Protect Your Charles Schwab Accounts From RAT Attacks in 2026 and Beyond
Over the past month, I’ve spent a lot of time discussing investment strategies—from capital preservation to growth-focused ETFs—to help you maximize your retirement accounts. If you missed them, be sure to check out:
Episode 288: The 7 Best Investments for Capital Preservation
Episode 289: The Top 5 Growth ETFs to Own This Year and Beyond
This week, we’re switching gears to something just as important as investment performance: protecting your accounts from cybercrime.
Specifically, we’re talking about recent security alerts issued by Charles Schwab and covered by major news outlets involving a growing threat known as a RAT attack.
And no—this isn’t about rodents in New York City subway tunnels. It’s far more serious.
What Is a RAT Attack?
A RAT, or Remote Access Trojan, is a type of malware that allows cybercriminals to secretly gain control of your computer or smartphone. Once installed, attackers can monitor activity, steal credentials, and even move money from your financial accounts—often without you realizing it.
While RAT attacks are not new, they are becoming far more common and sophisticated, and more people are falling victim every year.
The Scope of the Cybersecurity Problem
Cybercrime is no longer a niche risk—it’s a global crisis:
An estimated 2,200 cyberattacks occur every day, or one every 39 seconds
Global cybercrime damages reached $9.5 trillion in 2024
Losses are expected to rise to $10.5 trillion in 2025
Those numbers are staggering, and they highlight why protecting your Schwab and other financial accounts must be taken seriously.
Listen to this week’s episode on: 6 Changes to Social Security in 2026
How RAT Attacks Actually Happen
Understanding how RAT attacks work is the first step in preventing them.
Stage 1: Social Engineering
Most RAT attacks begin with social engineering, not advanced hacking.
Social engineering exploits human behavior—trust, fear, urgency, and confusion—rather than technical vulnerabilities. Attackers often impersonate trusted companies and create urgent scenarios designed to pressure victims into acting quickly.
Common delivery methods include:
Phishing emails
Fraudulent text messages
Fake invoices or account alerts
Malicious PDF attachments
Links claiming package delays, unpaid tolls, or account issues
If you’ve ever received a text saying “You have an unpaid toll—click here” or “Your Amazon package is delayed”, you’ve seen these tactics firsthand.
Rule #1: Never click links or open attachments from unknown or suspicious senders.
If a message claims to be from a legitimate company, go directly to that company’s official website or call them using a verified phone number.
Other Common RAT Delivery Methods
Beyond phishing, attackers may use:
Bundled software: Malware hidden inside seemingly legitimate apps (games, video editors, PDF tools)
Drive-by downloads: Simply visiting a compromised website can trigger malware installation—no clicking required
This is why it’s critical to only download software from trusted, official sources, especially on devices used to access financial accounts.
What Happens After a RAT Is Installed
Once installed, the attack moves into the command-and-control phase.
The malware runs silently in the background every time your device powers on and communicates with remote servers controlled by the attacker. These communications are often encrypted to avoid detection.
Attackers may gain the ability to:
Record keystrokes (keylogging)
Capture usernames and passwords
Take screenshots
Activate webcams and microphones
Monitor emails and text messages
Keylogging is particularly dangerous because it can capture:
Banking and Schwab login credentials
Two-factor authentication codes
Personal and financial communications
Even worse, RATs can spread across your home or office Wi‑Fi network, potentially compromising other connected devices.
Use code: RETIRE99 to purchase the course for just 99! ($197 discount).
A Real-World Example
This isn’t hypothetical—we’ve seen it happen.
We monitor Schwab account activity for all of our clients and receive daily alerts. In one case, we noticed a wire transfer request that didn’t align with a client’s normal behavior.
When we called the client, something didn’t sound right. We contacted the client’s spouse, who confirmed the client’s phone had been compromised. The attacker gained access to financial accounts through the phone.
Because of monitoring and alerts, we were able to stop the transaction before funds were lost.
Without close oversight, transactions like these can settle before fraud is detected—leading to lengthy investigations and stressful recovery processes.
How to Protect Your Schwab and Financial Accounts
There’s no single silver bullet, but layered security dramatically reduces risk.
1. Awareness and Training
Most RAT infections start with phishing—not sophisticated hacks.
Don’t open attachments from unknown senders
Don’t click links in unexpected emails or texts
Hover over email senders to verify real addresses
Report and delete suspicious messages immediately
If you own a business or have employees, training is critical. One click can expose an entire network.
2. Secure Access Controls
Use multi-factor authentication (MFA) on email, Schwab, banks, and financial accounts
Apply strong passwords and password managers
Limit administrative privileges
Use secure browsers and firewall protections
3. Protect Remote Access
Every remote connection is a potential entry point.
Use a Virtual Private Network (VPN) when accessing sensitive information
Consult an IT professional to lock down network access
Restrict what software can be installed on company devices
4. Be Careful With Public Wi‑Fi
Free Wi‑Fi networks are a major risk.
Avoid logging into financial or email accounts on public Wi‑Fi
Use your phone’s hotspot instead when possible
If traveling, assume public networks are unsecured
5. Enable Alerts and Monitoring
Make sure you:
Enable account alerts on Schwab and banking platforms
Turn on two-factor authentication everywhere possible
Monitor accounts regularly for suspicious activity
Early detection can prevent devastating losses.
Final Thoughts
RAT attacks are increasing in frequency and sophistication, but most are preventable with awareness, discipline, and layered security.
By staying informed, limiting access points, using strong authentication, and actively monitoring your accounts, you can significantly reduce your risk.
If you have a question you’d like addressed on a future episode, visit retirewithryan.com and click Ask a Question.
Have a great week—and I’ll talk to you next Tuesday.
Written by Ryan Morrissey CFP®, CLU®, CHFC®, CMFC
Founder & Principal Advisor of Morrissey Wealth Management
Host of the Retire with Ryan Podcast