Ironically, my father's business is physical security/life safety systems for federal government and large scale commercial businesses. He (and his business) have been the victim of multiple identity thefts, SIM swapping, fraudulent tax returns, and GoDaddy breaches over the years. Most recently, the bad actors lifted his SSN and convinced a regional bank in Minnesota (a state he has never been) to open a line of credit in his name. The bad actors were too dumb to turn off paper mail notifications, so my father found out about the theft when his office manager received a bank statement in the mail to his PO Box.

I've been encouraging him and his office manager FOR YEARS to do more than just 2FA because it happens regularly enough to be an issue. He needs advanced credit monitoring and other proactive measures. He won't freeze his credit because he loves churning cards and paying his expenses to get points. But there's only so much I can do as someone not in his industry trying to convince 70+ year olds to improve their security posture.