60 Comments
User's avatar
DEO's avatar

Thank you for your expertise, first things first. I am Getting a quote for a whole house generator. Was putting off but not now. I can get health aides and stock my pantry easy enough. I can unplug my wi-fi and even take my phone offline whenever possible. But even if I stop paying bills via my bank, and use paper checks, the bank will process through their online service, so my account number will be available through their systems, right? Also, my financial advisor direct deposits to my bank account from my retirement account, how do I get that? It seems impossible to hide, there will be a crack somewhere. This is exhausting . . . But truly appreciate your effort to inform us.

Expand full comment
Lexi's avatar

Hi DEO,

Agree, trying to stay one step ahead of DOGE is exhausting. As if we didn't have enough to worry about. 😵‍💫

It sounds like you are ahead of the game, I am also in the process of installing a whole house generator, if you have started the process you are doing great. My goal is to have backup power ready in time for our next hurricane season, which apparently is mid summer (we had our first hurricane ever last year with Helene).

Regarding your question about banks having your account number, since banking is mostly online these days it will be impossible to completely obfuscate your accounts but what I recommend is breaking the "chain of custody" wherever you can.

What that means in practical terms is withdrawing cash from your bank, or get a bank check, and deposit the funds in a different bank. Bonus points if you can hold it for an extended period between deposits.

I do not expect that DOGE will have easy access to any bank account number that has not been used previously for IRS payments or refunds. At this time I assume that banks will not hand over your account information, that may become a concern in the future but for now it is not a concern I have.

Hope that helps and stay strong, we are in this together.

Expand full comment
DEO's avatar

Very helpful to know I am on the right track doing what I can. Now getting my GenX son to hear me is almost impossible. He is so busy being busy with job, house, kids, etc. he has only taken in a bit of what is happening but it is slow. I wish I could sit him down and impart all the knowledge I have gathered being on Substack. He listens with half an ear so I have to back off a bit or he will close me out entirely. This is even a problem socially with neighbors, no one wants to talk about this regime, like they are in denial still! Even though they are 55+ community, some still working, many retired, like everyone is putting their head in the sand or so seems. Disheartening. I would love to develop a local group of like minded neighbors so that we can all share the news and possible events to attend but don’t know how to start.

Expand full comment
UnkleClyde's avatar

Just a couple things…

1. credit freeze is good but, realize that the 3 bureaus have processes in place for you to easily regain access to your credit. Each allow you to create a new account with your SSN & a new/different email address. Doge has access to all of our SSNs. Definitely since up with a service to monitor your credit.

2. Please don’t use Microsoft or Google 2FA they CANNOT be trusted! Authenticator app, yubikey or duo are much better options.

3. Secure your bank/creditunion account with a secret passcode when you talk them. Reiterate that nothing happens without this code. If you’ve received tax refund direct deposits ask the bank/CU to give you a new account number & don’t do direct tax refunds, ask for a check.

Great article otherwise… I’m also a Sr Cyber Analyst for the past 40yrs

Expand full comment
Lexi's avatar

Thank you for these tips! Responses below:

1. Agree credit monitoring is a great idea, I use Chase for that purpose. Also pull regular credit reports to cross check all open accounts belong to you.

2. A clarifying point: when you say "Authenticator app" are you referring to the Microsoft Authenticator app, because that is what I recommended as it can be used for MFA across many account providers. Linking the app in question below:

https://www.microsoft.com/en-us/security/mobile-authenticator-app

3. This is a great suggestion, I'll raise with my bank when I speak to them next.

Thank you for helping get the word out and the peer review. Let me know if you'd be interested in collaborating on a post if there is a cyber defense topic that you feel is pertinent to broadcast.

Expand full comment
Alemany's avatar

PS President Carter would be so proud of you.

Expand full comment
Lexi's avatar

Thank you! He and my granddaddy are my heroes. 🥹

Expand full comment
Susan Lawlor's avatar

Thank you for all this information.

Question/concern about protecting bank accounts. Yes I have a bank account that has been used to pay or receive IRS payments. That account is also where I receive my social security payments (and pay and receive pretty much everything)

Obviously I can open another account and start transferring everything, and create backup information so I can be prepared to pay bills with checks or cash. I'm nearly 70 and even through I'm much more digitally comfortable than a lot of my peers, I do remember how to live in an analog world)

However, I figure that the social security system is also going to be hacked before too long. I'm thinking about transferring everything *except* the IRS and SS payments to another account and leaving the existing account in place for those transactions. Or (and this is the crux of my question) does the very existence of that presumably compromised account leave me and all my other accounts at risk?

Expand full comment
Laurie Rubie's avatar

I came to the comments hoping to get the answer to your exact question. If I leave the compromised account open for essential payments but then transfer the money to a new account, am I really still protected?

Expand full comment
Lexi's avatar

Thank you for raising: How do you initiate a cutover in your banking system from a compromised account to an obfuscated account to block DOGE seizure of funds.

In system architecture this would be ideally implemented via ORCHESTRATION (will elaborate on this in a later post) but for now you will be enacting changes through human requested changes in your banking systems (a manual process).

Important terms and their definitions:

- a CUTOVER is a migration of an active bank account to a new account without causing outages or incurring fees for automatic payments/ pending transactions/ min balances

- a compromised banking account is an EXISTING account that you have previously shared with the IRS in service of processing tax payments or refunds.

- an obfuscated banking account is a NEW account whose banking details have never been shared with the IRS.

Goal: CUTOVER from your EXISTING account to a NEW account without exposing sensitive details that would aid a man-in-the-middle bad actor, DOGE, to intercept the transfer and capture funds or banking account details.

RISK

A man-in-the-middle attack is what it sounds like, it characterizes a cyber attack where a bad actor has used means (either a back door or otherwise) to insert themselves in the middle of your transaction as a way to steal data. The risk of man-in-the-middle attacks for DOGE is unknown at this point so we will assume HIGH risk until proven otherwise - this is a tenant of ZERO TRUST.

Method: Use 2 cyber defense techniques: Air gap + break the chain of custody. Plan a contingency period for your cutover where you have reserve funds in the EXISTING account to allow for pending payments to process while you switch to the NEW account.

An Air Gap is a dead zone in the network, put in place for a purpose. In this case you can create an Air Gap between your EXISTING account and your NEW account by withdrawing cash from your EXISTING account, holding it, and then depositing it in your NEW account.

For extra security, consider depositing the cash in a NEW bank account at a different bank, this will break the chain of custody and all but guarantee that a man-in-the-middle attack is disarmed in the short term.

Cutover implementation process:

1. Write down all pending payments and automatic payments you have for the EXISTING account, leave that exact total in the EXISTING account + whatever minimum amount is required to keep the account active without fees.

2. Open a NEW account, either at the same bank or another bank for additional security (break the chain of custody)

3. Withdraw funds, cash, that are over the total you calculated in step 1.

4. Deposit withdrawn funds into the NEW account.

4.1. In parallel, schedule your automatic payments to switch over to the NEW account. Make sure you time this so that the NEW account has sufficient funds for automatic withdrawal.

5. Once all automatic accounts are switched over and the NEW account is sufficiently funded, CLOSE the EXISTING account.

6. Cutover is complete.

I am not a banking SME so would appreciate a peer review on this proposal for those that have specialized expertise in banking exchange (I'll request from my network as well).

Hope that helps in the meantime!

Expand full comment
Cherie Scillia's avatar

Thank you for explaining and for your valuable advice and insights. This is exactly what I began doing over a week ago, including timing the automatic withdrawals.

My original set up was: my husband’s retirement accounts and my SS went into our credit union. The credit union also receives any federal tax refund automatically.

A week ago we issued new authorizations to deposit the monthly retirement funds to the “new” bank from which all bills will be paid automatically. I removed existing auto transfers between the bank and the credit union to isolate the CU.

I voiced my concerns to our credit union and they instructed me to open a new checking account with them that will be kept totally separate from the original checking account. My incoming SS funds (if they still come!) will be withdrawn by check or cashed out and then deposited into the checking account for paying bills.

I hope this works.

Expand full comment
Lexi's avatar

That's amazing Cherie you are doing all the right things!

This week I helped my mom open a new account at our regional bank and she moved over funds from her retirement savings. Next step is to do what you've outlined here with manually withdrawing her SS money and deposit into the new money market account. It's extra work but worth the peace of mind until DOGE is evicted from our banking system.

Stay strong, we are in this together.

Expand full comment
Mary Bryson's avatar

Is cash, dollar bills, the best form to transfer, or can we use a cashier’s check or write a paper check from compromised account to the new account?

Expand full comment
Lexi's avatar

I assume a bank check or written check is OKAY as long as you are depositing into a new bank account that is not previously known to the IRS or federal treasury.

Expand full comment
Starky's avatar

Thank you, Mary, for asking this question since walking around with more than say $50 isn’t my favorite where I live. Looking for a new bank/ credit union today.

Expand full comment
Blasphemous Nutrition's avatar

Wise is a UK based bank, but exclusively online. I’ve been using it as a savings account so that I can easily use cash in both Europe and the USA without high exchange rate fees. Presumably this is safe since it is based outside the USA? It’s never been used for government based payments nor deposits.

Expand full comment
Bill Christensen's avatar

In an earlier comment thread it was pointed out that Wise accounts for US people are run through JP Morgan and subject to US rules. So you may not really be moving that money "offshore".

Expand full comment
sotoportego's avatar

As far as I can seeno one else is doing anything like this, Lexi. The word will spread. Thank you.

Expand full comment
Lexi's avatar

Thank you, I have been heartened to see more cyber security SMEs speaking up recently but this is a niche space and many of us are active on the frontline of the cyber war. We need all the help we can get.

Expand full comment
Kristi Hoffmaster's avatar

Thank you. Let’s connect sometime if you like.

- CISSP and cyber risk professional here 🙏🛡️

Expand full comment
Alemany's avatar

Love to you. Now I have to take notes, listing “to do”priorities, as I read your informative gifts again. Thank you

Expand full comment
Debbie's avatar

Hi, Lexi. Following your advice, I called a couple credit unions to ask about offline contingency plans and realized I didn’t exactly know what I was referring to. Are we working under the premise that no internet will be working at all, for individuals and the banks/credit unions? And, does “cloud-based” mean “internet” for us laypeople? I’m working my way slowly through your to-do list.

Thank you!

Expand full comment
Lexi's avatar

Hi Debbie, sorry for the delay, please refer to this guide for how to talk to your bank about offline banking: https://open.substack.com/pub/landfamilyhome/p/insulate-your-household-from-doge?r=50mm70&utm_campaign=post&utm_medium=web&showWelcomeOnShare=false

In summery we should assume there will be periods of time where banks will be completely offline/ without internet or only online via Starlink/ satellite connectivity.

Expand full comment
Debbie's avatar

Thank you so much for all the knowledge you share.

Expand full comment
Kim D's avatar

I am a pretty smart person and I understand very little of what you’ve said here.

Expand full comment
Lexi's avatar

Hi Kim, thank you for the feedback and reading. Are there specific points that are confusing? Would schematics help?

Cyber security has a high barrier to understanding because the terms and ideas are going to be new concepts for most. I am attempting to help decode what's pertinent to understand in order to block DOGE from doing bad things.

Does the idea of building a "moat" around your household via offline support make sense? The idea with a moat is to create distance between you and the those trying to steal your data and do bad things with it (bad actors) and then give you time to respond with additional protections.

Cyber security is most effective with as many layers of protections as possible but being offline will be the most secure posture you can adopt.

Expand full comment
Maggs's avatar

I felt similar to Kim. Your comment above outlining banking steps was more clear, so maybe having steps like that in the posts would be helpful? Or when you say kill switch do you just mean off power? With our devices, keep our phones on airplane mode unless in use? The same goes for any tech devices?

Expand full comment
Laura HF Barde's avatar

May I add here? Thank you, Lexi, this is all helpful. (And somewhere in heaven my father is muttering I told you so!) I have rudimentary understanding of what you are saying but I quickly run into issues like “we bank at a mega bank and must keep that for elderly parent reasons.” Is there value in creating new accounts at the same bank? Second, can I keep my direct deposit for salary income? What about my retirement accounts linked to this bank? What is the risk of DOGE or other bad actor being able to access retirement funds via bank account links? So my feedback is perhaps prioritizing alternative yet worthwhile actions in your schematic. Thank you.

Expand full comment
Alyssa Edmondson's avatar

I am with Kim on this. Curious if you could use a lay person to collaborate with when writing these pieces. The action steps to take feel muddied up by the explanations of what is happening at a high level.

I offer my services to connect on this knowledge transfer you are trying to do. I am a theatre director. stage manager, and educator so having to clearly write out action steps is my forte.

I love all you are doing so not meaning to criticize. It’s just that I feel very unclear on what the action steps are. Many people will read this and feel so overwhelmed trying to prioritize and come up with the major and minor action steps it takes to do all of this in two weeks. I think having some of that work done for people will be helpful.

Just my two sense but no pressure to change what you are doing if it is working for you.

Expand full comment
Helene S's avatar

First, you are utterly amazing! 🤩 THANK YOU. I began doing many of these things in November and sharing the knowledge with friends but I think many thought I was going off the deep end. I work in an adjacent industry and we share many understandings about what is going on and how to respond and react. I am so grateful to you for putting this into actionable tasks. Now, that said - I never thought about the direct deposit bank account the IRS has 😩 Only considered tax refunds may not come. But I spent a lovely hour admittedly stoned (the only way I can be absorbing so much THIS lately) trying to figure out where that bank account connection resides. I’ve been all over TurboTax and Intuit - I don’t believe I even have an IRS account directly. It doesn’t seem Intuit stores it and it’s not added til the return is ready to transmit. Which may mean my taxes need to get done this weekend so I can change it to sending me a check (as if). But it still feels like the IRS must have my digits stored somewhere I can’t think of right now!

Expand full comment
Maggs's avatar

Very helpful, but very terrifying. I had no idea the extent of danger we are in (cyber security wise). Thank you so much.

Expand full comment
Lexi's avatar

Thank you for the kind words and I'm sorry that the general public is now having to wade into this space as it is stressful and anxiety inducing. Keep in mind that as long as you stay one step ahead of DOGE you will be in a strong cyber offensive posture.

The people that will be blindsided are those that are going to be devastated. Hopefully by the time DOGE causes major outages our households will be afloat and can lead others through the crisis.

This is going to be a slow burn and we just need to outlast DOGE. Their credibility will deteriorate quickly with the federal infrastructure and I anticipate DOGE will have little to offer in terms of leadership, giving others an opening to step up.

Expand full comment
Kelly Thompson TNWWY's avatar

Also: what if cash is no good? All changed to crypto?

Expand full comment
Deanna Laquian's avatar

Thank you so much for this knowledge transfer. I’ll be taking the steps you indicated.

Expand full comment
Mark Clawson's avatar

Thank you for posting. I’m the designated knowledge transfer for my extended family. A few questions:

- thoughts on VPN, do you see this as a means for encryption or will their capabilities just hack any VPN we use?

- does anyone know what Elon is doing to/with the systems i.e. system/image/data replication to a cloud? Installing XAi?

- should we be actively scrubbing data? What would this look like?

- what “canaries” should we be looking for?

Thanks!

Expand full comment
LuAnn Collins's avatar

Wow, you are a gift. When I brought up my concerns about this to friends a couple of weeks ago, I could tell they thought I had become untethered. I had tried to think through how to go about this decoupling and protect what few assets I have and you've given me the steps to follow. And more. Little by little as quickly as I can. I thank you! Mostly, I appreciate your helping me not feeling quite so hysterical. :) Rather than being the one who remains calm while others are losing their heads, I felt like the one losing my head while everyone else was calmly watching the zombies come stumble through the barricades. I can now remain calm and carry on with this (and your other) plan. Bless you.

Oh-- after Carter's funeral, my daughter commented that the 70's must have been a much better time in which to grow up. (I'm elderly and she's mid-life and teenager/young adult grandchildren). I said no. It was a horrible time. He was just a good man. I'm glad to find another person who thinks he was the best, totally under-rated and unappreciated. And rare.

Expand full comment
lori's avatar

Ar this point we have social security checks direct deposited. I'm assuming we should switch to paper checks and then should assume they'll never come either because of no staff there to process the change or they aren't planning on continuing to provide ss payments anyway.

Expand full comment
Diane's avatar

I don’t think SS will even do checks anymore. I believe there’s a requirement that all payments be electronic.

Expand full comment
lori's avatar

So is the answer to set up an account that is used for ss/tax returns deposits ONLY and manually move funds over so there is no electronic internal transfer connection to that account?

Expand full comment