The $15 Billion ‘RAT Attack’: How Remote Access Tools Threaten Your Wealth

 Protect your wealth from the $15 billion "RAT Attack" in this episode of  Your Retirement Guide by George Jameson, CFP®, RICP®, MBA with Capital Wealth Group. Learn how to identify the invisible red flags of remote access scams and the exact "digital fortress" steps required to secure your financial accounts. 

 Welcome to "The Retirement Guide" Podcast! I'm your host George Jameson, owner of Capital Wealth Group, a Fee Only Advisory firm. Whether you’re nearing retirement or already retired, Join me each week as we explore the world of retirement planning and equip you with the knowledge and tools you need for a successful retirement.

Thank you for tuning in to this episode of The Retirement Guide. If you enjoyed this episode, please subscribe & leave a review. If you'd like a free 30-minute retirement review, visit our website at www.capitalwealthplan.com to schedule.

This is for education only.It is not tax, legal, or investment advice. Before  acting on any information consult your tax, legal, or investment advisor.

Let's Connect!

Visit our Website: Capital Wealth Group

Schedule a Free Introductory Call Today! (30min)  

Capital Wealth Group is a Fee-Only Advisory Firm located in Columbia, SC , serving clients locally in South Carolina and North Carolina and virtually nationwide. 

Any Questions or Topic Ideas? Send me an email at George@capitalwealthgroupsc.com

Transcript

 Welcome to your retirement guide. I'm George Jameson, certified financial planner and founder of Capital Wealth Group in Columbia, South Carolina. If you're watching on YouTube or listening to the podcast, thank you for joining me. I usually spend our time talking about retirement planning topics, , but today we're talking about protecting your money.

So I recently got an alert from Schwab. And I thought it prudent to share. It doesn't matter whether you keep your money at Schwab, fidelity, Vanguard, a wirehouse, a credit union, you name it. This is a universal red flag. Whether you handle your own trades or you have an advisor manage your money, you can't afford to be hands off here, even with a diligent advisor watching over you.

You've got to stay on top of your own accounts. The threat I'm talking about is what's called a rat attack, and no, I'm not talking about actual rats, of course, I'm talking about remote access tools. It sounds technical, but it's a scam that can hit anyone if they aren't prepared. So based on FBI reports, over 260 million was taken from this type of scam in 2025.

And it has increased over 55% from 24 to 25 and will likely continue going up in 2026.

So what is a rat attack? Normally, when we think of a computer virus, we think of something that breaks your computer or maybe steals your files. A rat is different. It's stealth software. The criminals aren't looking to break your computer. . They use legitimate software, the same kind of tools an IT professional would use to help you fix like your printer.

But they use it to take control of your device without you ever knowing they're there.

So how is the trap set? It usually starts with something that looks completely normal. You might get an email or a text, what we call a phishing attack. In 2026, these are getting incredibly realistic. You might see an evite to a friend's party, a Zoom link for a family or a business call, or an urgent invoice from a company you actually use.

Lately, they're even impersonating the Social Security Administration, Medicare or your custodian itself, . Here's the scary part. The moment you click that link or open that attachment, the RAT is installed. There's no, are you sure? Or a popup?

There's no notification. The software just connects to a remote server. Suddenly they are sitting in a room halfway across the world looking at exactly what you're looking at on your screen.

So what can they do once they're in? , Once a criminal has a rat on your device? They can monitor everything. They use key logging to record every password you type. They can watch your screen.

They can see your bank balances and your account numbers. They can piggyback your login. This is the most dangerous one. They wait for you to log into your Schwab or Fidelity account or whatever. Then you do your two factor authentication. You enter the code from your phone. You've opened the door,.

The criminal then piggybacks on that session. While you're looking at your portfolio, they're in the background trying to move your money to an outside account or even move your entire account. And because they're using your trusted device and your IP address, it's invisible to most antivirus software.

Your computer thinks it's just doing your normal business. Let me give you two examples. Scenario number one is the fake security breach. A client receives a text. Let's say it's from your custodian. It is an alert saying there's unusual activity. Click here to verify. You click the link. It takes you to a website that looks identical to your custodian account. It then asks for your login. While you're typing, the rat is downloading. Then a representative might even call you sounding professional, asking you to download a support tool so they can secure your account. Please never do this because once the tool is there, they have the keys to the kingdom.

Now, scenario number two, you receive a fake industry email. Nothing seems to happen, but the next time you log into your accounts. The bad actor is right there with you, ready to move money. Now, some invisible warning signs. Since these attacks are designed to be hidden, you have to look for the glitches.

Here are some red flags. If your screen suddenly goes blue or black, and a message pops up saying, do not turn off your computer system is being scanned. Stop. This is often a tactic to keep you from using the computer while the criminal is busy transferring your funds in the background.

If you see this, do not wait. Physically unplug your computer and turn off your wifi. What to do if you suspect an infection. If things fell off, maybe your mouse is moving on its own or you see programs opening and closing. Here's your emergency protocol. Disconnect from the internet right away.

Pull the plug, turn off wifi. This cuts the leash the criminal has on your device.

Then call your financial institution right away like Schwab or Fidelity, and if you have an advisor, also call he or she let them know your device may be compromised so they can freeze money movements. Do not change your passwords yet. If the "RAT" is still on your computer,

the criminal will just see you typing the new password. Only change your passwords from a different clean device like a tablet or a phone that wasn't used. And then you may want to consult a pro. You may need to factory reset your computer to ensure the rat is truly gone.

So now, how to build a digital fortress, at least for these type of attacks.

I don't want to just scare you. I want to help you. Here are the steps I recommend for all of my clients at Capital Wealth Group.

So the separate device rule, if you use an MFA app, which I do recommend, like a Google Authenticator, put it on a device other than the one you use for banking or investments.

If your laptop is compromised, but your security code is on your phone, the criminal still can't get in.

And then next. Use bookmarks never type schwab.com or fidelity.com into a search engine. Scammers use search engine optimization to put fake sites at the top of the results. Especially for smaller firms.

And then type your URL once, verify it's correct and bookmark it. Only use that bookmark .

And the third way to protect yourself. If you use an advisor, talk to your advisor about limited view for your online access. This allows you to see your balances, trades, returns, et cetera, but requires a phone call or a physical signature to move money out. It's a great way to protect your money.

And then log out. It seems simple, but close your browser window the second you're done. Don't leave your banking tab open while you go browse other websites.

That's all the tips I have for today. I'm sure there are plenty others. Please leave a comment if you know of them. Thanks for joining me on your retirement guide.

Again, I'm George Jameson, CFP, founder of Capital Wealth Group in Columbia, South Carolina. We're a fee only firm helping you plan and live confident in retirement. If you'd like to take the next step, schedule a free consultation at our website at Capital Wealth Group sc.com. We work with clients here in South Carolina and virtually nationwide to help you retire with clarity and peace of mind.

If you found this helpful, please subscribe and share your thoughts in the comments. As always, here's to living your best life now and later. Have a great day.