Staying Safe in a Digital World: How AI is Changing Financial Security and How to Respond

Jessica Sclafani: Welcome to T. Rowe Price’s CONFIDENT CONVERSATIONS® on Retirement. I'm Jessica Sclafani and I'm excited to be your host this season. As a retirement strategist, I've spent years helping people make sense of retirement, both the numbers and the emotions behind them. Together with my colleagues, we’ll explore practical insights to help you retire confidently. Today, we're exploring how artificial intelligence is transforming the world of financial fraud. From deepfakes to sophisticated phishing, AI is changing how fraud happens and how quickly it can spread, but it's also giving us powerful new tools to protect ourselves. I'm joined today by two experts who are here to help us understand and respond to this evolving challenge.

First, we have Tom Quinn, our Chief Information Security Officer here at T. Rowe Price. Tom, welcome to the show.

Tom Quinn: Thank you very much for having me.

Jessica Sclafani: And we're also joined by Lindsay Theodore, a Certified Financial Planner professional from our thought leadership team. Lindsay, thanks so much for joining us.

Lindsay Theodore: Thanks for having me, Jessica. Nice to be here with you, Tom.

Jessica Sclafani: Perfect. So, let's dive in and learn how we can stay safe and confident online. Before we get into the details, I'd love for our listeners to get to know each of you a little bit better and to understand why this topic hits home for each of you. Tom, we'll start with you. Can you share a bit about your role and what makes this intersection of AI and financial fraud so critical right now?

Tom Quinn: It's an amazing time that we have in the world, with the advances in technology and specifically around AI. I've been in the financial services industry since the beginning of the century and have seen this arc of technology advancement to help firms deliver for their clients. I've been in cybersecurity now for almost that entire period of time, and the threats and risks that we've seen along the way…still there, but how they have evolved is just amazing and sometimes amazingly scary. I have, my family and I, we think about what retirement means to us. We've had some of our family members retire, parents, in-laws, and seeing this kind of firsthand has been eye opening for me, and it's something I want to be able to share today a bit, too, for our clients.

Jessica Sclafani: We talk a lot about what retirement means to each of us on this podcast, so you've come to the right place.

Tom Quinn: And in particular, I think there's a few simple ways to consider about thinking through this. And I just want to give you a little bit of an alliteration. So first think about awareness. Being able to spot and appreciate that something isn't right is a crucial component. Next, agency. Realizing that you're in control of a situation when you're getting involved with a phone call or an email or text, you can determine the amount of time you want to spend, and you can always stop the engagement.

And then lastly around authentication, be clear who you're speaking with or who you're engaging. Don't just trust that because they say who they are, or they sound convincing that they actually are the counterparty that you're working in. You want to make sure that they can prove it. And there's ways that we'll talk about that today as well.

Jessica Sclafani: Well, who doesn't love a good alliteration, Tom. Thank you for that. Three A's for staying safe. And because you used the alliteration technique, I can actually remember them. Awareness, agency and authentication. And we're going to come back to those because if listeners remember nothing else from our conversation today, we hope that they can remember the three A's. Lindsay, let's go to you and focus on your perspective as a certified financial planner, why is this conversation so critical for investors and retirees?

Lindsay Theodore: Sure. So yep. I'm a financial planner and was an advisor, client-facing advisor for 17 years before joining thought leadership. And we always say when we build a financial plan for someone or give them advice on their retirement and how to get there and achieve their goals, we're in the peace of mind business, and there's nothing that can rattle your peace of mind than being the victim of a scam. Even if it's a relatively low loss. The loss emotionally is just so, it's very real. And so, I've gotten very passionate, both because I've seen many clients experience these situations or come up to the edge and almost get defrauded and seen family members, like you said, Tom experienced the same thing. And just educating our clients on the importance of maintaining that peace of mind, maintaining that control of your financial future does depend on the decisions you make every day, with the texts you get and the emails you get and your interactions with the broader world. So just be vigilant.

Jessica Sclafani: I love that you said we're in the peace of mind business.

Lindsay Theodore: So true.

Jessica Sclafani: Really, what could be more valuable than peace of mind?

Lindsay Theodore: Absolutely.

Jessica Sclafani: And so relevant for retirement too.

Lindsay Theodore: Yep.

Jessica Sclafani: So that was great context from both of you to get us started today. And now that our listeners understand a little bit about your backgrounds and why this matters to each of you as individuals, I think we can start to get into the fundamentals.

So, Tom, you just gave us three themes – our three A's awareness, agency and authentication. Can you help us understand why those matter now? And specifically, what I'm getting at here is, what's changed in the last year or two that makes each one of these three A's essential? And what should listeners be doing differently because of how things have changed?

Tom Quinn: Well, starting with an awareness, the technology that's available not only to companies like T. Rowe, but to people who may want to do something adversarial is tremendous. It's not some fuzzy picture anymore. It's not some weirdly worded sentence and the like. It looks and feels like you're interacting with a trusted brand and a trusted company. It's designed to do that. These bad actors are leveraging technology that you would have in a marketing campaign, with the quality that you would see there. It's really meant to provide confusion or to build trust. And that trust building is a key component for all of this. So be aware, right, that the material that you may receive – email, phone call, text – it may not be what you think it is. And I think that awareness is a key component when you're interacting with any of these things. So, awareness is an important consideration in the world that we live in.

Jessica Sclafani: And it's gotten so much more sophisticated. So, you don't even need to feel…sometimes I might feel a little bad, “I should have spotted that.” But what I'm hearing from you, Tom, is in recent years it has gotten that much more effective and more sophisticated. It's easier to fall for some of this.

Tom Quinn: I think it's a really good point to raise up. You, anyone that interacts with these things and you think that you're interacting with somebody you trust, or you think you know the person at the end of it, don't feel bad. The bad actors want you to feel embarrassed, right?

Lindsay Theodore: Right. So, you won't report it.

Tom Quinn: You're exactly right. And they think, for so many of us, that visible failure or mistake is what they're counting on. They don't want you to report it to the police. They don't want you to report it to your bank or your financial institution or your retirement provider. It's crucial to make sure that you're communicating this to friends, family, and certainly the people who are there to stand by you and provide confidence in your financial planning as well.

Lindsay Theodore: I also think the scams have gotten so sophisticated, I have a personal story that happened recently. The timing of it was just so apropos. It was, it was so good. So, my mom was on a trip to South America for three weeks, and she was going to miss Easter. And several of us in my family, while she was gone, got a Punchbowl invite one of those invites like Evite and all these companies that you can plan a party and get the RSVP list and everything. It looked very legitimate and it was for the Sunday after she got home. And of course, I text her and say, “mom, did you send this?” She doesn't respond right away because I don't know what time it is in Chile, but my brother got the same thing and so did several of my other family members. And it's just so funny because I'm pretty good about spotting things like this, but I did find myself clicking on it just out of curiosity because she hadn't gotten back to me. Immediately, I closed the browser, it was on my phone, which is an iPhone, so it does have some security measures built in, but I exited out right away hoping it would be okay. Did some more research. This is a very common scam. Another family member who I don't want to say what his relationship is to me, but he opened it and logged into his Gmail and so then had to change some passwords because surprise, surprise, there was nothing there. And then another family member opened it, logged in, downloaded a bunch of software on her desktop computer…

Tom Quinn: Oh no.

Lindsay Theodore: …and her son, who happens to be, again, another family member, I don't want to say exactly the relationship because I don't want to embarrass him. There's like you said, Tom, there's shame involved. But he will regularly check this person's computer for malware and found that there was software on her computer tracking every keystroke, basically watching what she was doing.

Tom Quinn: Yes.

Lindsay Theodore: And she said, “I downloaded everything. I didn't see an invite.” We said, “don't do that again.” So even if it's someone who's close to you, it's almost like these AI has made it possible for whoever this scammer was to know she's out of the country, she's coming back. This might make sense for a time we would get together for this dinner, dinner party or whatever. Now, I should have thought twice. We all should have thought twice and thought “mom wouldn't arrange a dinner without checking with us first on the on the date and coordinating by text or something,” you know? But we're all just…we miss our mom and we want to see. Did she send an invitation? So, it's a really good example of how sophisticated these things have gotten. And even those of us who are really good at spotting them can fall victim.

Tom Quinn: If it's okay, I'd like to just talk a little bit about behind the curtain of that.

Lindsay Theodore: Yeah.

Tom Quinn: …attack or marketing campaign, that we could even call it. Okay, so in back of the curtain, people have their social media available to lots of people because they want to share the good news of a trip, right? A birth, maybe a birth of a child or something, or, oh, by the way, retirement. And so, to your point about AI capabilities being so high, what they'll do is say, “oh, here's the social media feed. Somebody is going on a trip. I'll look then to find out who their network is and if their network connections are public, like who I interact with.

Lindsay Theodore: Right.

Tom Quinn: They'll craft it as an attack, just like you said, which is we know all those things are true. We’ll craft this attack and send it. We only need one person to believe enough to start moving forward.

Lindsay Theodore: Right.

Tom Quinn: And that trust building, that chaining of little bits of facts together to get you over the hump of belief.

Lindsay Theodore: Right.

Tom Quinn: With just enough context. They're counting on it. And it's by design. There's research that is built into this to show those kind of things happening. So anyway, I hope that was just a little bit of color about how some something very innocuous, like social media posts or Facebook or those kind of things, how they could be used to create an attack like that.

Lindsay Theodore: No. Very true.

Jessica Sclafani: It's always helpful to hear these stories because you used the word shame, Lindsay. And if we can take some of that out of the equation, I think we'll all benefit from it.

Lindsay Theodore: Sure. Definitely.

Jessica Sclafani: So, you know, Tom, you have me trained: the three A's. And we talked about awareness. So can I ask you to talk a little bit more about agency.

Tom Quinn: So, for agency it's a concept right where you have the ability to drive outcomes independently. And I think it's crucial to understand that these things aren't just happening to you, you have a choice to interact with them. We talked about the example of somebody creating an attack and an interaction where it seemed normal and almost expected. I'll talk a little bit about examples where the attacker is using a different emotion. An attacker may want to use the emotion of angst or fear and build a sense of urgency for you to do something immediately. One of the things I find is when you start to feel that bubble up within you on these interactions, it's crucial to take a step back and pause. I know so many of us, we want to…we're so busy. We just want to move to the next thing.

Jessica Sclafani: Cross it off your list.

Tom Quinn: That's right. And we want to be responsive. And especially when like when you're dealing with a client, we want to be responsive as fast and as effective and efficient as possible.

Jessica Sclafani: Of course.

Tom Quinn: Because we're supporting our clients. That is actually a culture that these bad actors are leveraging against us. The ability to want to go faster and get things done. So, for when you feel that emotion, like especially with AI and some of these new technologies, if there's a voice of a friend or a colleague, that voice could be used and manipulated to sound like them.

Jessica Sclafani: It’s so scary.

Tom Quinn: It is very scary. It could be a picture of somebody that you see, and maybe the picture is embedded into an email or text. So purposely starting to build a little bit of trust, a little bit of context, and then that sense of urgency to go do something. And I think one of the things that I always talk to my family about is just take a step back and breathe. 10s or 20s or two minutes. Isn’t a lot of time, but if you just paused for two minutes and didn't say anything, we won't do it now because we're we don't want to fill out.

Lindsay Theodore: We don’t want dead air.

Tom Quinn: It feels like forever if you pause for two minutes. But that's the amount of time for you to express that emotion through your…how you process it and be able to think through that in a clear-eyed way, where if you build that sense of urgency and emotion, you may not be. So, I, I really call that is the agency that you have in those situations is crucial. And when you feel that welling up in you…

Lindsay Theodore: Or the fast heartbeat.

Tom Quinn: Take a breath. I think that's a really good indicator. It is like your heartbeat comes up or something.

Lindsay Theodore: Exactly. Oh no, I've got to act now. I think another thing that we tell clients and that I tell my loved ones is like, yes, take that 10s or two minutes, but also maybe reach out to someone you really trust on these matters and say, and you know who you're contacting and say, “what do you think of this?” Because oftentimes, like having that third party perspective can help you realize, “wow, yeah, this doesn't sound quite legitimate.” Or they can provide you with a course of action if you are really concerned about it, here's what you can do. Contact the bank, contact your retirement plan provider. Whatever it is, contact the credit card company so that you can verify that it is from a legitimate source.

Tom Quinn: If I can, I'd be happy to share an example. I know you were kind enough to share an example in your life. So, my father-in-law was almost faked out of a large sum of money. So, he thought he was interacting with a legitimate company, and I won't mention the specific name, but they were doing technology support. And he got into a state of confusion where he was convinced that he needed to go to his bank, take out a sum of money and then provide it to this fraudster. Was down at the bank, thankfully it was local. They live in a small town. The local branch happened to know him, like really know him. And when he arrived the bank branch teller said something's not right. Called his wife, said please come down here. And all along the time his phone is ringing off the hook. The fraudster is trying to get ahold of him on his cell phone and convince him to get the money and not listen to anyone. So, your point about bringing somebody else in there that you trust is crucial, because you may need the help. You may need somebody else's advice and getting a trusted advisor. Having somebody designated as a trusted advisor to potentially talk to about these things as well on your behalf is key. But reaching out and asking for help is crucial.  And I do it all the time. Just every day I'm asking for help for somebody and it really does make a difference.

Lindsay Theodore: Yeah, definitely.

Jessica Sclafani: And this probably sets us up nicely to talk a little bit more about our third and final A, the authentication.

Tom Quinn: We were talking about trust before I think trust is great. And our brand and I think about this for T. Rowe Price, right? Our brand is trust and, but people will leverage a brand or a picture or something to try to leverage the trust that that has. I think it's crucial that even though someone is presenting that brand, it's not enough. And it's not enough in the world that we live in today. Authenticating a brand, authenticating a person, isn't necessarily a technology issue, although there are solutions to do that with technology. But being assured that you know who you're engaging with is crucial. And some practices there I think that are appropriate is if your bank's calling you and you happen to be in a town with a bank branch and they're asking you to do something, you may just want to go to the bank branch, like see somebody in person and see that building and do that. You may want to look at your credit card, your bank statement, your T. Rowe Price retirement statement. Look at the number, the phone number that's printed there, or maybe even there may be another contact way to do that and use that as a way to communicate. We were talking a little bit, I think, before we got on camera we were talking a little bit about this. And I think that in some cases, what the bad actors will do, right, and you shared this right before they'll give you a phone number to call.

Lindsay Theodore: Right. Oh yeah.

Jessica Sclafani: So, you think you're doing the right thing and then...

Tom Quinn: And I'll put the agency thing back in there too. It's just like pause. Like, I don't need you to give me the number. That's out of the sequence of things like we have. I have other ways to do that. So, authentication to assure the people that you're speaking with or interacting with, because it could be like text or email, is important. And then when you line those things up, that is, that gives you the best chance possible those things together to weather the storm through this.

Lindsay Theodore: I think there's also an element of wanting to be polite. So, I don't ever answer a phone call from an unknown number just because I'm programed that way. But I know a lot of clients who are slightly older, who answer the phone and they don't want to hang up, even if they suspect that this person isn't who they say they are. They don't want to hang up because it's impolite. Do you find that that is like a common thing too? It's not only the level of urgency, but the social responsibility to be kind to people.

Tom Quinn: It's a very good point. I have had to untrain myself for that as well. I think equating politeness to that is something…it's not the same. You can be polite to a human. We're sitting here together. You can be polite to your family members maybe as well. But to a, you know, a phone call, an email or whatever.

Lindsay Theodore: From a stranger.

Tom Quinn: I think it's fair.

Lindsay Theodore: I think we can give the listeners permission to hang up.

Tom Quinn: And I think the thing that…

Lindsay Theodore: To hang up on people.

Tom Quinn: …is problematic for that too, is you still want to engage with the world.

Lindsay Theodore: Yes.

Tom Quinn: And I think it's important to balance that. And I think if you use the three A's plus to your point about the politeness side of that, I think you can get to where you need where you may be able to still, well, I don't take a phone call that people I don't know, but that you're still interacting. And I think it's crucial to make sure that you're interacting with people too. But really good point.

Lindsay Theodore: Yeah.

Jessica Sclafani: Right. We are not telling people to not engage with the world.

Lindsay Theodore: No, definitely not.

Jessica Sclafani: We're just trying to give a few tips on how to do so safely, understanding that we've entered this new era of AI being used for scams and more specifically, financial fraud. I think you've both been really generous and sharing examples from each of your lives. I appreciate that, and I'm sure our listeners do too.

Lindsay, based on your engagements with clients, really, what's keeping them up at night when it comes to this topic?

Lindsay Theodore: I think a lot of the things we've talked about, you know, if you get some, if you get a text message… now, they have so many different ways of being engaged with. It used to be just a phone call or even an in-person interaction where someone said they were someone they're not. But now with email and text and social media, there are just so many ways that scammers can get to these clients, so it can be very overwhelming. We've seen situations where a client might have been contacted by someone on social media who seemed like a legitimate friend and offered some a “great investment opportunity,” and the client was prepared to send money in Bitcoin. Luckily, it was caught before anything happened. And she did share with her advisor what was happening. But she initially did not. And she eventually called back the advisor on our team and said, you know, they told me once they had realized this was a scam and she had put the money back, but “they had told me not to tell you anything.” Right?  And that is the coaching and the manipulation.

Jessica Sclafani: That’s a red flag.

Lindsay Theodore: That's a huge red flag. If someone is telling you this is urgent, don't tell anyone. Hang up until everyone. So. And be very wary of someone contacting you out of the blue for any opportunity, for any urgent action you need to take, whether it's on social media, via text, via email. The IRS, Social Security, they'll never send you a text saying that “you better pay this balance or you're going to go to jail.” That just doesn't happen. It can be very alarming to get a text that you think is coming from the IRS saying that, but just really take a moment and it's okay. I guess what I'm saying is in these instances, it's not rude to ignore it and follow up via other avenues. Right? Trust but verify. Very verify.

Tom Quinn: I think you're right on putting a bit of space and time between the urgency makes all the difference that investment will be. I'm not giving financial advice, but those opportunities, if they're real, will be there tomorrow.

Lindsay Theodore: Correct.

Tom Quinn: And I think there are there is space and time for all those things. And we're putting space and time in there is a real protective measure.

Lindsay Theodore: Definitely. Yeah.

Jessica Sclafani: So, Lindsay, you mentioned in your most recent story that in in this example, the woman was asked to provide Bitcoin to the fraudster.

Lindsay Theodore: Right. Big red flag.

Jessica Sclafani: Yeah. So, I and I was sitting here thinking, okay well I don't think I would fall for that one. Bitcoin. But there are so many others that I would fall for because these social engineering tactics have become so effective really even for people who would describe themselves as smart and cautious, conservative. Tom, can you help us understand the social engineering tactics of it all?

Tom Quinn: So that trust building. Right. So firstly, social engineering. It's where somebody wants you to do something that normally you would not do.

Jessica Sclafani: Okay.

Tom Quinn: And under a set of circumstances, you would not do. But it is something that normally you have the ability to do. And whether that's take money out of the bank, give some of your user ID and your password. Buy a bunch of gift cards. Like you have the ability to do these things, but you're doing them for the wrong reasons. So social engineering. Sometimes people are convincing, right? They can look like they're legitimate. They may look like they're your friends and neighbors and like to, but that same sense, that trust building sense of urgency and doing something that's slightly unexpected. We're still sharing about things that we do. One of the things I do, and I'll just give an example when it may look or appear like it's a relative or a family member asking you to do something, and it is a sense of urgency. And sometimes that happens. There could be accidents, right, where things occur. We actually have a code word in our family.

Jessica Sclafani: Yeah.

Lindsay Theodore: Really good idea.

Tom Quinn: And we don't share it electronically. We don't share it over the phone or text or anything else. We get together and talk through it. So, if there is something where there is an emergency and you need to make sure and validate, right, that they are, it's a way to have that happen is to have something like that available and practiced. To be mindful, like if you've exposed any kind of information like your birth date or your favorite color or your, you know, the kind of animal you may have or pet you would have and so on and so forth.

Lindsay Theodore: Don't have that as the code the word.

Tom Quinn: That's exactly right. Yeah, because AI is scouring.

Lindsay Theodore: And can pick up those things.

Tom Quinn: That's exactly right.

Lindsay Theodore: So totally random word you discuss in person.

Tom Quinn: Yes. That's right.

Lindsay Theodore: I think it's a really good point. And it would have we another thing that we're finding is with AI, some of the voice copying abilities are really, really strong. And so, I, we had a client who's who got a phone call from her grandson and it sounded just like him. And it was the police officer's phone apparently. So, it wasn't from his phone. And they were asking for money because he was in trouble since he was the one who caused the accident and he was going to be taken to jail in less $10,000, I forget the amount, but it was something like that. Luckily now they didn't have a safe word or a…what did we call it? Family word. Family code word. They didn't have that. But luckily, she had the presence of mind to say, let me call you back. She hung up the phone. She called her daughter the mom, and said, “hey, have you heard anything about this?” “No, I just talked to him. He's at work.” So just taking the time, saying, “hey, not to be rude, but I'm going to call you right back.” Really, really helps and contacting someone who would know if this was going on or if it could be going on. Just doing the research.

Tom Quinn: And I want to go back to your point about isolation before. If the person, the interaction that you're having, somebody says it's a secret. You can't call me on the phone. I have for some other reason. But you need to do something now and you can't verify. We'll go back to the three A's, maybe. You can't authenticate. You feel like your agency is being interrupted, right? And like your awareness is like pinging off in your head. Something's likely going on. Pause time, space, and exactly how that your story was, I think is important. But you may not have the time to have a, you know, a family word. But I do think what's important is to talk about these kind of scenarios ahead of time. So we do that for financial planning and retirement, right? It's like oh, retirement may be decades in the future. When you decide to retire. Is it in the U.S. Is it 62? 65? Whatever those things are, there's reasons to pick one of those numbers based on who you are and what you're doing.

Jessica Sclafani: That's a different podcast. That’s a different episode.

Tom Quinn: That’s right. But planning for that eventuality, the planning part of that, I think, is crucial. And you should.

Lindsay Theodore: If this happens. This is what I'll do. These are the options to consider. Right?

Tom Quinn: That's exactly it. And I think all too often I think we're so busy in our lives. But taking a few minutes think about what would happen. Could this happen to me and alike? And to do that ahead of time and almost have a plan. Right? Having a response plan on what you think you would do, who you would call, you know, is there a government agency you would call who what would you lock down or what you would change? Very lightweight plan. Nothing too crazy, but a few bullet points so that if something does happen, right? We've been talking about preventative measures, but if something were to happen, what would you do?

Lindsay Theodore: What’s the plan then? Exactly.

Jessica Sclafani: You know what strikes me?  Listening to you both, Tom, Lindsay, today we're talking about an intimidating and what I would describe as high tech, right - sophisticated technology problem. But what I've heard from each of you so far is that our, one of our best solutions to addressing this high-tech problem is actually very low tech. It's really slow down. Take a breath and verify through independent channels. And just that, that helped me get a little bit more comfortable with the topic because it does feel intimidating. I don't understand, I mean, you just explained social engineering to me, Tom, and now I feel a lot smarter about it. So, thank you for that. But it's intimidating, so it's good to know that the solution doesn't require me to be a tech genius.

Tom Quinn: No, but I would be remiss if I didn't…working in technology and having a career technology. But there are practical technology things to do.

Jessica Sclafani: Yeah, let's talk about that.

Lindsay Theodore: Let's talk about those.

Tom Quinn: So maybe three, three things to really consider is there's something called multi-factor authentication. T. Rowe has that as an offering on our retirement plan systems for our clients. But it's a technology that allows for improved identity verification. We talked about authentication before, but it's much more…it's stronger than just using a user ID and a password. Multi-factor authentication. Your financial institutions, your email accounts. If you don't have it installed, you should. It really is simple and for the most part, it's free. Some are better than others, some are more likely to fit your use case and your lifestyle better. But it's something that you should avail yourselves to. Second, having a separate device for doing high risk, or maybe even financial transactions is valuable. One of the things that we see often is that people will be doing email, web browsing, research, playing games, or giving their device to a family member so that they could do those kind of things. Well, what ends up happening is unintentionally unexpected software could be installed on the machine or other kinds of things like that. One of the things we find that's a very effective approach and technical approach is get another tablet. Get another PC or another phone. In some cases, they're very inexpensive and depending, and you may even be able to pick up one for free, depending on other services that you may be getting. The reason I mentioned that having that separate device for really, really important transactions is that single purpose use really minimizes the amount of potential bad things to happen on the device itself.

Jessica Sclafani: Sure.

Lindsay Theodore: A really good point.

Tom Quinn: Yeah, I, I do it. It may not work for exactly for other people, but I have this device. I just use it for this purpose, and I make sure it's patched right and all these other things. But that's what I, I only use it for. So, something, something else that's important. And then maybe just something as basic as making sure that you're on the latest versions of any of the software you possibly can.

Lindsay Theodore: Right.  Do those software updates.

Tom Quinn: That's exactly right. I think super, all super valuable things.

Lindsay Theodore: Yeah, definitely. Those software updates are there for a reason, often to patch issues of malware and scammers getting through.

Tom Quinn: That's exactly right. And I know we're in May 2026. People may have heard in the news about and we're talking about AI, but there is a new version, a new model for some of the AI that is out there. And it's being applied to find vulnerabilities and to exploit them. Very powerful. And that's the promise of AI. I think that we should realize that things are getting harder and harder all the time. And I think I'll go back to awareness again. And keeping appraised of what's going on in our environment is important because things are changing just all the time so.

Lindsay Theodore: Yeah, and it's funny you mentioned the device thing that might not be feasible for everyone, but I think about like teenagers sharing a computer with their parents and the stuff that's downloaded. I see what my son has on his little pretend phone that doesn't have cellular service, but it just he can connect to Wi-Fi and do his little games. I'm not sure what those games are downloading, you know? So, it's a good thing that I'm not logging into all my apps, my financial apps on that phone.

Jessica Sclafani: Keeping that separate.

Lindsay Theodore: It's totally separate, and I generally don't let them use my phone, but I think that's a really good point.

Jessica Sclafani: So maybe just to summarize some of the helpful tips that we've talked about for our audience on the low-tech side, we talked about the importance of slowing down, taking a breath and verifying through independent channels. And then Tom, rightly in his role, pointed out, there are also some technology tools that we can use to protect ourselves as well. And you shared the importance of multi-factor authentication, having a separate device for important transactions and making sure you do those sometimes annoying but very important software updates.

Lindsay Theodore: Right.

Jessica Sclafani: So, I think that's all really helpful at the individual level. I'd love to shift our conversation a little bit to go to financial institutions, including T. Rowe Price, and talk about what big financial institutions are doing behind the scenes to protect investors from these kinds of threats.

Tom Quinn: So, from maybe I'll start with policies and the like. So, you know, we do stand by the controls that we have. We stand by the brand that we have. And we stand by our clients as well.  And for that, the thing to think about when you're selecting financial institutions that you're working with, you should be asking about those kind of things, like if something were to go wrong, under what circumstances can I expect help from the institution? How are you standing behind me? I think that's a… we have that at T Rowe Price. Certainly speak to your financial advisor about the details for that. But it's one thing to select and I think it's a key variable for selecting a financial partner that you're dealing with, how much they stand the back of you, the kind of support that they have for you as well. From a technology investment perspective, we spend quite a bit of resources and ensuring that we have the most modern technology, the most modern controls. And we mentioned about multi-factor authentication earlier. But we also use AI, artificial intelligence, to look for anomalous behavior to mitigate things like fraud or misuse. And it's important for us and any institution that you'd be working with that they would have similar kinds of investments, similar kinds of commitments. And it's not only my team, right? We have thousands of people in technology, hundreds of people in legal and compliance, and people may not even see that aspect of what we do to make sure that we're compliant with laws and regulations and rules and the like. We work with law enforcement on a regular basis, too, to ensure that we're in receipt of any kind of intelligence that may be available to us so that we understand where things are going, how criminal activity could be evolving, how technology is evolving, and that intelligence allows us to make investments, the right investments at the right time to support our clients. And I think without that forward-looking view, you're going to be behind the curve. So, we invest in technology, people, process improvements. We ask for help, right? So, working with law enforcement, regulators and others. But also, too, we work with our other financial services peers. And it's not for marketing.

Lindsay Theodore: That's good to know that you share best practices there.

Tom Quinn: We do. And an attack against one financial institution is an attack against all of us.

Lindsay Theodore: Right.

Tom Quinn: And I think sharing those best practices is key to protect ourselves. And it really does make a difference. I think it's important to realize is it's both the client.

Lindsay Theodore: It's a shared responsibility.

Tom Quinn: That’s exactly right.

Lindsay Theodore: But I do want to go back to the situation with your father-in-law that you were kind enough to share. That's a scary situation but think about the fact that people knew him at the bank. The branch manager knew him, the teller knew him. Everyone knew him. So, they knew what was unlike him. And they could kind of step in and be that people, those people, to give him agency at that time, even though he had already gone down that road.  I think that having a trusted advisor like at your financial firms is really, really key because they'll be able to spot those types of incidents where if you call in and say, I want a withdrawal that seems very out of character, they'll have the relationship with you to challenge you and say, “what's really going on, like, tell me what's happening,” and you'll actually feel comfortable sharing it, right, without any shame or self-doubt. So having that relationship and I think another thing I'll just add, and this isn't like a sales pitch or anything, but I think clients often think that having accounts everywhere is diversifying their investments and diversifying their risk. And the issue with that is that if you have ten or 11 or 12 accounts, that you have to check the statements and go online and make sure the activity looks right, that's a lot of work for you.  It does mean that if one account is compromised, it won't affect the others potentially if you don't share passwords across them, which people should not do.

Tom Quinn: But they do.

Lindsay Theodore: But they do. And that's the issue is even if you have 12 accounts, it's harder to keep up on those. Right?

Jessica Sclafani: It's a good point, Lindsay.

Lindsay Theodore: And so having maybe consolidating some of those interactions so that you can build those strong relationships with those firms that you work with and not have so many, that can also be very empowering and helpful.

Tom Quinn: Simplification it's an important approach. It is because complexity is and agree with you. Complexity is just going to lead to an outcome that that isn't going to be optimal.

Lindsay Theodore: Correct. Absolutely.

Jessica Sclafani: So, Tom, you said something that I want to circle back to because it feels counterintuitive to me. You I think you mentioned that AI, we use AI at T. Rowe Price in our approach to detect fraud, even prevent fraud and protect investors. So, we're using AI to fight bad AI. Am I getting that right?

Tom Quinn: I think you're getting it exactly right.

Jessica Sclafani: Oh, good. Okay.

Tom Quinn: I think, you know, this kind of technology can be used for good or could be used for evil. And we have to adopt it. We may use it for fraud detection. We may even be using it to give a better experience to our clients and how we interact with them. So, we have to keep up with these kinds of things. And this is great technology. The promise of AI is off the charts, and we want to adopt it, and we want to adopt it with the right kind of guardrails, because there are things that we probably wouldn't want to use AI for, but we have regular governance discussions around that. Our leaders are briefed and trained on the topic. The technology and how we think about using it. And in some cases, you know, we choose not to use it, even if it potentially could benefit from us, right? Potentially. If it's not within our culture and it doesn't serve our clients the way that we want them to be served, we're not going to use technology in that way, but to close it out as we are using good AI to fight bad AI.

Jessica Sclafani: Probably an oversimplification, but sometimes that's helpful, right? I think we just talked about that. And, Lindsay, you mentioned the importance of having a trusted financial advisor, and I can't help myself, but just point out to our listeners that we do have an episode this season that is all about finding a financial advisor that really meets your needs and your preferences. So, I encourage listeners to check that out if they are thinking about looking for a financial advisor. As we bring our discussion to a close here today, I always like to make sure that we're leaving our audience with concrete actions that they can take after listening to us. So, I'm going to ask each of you the same question, what are some actions that listeners can take today to feel more secure and confident about their financial safety? Who wants to go first?

Lindsay Theodore: Well, I'll go first. So, Tom had mentioned having a plan of action for retirement. If this happens, these are the choices we'll have if I choose this, this is going to be the repercussion. Having that in your financial plan and in your investing strategy is absolutely critical. I think having a plan of action for how to address potential scams, who you'll call, what group text you'll send a message to, what the family word is, is really crucial, too. So maybe go back and have a plan of action for how you'd address something if you if you got a call or if you got an email that you were unsure about.

And then also, what would the plan of action be if something happened. Who would you call? What credit cards would you need to cancel? What financial institutions would you potentially have to contact? And I would just assure folks like you've heard several stories just from my family today. So, this can happen to anyone, don't be ashamed about it. Just try and control what you can and back to one other thing, do a password review. Make sure that you have strong passwords, unique passwords for each of your accounts so that God forbid one account is compromised, the others won't all sure be compromised as well.

Tom Quinn: And just to build on that multi-factor authentication, just a little bit of practical tech things, multi-factor authentication really does work. There are a variety of choices for multi-factor. Some are better than others, but in general, they're free. And pick the ones that meet your lifestyle the best and integrate that and ask your institutions that you work with if they have it and deploy it if you do. But partnering with the right institutions are key. Asking for help is important and feeling confident about the agency that we all have to step back, reflect, and that you're in control of the decisions that you make and the choices that you have. And just to go back again, trusted partners, trusted advisors who can bring to bear the investments and scale and advice for you to meet your needs now and as we go forward.

Jessica Sclafani: Well, Tom and Lindsay, thank you so much for joining me today. And thank you for sharing your personal stories, too. I know that really resonated for me, and I really think it will for our listeners as well. This has been such a valuable discussion about staying safe and our increasingly digital financial world. The landscape of fraud may be evolving and we know it is. But with awareness, vigilance and the right tools, we can all stay protected and dare I say, still connected. See what I did there? Tom has his alliteration. I have a little bit of rhyming.

But again, I'm Jessica Sclafani. Thank you for listening. If you like this podcast and I know you do, please rate us and subscribe wherever you get your podcasts. And remember, the numbers matter, but so does knowing. You have the freedom to live with purpose and peace of mind.

T. Rowe Price

Retire With Confidence®

This episode of CONFIDENT CONVERSATIONS® on Retirement is provided for general and educational purposes only, and is not intended to provide legal, tax or investment advice. This podcast does not provide recommendations concerning investments, investment strategies or account types. It is not individualized to the needs of any specific investor and not intended to suggest any particular investment action is appropriate for you, nor is it intended to serve as the primary basis for investment decision making.

Investors will need to consider their own circumstances before making an investment decision. All investments involve risk, including possible loss of principal.

The views contained herein are as of the date noted on the material and are subject to change without notice. These views may differ from those of other T. Rowe Price group companies and/or associates.

©2026 T. Rowe Price. All rights reserved. T. Rowe Price, INVEST WITH CONFIDENCE, RETIRE WITH CONFIDENCE, the Bighorn Sheep design, and CONFIDENT CONVERSATIONS, collectively and/or apart, are trademarks of T. Rowe Price Group, Inc. All rights reserved.

T. Rowe Price Investment Services, Inc., distributor. T. Rowe Price Associates, Inc., investment advisor.

202608-5050896