You both raise valid points. Just putting the info out there.
And it’s appreciated.
About the only defense we have is to change critical passwords regularly and have one email account that is strictly for financial business. I’ve even considered buying a cheap Chromebook to use only for banking and investment log-ins.