8 Cybersecurity Tips Every Financial Advisor Should Know

‍IN THIS ARTICLE

• Passwords and MFA
• Privacy Settings
• Document Disposal
• Public Wi-Fi
• Software Updates
• AI-Driven Threats
• Cloud Storage
• Cyber Insurance
• LPL Technology

Cybersecurity Doesn't Have to Rest on Your Shoulders Alone

Today's advisors face increasing cyber threats, evolving regulations, and growing client expectations around data protection. While good security practices remain essential, many advisors are also looking for technology partners that help simplify cybersecurity through enterprise-grade infrastructure, integrated safeguards, and ongoing investment.

Cybersecurity for financial advisors has shifted. The fundamentals still matter, but artificial intelligence has changed the threat landscape. Fraudsters now use AI to clone voices, generate convincing identification documents, and impersonate regulators. New SEC requirements have also raised the bar for how firms must protect client data.

While no practice can eliminate every threat, consistent security habits and the right technology foundation can help reduce risk. Here are eight practices to help protect your clients, your team, and your business. For more, see how LPL helps advisors protect client data.

Strengthen Passwords and Enable Phishing-Resistant MFA

Strong passwords remain your first line of defense. Use long, distinct passwords for every account, and store them in a reputable password manager rather than a spreadsheet or browser autofill.

Multi-factor authentication (MFA) adds a second verification step, but some methods are stronger than others. Short Messaging Service (SMS)-based codes are now considered the weakest option because they can be intercepted through subscriber identity module (SIM)-swapping attacks. The industry has moved toward phishing-resistant MFA, which includes hardware security keys and authenticator apps that generate time-based codes. These methods are harder for attackers to bypass, even with AI-assisted techniques.

Move away from SMS-based MFA wherever possible across your firm.

Review Privacy Settings and Third-Party App Permissions

Set a recurring annual review for social media and email account privacy settings. Platforms change their defaults frequently, and a setting that was private last year may now be more exposed than you realize.

Audit the third-party apps connected to your accounts and revoke access for any app that is suspicious or no longer in use. Every connected app is a potential entry point for an attacker.

Dispose of Sensitive Documents and Data Correctly

Physical document handling still matters. Maintain a clean desk policy, use shredders for paper documents, and set up printers and scanners to release held print jobs only by badge or employee number.

Digital disposal is equally important. Use end-to-end encryption when sharing sensitive data and prefer file-sharing systems over email for client files. SEC Rule 204-2 governs books and records retention, so follow those requirements when deciding what to keep and what to destroy. As more firms shift toward cloud-based workflows, secure disposal also means securely deleting files and revoking access in cloud systems.

Use Public Wi-Fi with Caution

Unencrypted public Wi-Fi networks put login credentials and financial data at risk. Anyone on the same network can potentially intercept unencrypted traffic.

Use a virtual private network (VPN) or a personal hotspot when working in public places. A VPN encrypts your connection, making it far more difficult for anyone to intercept your data.

Keep Software and Systems Updated

Enable automatic updates wherever possible. For those who prefer more control, make a habit of manually checking for updates on a regular schedule.

FINRA's 2026 Annual Regulatory Oversight Report also flags third-party vendor risk as a growing concern. Many of the tools advisors rely on connect to outside vendors and keeping those integrations current, is part of the same discipline as updating your own devices and software.

Recognize AI-Driven Threats and Use AI Tools Safely

FINRA's 2026 Annual Regulatory Oversight Report identifies GenAI-enabled fraud as a fast-growing concern, including voice clones used to impersonate clients or colleagues, AI-generated identification documents, and deepfake audio and video.

In March 2026, FINRA issued a cybersecurity alert about an active phishing campaign impersonating FINRA and SEC staff. Fraudulent emails claimed to involve a time-sensitive regulatory matter and pressured recipients into joining a Microsoft Teams call, where AI-generated deepfakes could convincingly impersonate a real regulatory official. Similar campaigns targeted SIPC-regulated entities and the New York Department of Financial Services.  For more on recognizing these threats, see cybersecurity tips for financial advisors.

QR-code phishing, known as quishing, is another emerging tactic. Attackers embed malicious links in QR codes that appear in emails or printed materials, directing users to credential-harvesting sites.

The phishing fundamentals still hold true: be cautious of unsolicited emails, texts, or calls requesting personal information. Legitimate companies will not email or text a link asking you to update payment details or passwords. Report suspicious messages to both the impersonated company and your IT team.

At the same time, many advisors are adopting AI tools to save time and serve clients better. Recent developments have shown that AI tools can sometimes break out of their intended environments and access data they should not reach. Before adopting any AI tool, understand how it stores, processes, and protects the data you feed it.

Use Secure Cloud Storage

Cloud storage differs from single-device storage because your data lives on remote servers managed by a provider. This offers advantages for accessibility and disaster recovery.

Choose providers that offer encryption and enable MFA on all cloud accounts. Look for versioning, which lets you restore files from before an attack occurred, making it a practical ransomware recovery tool.

Understand the Role of Cyber Insurance

Cyber insurance can be an important component of a broader cybersecurity strategy. While insurance does not prevent cyber incidents, it can help provide support during recovery, including access to specialized resources and services when an event occurs.

As part of LPL Latitude, our unified technology experience, advisors receive access to cyber insurance coverage that complements ongoing investments in cybersecurity, resiliency, and advisor support. Together, these resources are designed to help advisors navigate an increasingly complex threat environment while maintaining focus on serving their clients.

Cyber insurance should be viewed as one layer of protection within a broader approach that includes strong cybersecurity practices, employee awareness, business continuity planning, and secure technology foundations.

Remember: The goal is not simply to recover from an incident. It's to build a resilient practice that can continue operating and serving clients when disruptions occur.

Why Technology Scale Matters

Cybersecurity has become increasingly complex, making it difficult for individual firms to keep pace with evolving threats on their own. That's why many advisors are looking beyond standalone tools and toward technology ecosystems designed with security, resiliency, and ongoing innovation at their foundation.

At LPL, cybersecurity is embedded across the technology experience through continued investments in infrastructure, monitoring, governance, and advisor support. These investments help create a foundation for connected experiences, digital innovation, and AI-powered capabilities while helping advisors stay focused on serving clients.