David Vomund warned that rising fraud often starts with fake calls, texts or emails claiming a brokerage or bank account has been hacked and demanding immediate action.
Two-factor authentication is the most important safeguard, he said, adding that legitimate firms will never ask for one-time codes sent to a phone.
Vomund also urged investors never to click links in unsolicited messages, never share passwords, and avoid reusing the same password across sites.
Caller ID cannot be trusted, he said; investors should log in directly through bookmarked sites, use verified phone numbers, and contact their adviser if an account issue appears.
Any request to send bitcoin is a clear scam, underscoring how fraudsters use urgency and fake alerts to steal sensitive information and money.