Its taken a long time for companies to start to question their password policies, but frequent password changes are no longer the standard used across industries.

If you are interested... Time to rethink mandatory password changes | Federal Trade Commission

I receive notification of data breaches at least monthly. It's so frequent that I half wonder whether there is an element of marketing since the notifications always include offers of "free" credit and security monitoring from some company for 1 year after which I am sure there would be an offer to continue the monitoring at a "nominal" annual fee. Just what I need, another subscription. I have over 8 encrypted pages of passwords, with many repeats. It seems almost physically impossible to routinely update them and make them all unique. I think the best approach currently is to opt in for 2 factor authentication wherever it's offered. It slows the login process down but appears to be very difficult to hack and allows for password simplification. I don't care very much if someone gets my password for a magazine subscription. It's the financial stuff that matters. When data breaches occur, there is the chance of vital identification info being released and leading to ID theft. So, it's important to routinely check your credit reports and freeze credit access.

CoachK's boss told her that someone got access to his Fidelity account over the weekend. They spoofed his number, and answers all the questions correctly, or somehow got through. Not sure how much 2FA, etc he had but they are all trying.

My Mom's checking account got locked over the weekend as well. All related to a medical hack back in April of the same hospital's patient records at a transfer site for billing.

Maybe the only safe way is go back to the old days where you talk to a person before anything can be done.

Don't know if this is an option with other financial services but Edelman Financial won't do anything unless you speak to your advisor on the phone.

without some sort of voice validation, or non public validation process, its all hackable. Phones can have sim cards switched with software sims, etc. .