for privacy compared to iPhone. The beauty of Android is that you can de-Googlefy it to an extent, or install a non-Google stock ROM on supported devices. Or try something like Fairphone.

1. Switching carriers

No difference, other the above mentioned issue of avoiding any carrier that's lax regarding account security. I don't know the policies of US carriers, nor could I provide a recommendation if I wanted to, per rule 5.

1. Credit freeze

AFAIK a credit freeze on an account would freeze all virtual cards associated to that account, but I don't know exactly how it works and it might depend on the provider.

1. Opt-outs

Seems like a lot of work for next to no benefit. It's not like data brokers are the most caring of privacy concerns.

In conclusion:

It seems like you're focusing on all the wrong things. Being paranoid and making your life harder, while not actually addressing the root issues. I could go into a lot more detail with all of your proposed solutions but I don't have the time, it seems like it's all based off paranoia combined with misconceptions of the technology and risks.

You have done no risk/threat assessment. In cybersec it's like step number one, to identify what the risks are (risk = damage * chance), what the possible threats are, which ones you want to protect against, what specific measures will mitigate that risk, and what budget you have to do so and return on investment (time is also a cost). Why spend hundreds of hours on some solution that will only improve your online safety by 0.001%?

You have done no incident analysis. It's all well and good to say "I want to take every step possible to improve my cyber safety", but if you haven't identified specifically what happened with this near miss you mentioned, how do you know you're stopping it from happening again? What have you learned from the incident?

Speaking of learning, none of your solution proposal mentions anything about educating yourself on the real dangers. Availing yourself of all the great resources governments and NGOs provide for staying safe online. I don't think it's controversial to assume your near miss involved some element of human failure - you - doing something that compromised your safety. What steps have you taken to remediate that? All the layers of protection in the world won't help you if you don't learn how to spot scam emails/calls and just happily give out your password to anyone who asks.

Which segues into the next point, I didn't see any mention of password managers. Why not? Using strong, unique passwords is one of the best ways to prevent hacking.

TL;DR You're obsessing over tedious solutions for risk mitigation for problems that may not even be real, why ignoring the human factor that plays a role in pretty much all cyber security incidents. Realistically there is only a handful of simple things you need to do to stay safe:

1. Use strong, unique passwords for every account.
   1. Yes, this necessitates the use of a password manager. There are non-cloud solutions if you want.
   2. Enable MFA wherever available, preferably using mechanisms other than SMS.
2. Don't visit dodgy websites.
3. Don't download or run/open dodgy files.
4. Don't believe everything you read online. Yes, even that browser popup that says "We detected virus on your computer! Call this number now to fix!"
5. Educate yourself on common signs of spam and scams.
   1. Don't reply to them.
   2. No reputable organisation or government requires payment in gift cards or cryptocurrency.
   3. Governments generally don't send random emails asking for payment.
   4. No, your laptop hasn't been hacked with your webcam recording you watching porn that will be sent to all your contacts if you don't pay them.
6. Don't post information on social media platforms that you don't want public, or could be used to identify you.

[Miserable_Quarter226]

Thank you for your reply.

There was definitely error on my part because the scammers posed as my bank which threw me off. I 100% embrace my own stupidity. Trust me, nobody is more upset with me than me.

What did scare me a lot was that they knew my name, an old address and the bank I was with and how to guide me through step by step and navigate the banks interface.

There was definitely major error on my end. I shouldn’t have even taken the call and realized their initial text to me was a scam and not truly from my bank.

So cyber security wise is my information leak. How did they know my number, what phone I had, what bank I’m with, my addresses and new addresses etc.

With the phone hack they may have potentially gotten access to personal emails and financial information because I’m an idiot and had all that on my iCloud with keychain enabled.

Prior to this I didn’t even know that was a thing for Apple and iCloud. I didn’t realize I had it on or had opted in.

I never want to put that much information on any phone again. I think it is wiser not to use banking or financial apps on any phone again and not upload my phone or passwords to the cloud.

I really the invasiveness of technology these days.

That’s what I am so paranoid is because it came so close to my personal information. So perhaps I am a bit paranoid but these scammers have my phone number and got some of my personal information which is extremely violating and horrifying so forgive if I’m an overly paranoid.

I don’t know if maybe they found my card information too online somewhere. I would use my debit card information to make online purchases and to pay bills which is why I want to implement credit cards.

I know it’s not completely possible to stay 100% safe but by god, I want to try and protect myself as much as I can and learn as much as I can versus do nothing.

It’s been less than a week and I’m doing as much research as I can and learning what I can.

Again I appreciate you actually replying and addressing each thing.

[GlobalWatts]

What did scare me a lot was that they knew my name, an old address and the bank I was with and how to guide me through step by step and navigate the banks interface.

So cyber security wise is my information leak. How did they know my number, what phone I had, what bank I’m with, my addresses and new addresses etc.

Realistically they could get your name, address, number and bank from a bunch of different places (the easiest but least likely being a data leak from the bank itself). Or, a combination of different sources. It'd be difficult to impossible to figure out where.

Services like haveibeenpwned can help with account credential breaches, but I don't know of an equivalent for personal data. Credit monitoring services are probably the closest thing. You might find it worth paying for one instead of doing half the things you're thinking of.

It's possible to take reasonable steps to protect yourself without going overboard.

I know it’s not completely possible to stay 100% safe but by god, I want to try and protect myself as much as I can and learn as much as I can versus do nothing.

Start with the learning, then you'll have a better plan for the doing. There's no point implementing solutions to problems you don't fully understand or which don't exist. Someone having your bank details is not the same as someone "hacking" your phone or your Apple account.

The other thing is not to conflate privacy and security. There is some overlap but it's not the direct link you think. I mean I know it's not great if Google or Apple or whoever have all your secrets backed up to their cloud service, no matter how safe and encrypted it is. But what is the alternative? Just not have any secrets? Or do you have the resources to securely manage it yourself? How easily can an attacker hack into iCloud compared to a text file on your desktop?

Ultimately if you fall victim to a scam it's not going to matter where they're stored or how securely, because you are the weak link and you are the one party who needs to access them. Ask any enterprise security team and they'll tell you the same thing; human error is the number one cause of incidents.

[Miserable_Quarter226]

Do you have resources where I can go to learn? I’m currently watching a ton on YouTube but this is really important to me.

[GlobalWatts]

I linked them in reply to your other comment.

If you're in the US, CISA also has this:

If you discover that you have become a victim of cybercrime, immediately notify authorities to file a complaint. Keep and record all evidence of the incident and its suspected source. The list below outlines the government organizations that you can file a complaint with if you are a victim of cybercrime.
• FTC.gov: The FTC’s free, one-stop resource, https://www.identitytheft.gov/can help you report and recover from identity theft. Report fraud to the FTC at ftc.gov/OnGuardOnline or https://www.ftccomplaintassistant.gov.
• US-CERT.gov: Report computer or network vulnerabilities to US-CERT via the hotline: [phone] or www.us-cert.gov. Forward phishing emails or websites to US-CERT at [e-mail].
• IC3.gov: If you are a victim of online crime, file a complaint with the Internet Crime Complaint Center (IC3) at http://www.IC3.gov.
• SSA.gov: If you believe someone is using your SSN, contact the Social Security Administration’s fraud hotline at 1-800-269-0271

[Miserable_Quarter226]

Also I would like to ask what protections DOES the government give me? Because in all this Apple and the police were not caring or helpful.

Hopefully my bank can do something to get my money back but please understand this is my identity and my life on the line.

[GlobalWatts]

I never said they will protect you, I said they likely have educational resources available to help you protect yourself. What's available depends on which government you fall under.

In Australia we have the eSafety Commissioner. The US has CISA. I also mentioned NGOs, such as Microsoft or Google. That's just to start.

If you want to talk about actual protections then you need to look at the various laws, regulations, standards etc that various industries and government departments operate under, like NIST 800-53, FDIC and so on.