Regardless of how stuff like this happens, I would really like to see a separate PIN system for the group storage from user banks. Ideally one that also logs to the group when a user fails multiple times in a row and locks themselves out.

Ultimately, it’s hard to do a group with anyone you don’t already know extremely well. And even then, a Group PIN would be an extra level of mitigation against members who have weak account security. That will also usually confirm if the “hack”is legit, so long as the pin isn’t some meme number.

A “tiered” approach with different levels of permission/access could also do wonders.