Have You Already Been Hacked?

I recently wrote a post entitled, “Assume Your Social Security Number is Already Out There”, which was inspired by an article I read suggesting that the personal information of about a quarter of Americans has already been hacked. My experience in the computer networking industry makes me think that number is likely quite conservative.

I have been notified four times in the past year that my personal information might have been compromised. When large companies like Target are hacked, they often offer their customers a year of free credit monitoring service and I currently have two such subscriptions going simultaneously.

There is only so much these services can do, however. Neither noticed when someone filed a tax return in my name, for instance.

Long before business school and my interest in retirement finance, I was a systems analyst with a degree in computer science. My specialty was data communications networks. Truth be known, computers are my first love and much of my financial research is done at my computer with code I write in Mathematica or R.

I had an email account 35 years ago. (As geeks go, I’m ancient.)

Today, I read an article in the New York Times Personal Tech section under the headline, “How Many Times Has Your Personal Information Been Exposed to Hackers?”. The authors began with this statement:

“Half of American adults had their personal information exposed to hackers last year alone.”

That sounds more like it, but since most companies don’t know they’ve been hacked until they find their data for sale somewhere on the Internet, it might be an optimistic guess. Many companies will never know they were hacked.

The quiz at the NYT article will give you an idea of your vulnerability, but look at the names. Who hasn’t subscribed to AOL, or used a charge card at Target or K-Mart, applied for a government job, joined E-bay or Twitter, or downloaded Adobe something-or-other?

The article reinforces my own feeling that nothing is currently safe on the Internet: “Security experts say there is no way to keep hackers out of systems with traditional defenses like firewalls and antivirus software.” The skills and tools available to hackers today have a huge advantage over the tools available to protect us. Passwords don’t work. Firewalls and anti-virus software are speed bumps.

I’m not suggesting you avoid these tools. It’s a little like making sure yours isn’t the easiest house on the block to break into. But if a burglar wants your house badly enough, he can probably find a weakness.

I have long suggested two-step authentication wherever it is available. A list of websites that support two-step authentication can be found at TwoFactorAuth.org. For many of these websites, a hacker would need your password and your phone. I use two-step authentication at Fidelity, Vanguard and Charles Schwab and on several other sites, including FaceBook.

(Some two-step authentication processes use a special key fob device to provide an ever-changing PIN (Charles Schwab, for instance) and others use an authenticator app on your smart phone (several companies use Google Authenticator). But many use text messaging to send a one-time password to your phone. Be aware that hackers may be able to access your phone at say, VerizonWireless.com, and forward these text messages to themselves. If your carrier's website is not also protected by two-step authentication, this leaves a hole for hackers to get through. A fob or an authenticator app are safer.)

Password managers like LastPass can help you create and “remember” complicated passwords. (They say the best password is the one you can’t remember.)

If you don’t have virus protection, don’t let the cost hold you back. I like Avast and it’s free, but there are plenty to choose from.

Another important step that I think makes a lot of sense, especially for retirees, is a credit freeze. I wrote about those in Assume Your Social Security Number is Already Out There. They can be a bit of a pain if you open credit accounts frequently, but most retirees don’t. Even if you do, it’s less painful than finding out someone has opened a credit account in your name and run up a huge bill. You won’t be responsible for much of that bill, if any, but cleaning up the mess will be formidable.

Personally, I’m not sold on credit monitoring services, though I do use them when the companies I trust with my personal information get hacked and offer those services free. They can’t hurt, but they monitor your credit report, not your accounts.

I use alarms on all my financial accounts that send a text message to my phone if there is an overseas charge on a card, an ATM withdrawal, or a charge above some maximum amount.

To summarize, here are a few things you can do to protect yourself:

• Consider a credit freeze at all three credit agencies
• Use two-step authentication whenever it is available
• Use your free annual credit report from one of the three agencies every four months to review your credit
• Use a password manager to help create and use strong passwords online
• Use a firewall and a virus checker at home. Excellent versions of both can be downloaded free.
• Set up text message alarms to notify you of unusual activity on your bank or credit card accounts

These won't fully protect you, but as my grandfather used to say, they're better than a poke in the eye with a sharp stick. It's more efficient for a hacker to steal your personal information in  bulk from Home Depot than to attack your home computer, but the latter still happens.

As I said in the previous post, I think it’s safest to assume that identity thieves already have your personal information, even if they haven’t gotten around to using it, yet. They probably do. The credit freeze may keep them from opening a new account in your name.

In general, the bad guys currently have all the artillery. If you don’t believe that, take the quiz at the Times article. It will open your eyes.

---

My post on Social Security benefits and early retirement generated several comments. (Posts on Social Security always do.) If you're looking for a basic booklet that explains your benefits in a very readable way, I recommend The Social Security Claiming Guide from Boston College Center for Retirement Research. There is a small charge for hard-copies, but downloadable versions are free.

Early Retirement and Social Security Benefits

In my first post on this topic, The Risk of Retiring (or Being Retired) Early, I noted that retiring early means a longer and more expensive retirement. In my second installment, Retiring Early: Lost Savings, I reviewed the risk of saving less. And in the third, Early Retirement: Spending Sooner, I considered the combined consequences of simultaneously stopping savings and starting spending. Another major financial risk of retiring early is not optimizing Social Security benefits.

I recommend that most retirees delay Social Security benefit claims as long as possible, but there are some people I just cannot convince. They're afraid that fiscal conservatives who have tried to dismantle the program since its inception in the 1930's will soon have more success than they have had in the past 80 years, or that they will not live long enough after retiring to "break even." But, I suspect a lot of it is addressed by a recent Forbes piece entitled, Most Americans Can't Pass This Basic Social Security Quiz, and they just don't understand how Social Security works.

The basic problem we try to solve by delaying Social Security benefits is the mitigation of longevity risk (growing very old and outliving all our savings) and delaying benefits is the single most cost-effective way to achieve that.

Here's the problem we hope to mitigate by waiting. John can retire at age 70 and receive benefits of $36,000 a year, he can retire at full retirement age of 66 and collect $27,600 a year, or he can retire at age 62 and receive $21,000 a year.  John's wife, Martha, will be entitled to spousal benefits of $13,800 a year, assuming she claims at her full retirement age. Her spousal benefit, like his retirement benefit, is reduced if she claims early, but her spousal benefit, unlike her survivors benefit, isn't dependent on when John claims.

If John claims at 70 and dies first, which is more often than not the case, Martha's spousal benefit will be replaced by a survivors benefit equal to John's retirement benefit. If John claims at age 70, Martha's survivors benefit will equal (his) $36,000 a year but if he claims at 62, her survivors benefit will only be $21,000 a year for the rest of her life.

If John claims at 62 and dies at 71 but Martha lives to 96, Martha is stuck with a $21,000 benefit for two and a half decades when she might have enjoyed $36,000 a year.  (Whether your Martha begrudges the extra $375,000 after you're gone is between you and your spouse.) It really all boils down to whether you view Social Security retirement benefits as insurance against a very poor financial outcome or you view it as a game you are trying to win against the Federal government. But, be forewarned that the government doesn't care who wins and that you generally "win" when you claim early by not living long.

Here's the problem the "claim early" crowd hopes to mitigate. John, or John and Martha, plan to delay claiming, but both die in their late 60's and never receive a penny of their benefits. From a purely financial perspective, this isn't as severe an outcome as living to 100 with inadequate funds for the last decade or so. While we would all probably hope to live longer, a short retirement means we are far less likely to outlive our wealth.

Some of those arguments made by the "claim early" crowd are valid. Maybe you and your spouse won't live a long time, who knows? Maybe benefits will be reduced in the future. But living long enough to regret claiming early is a far more common event than reductions in Social Security benefits have been. Don't protect yourself from sharks and ignore heart disease.

Nearly all academics in the field and economists, some Nobel laureates, recommend delaying benefits as long as possible. If they can't convince you, I certainly can't. If you do, however, agree that delaying claims for Social Security benefits is a good idea, then it becomes a consideration for early retirement.

Retiring early often means that you will need to live completely off retirement savings until Social Security benefits kick in, unless you are lucky enough to have a pension. That may put pressure on your retirement plan, unless you are quite wealthy, to claim benefits sooner than you otherwise would and to forgo the most effective longevity insurance available.

Next time, I'll talk about my own decision to retire early in Early Retirement: Would I Do It Again?

Before I do, let me say that I really appreciate your questions and comments and I hope you won't feel constrained to the topic of the post you are reading. Feel free to ask any retirement finance question anytime. If I don't know the answer, I'll find it. Sometimes your questions spawn an entirely new post. If you have a question, there is a good chance that several others have the same one. I prefer that you log in any leave your name, but do so anonymously if it makes you more comfortable.

I hope you're enjoying your summer as much as I am mine!

Early Retirement: Would I Do It Again?

After my first post on this topic, The Risk of Retiring (or Being Retired) Early, several readers wrote comments about the rewards of retiring early, despite the financial risk. You don't have to sell me. I retired quite early and I am having the time of my life. But, none of these posts were meant to suggest whether you should retire early or not. My intent is simply to make you aware of the financial risks you ought to consider before you make that decision.

And then there is the darker side of this issue. First, the majority of American workers will not be able to accumulate enough savings to retire comfortably at 70, let alone years earlier. And as surveys I mentioned in that first post show, more recent retirees are reporting that they weren't able to retire when they planned than those who report they were. Unfortunately, that number is growing. Retirement isn't always a choice. It usually isn't.

The major factors that can make early retirement financially riskier are:

• a longer (and consequently more expensive) retirement, 
• fewer years to save, 
• lost returns on those forgone savings, 
• lost returns on savings that we spend at an earlier age,
• difficulty un-retiring the longer you are out of the workforce,
• a lower sustainable withdrawal rate (or life annuity payout) due to the longer expected lifetime in retirement, and
• the potential pressure to claim Social Security benefits sooner.

There are several others, of course. Health insurance cost should probably still be considered risky, though the Affordable Care Act has removed some of the risk of obtaining insurance until Medicare kicks in at 65. It is still costly. ACA was intended to make insurance more widely obtainable, not to make it cheaper. Consider this in your decision, particularly if you're used to company-provided health insurance.

There is also the loss of the safety net of returning to work. Wages typically peak around age 55 and decline afterward, anyway, but the longer you leave the workforce, the harder it is to return with anywhere near your previous income.

The converse of those risks provide a list of things you can do to make retirement financially less risky by delaying it:

• a shorter (and consequently less expensive) retirement, 
• more years to save when you're typically able to save more, 
• investment returns on those additional savings, 
• more years for our portfolio to grow without spending,
• a higher sustainable withdrawal rate (or life annuity payout) due to the shorter expected lifetime in retirement, and
• less pressure to claim Social Security benefits sooner.

In fact, this series of posts is not only about the financial risks of retiring earlier, but about the benefits of retiring later.

I suspect than many workers contemplating early retirement underestimate the risks I have pointed out in these past few posts. (I did.) Just a few years either side of a planned retirement age can make a difference; several years make a big difference.

You may be wondering how I feel about retiring early a decade after I made that decision. I'll share a bit of the experience.

I retired in 2005, just before the market crash (housing and stock) in early retirement that we financial analysts say you should fear more than just about anything except perhaps living to 110. Fortunately, my finances were positioned well enough to absorb it. My finances are in better shape now than the day I retired.

I struggled with health insurance before ACA because I had a pre-existing condition. I was able to find health insurance, but the cost was tremendous, much higher than I had planned, and in ten years my high-deductible insurance never paid a claim.

Would I do things differently? I retired early primarily for non-financial reasons. Given my same circumstances as 2005, I would make the same decision. But as much as I had studied retirement before deciding to retire early, I didn't fully understand the financial risk I was taking. After a decade, and knowing what I do now, I might have considered working a while longer to reduce some of that risk – but probably not.

I'm pretty sure that retiring early is far, far riskier than most people assume. Then again, I'm the happiest person I know. My day is packed and virtually everything on my calendar is something I really, really want to do.

On the other hand, the second happiest person I know loves his job so much that he barely slows down for weekends. He may never retire.

The decision isn't purely financial, but I would advise you not to ignore that part of it.

Early Retirement: Spending Sooner

In my first post on this topic, The Risk of Retiring (or Being Retired) Early, I provided some thoughts about the risk of retiring early and perhaps extending what might already have been a long and expensive retirement. In my second installment, Retiring Early: Lost Savings, I reviewed the risk of retiring early and consequently saving less. As I mentioned in that second post, limiting savings at the end of retirement has a significant impact, but when we stop saving early, we typically also start spending from savings. The cost of early spending is greater than the cost of forgone savings and the two combined are substantial.

(As always, click on a chart or table to see a larger version. Hover your mouse over any yellow text.)

Here's the chart from that second post showing the cost of forgone savings without the simultaneous cost of early spending, in other words, imagine a retiree who could stop saving, retire, and avoid spending savings until age 70. (Note a minor change to the chart from my last post: this one graphs balances at the beginning of each year whereas the last post assumed the worker retires at the end of the year.)

Chart 1

As you can see, were this imaginary retiree able to retire at age 55 and not touch retirement savings until age 70, her portfolio value at age 70 would be about $265,000 less than it would be if she had kept saving until age 70. She would save $156,000 less over those 15 years and lose $109,000 in interest on those forgone savings.

Typically, however, when a worker retires and stops saving for retirement, he also begins spending from savings. Chart 2 below shows the resulting portfolio balances when a retiree simultaneously stops savings and starts spending at a given retirement age. It also shows the amount of spending supported assuming a constant-dollar annual withdrawal of the portfolio balance at the retirement age.

The amount of the sustainable withdrawal percentage is calculated using Milevsky's formula for sustainable spending (download PDF) using the life expectancy from the "male" columns of the following table. Note that females have slightly lower SWR's because they have longer life expectancies. My first post on this topic noted that the longer you postpone retirement, the greater your expected savings will be and the larger the percentage you can safely spend annually.

Table 1.

For example, if our sample retiree stops saving at age 65 (the inflection point in the purple line on Chart 2), he would have accumulated $1,181,178 by age 65 and Milevsky tells us we can assume he could spend 4% of that amount, or $47,247 annually beginning at age 65. If he saves until age 70, he accumulates $1,712,935 and Milevsky tells us he can spend 4.6% of that amount annually because he has a shorter life expectancy.

These probably seem like hugely different outcomes, and they are, so let me walk through one example of retiring at age 65 (purple curve on Chart 2 above) versus waiting until age 70 (teal curve on Chart 2 above) in Table 2 below.

Table 2.

Retiring at 70 allows the retiree to contribute $56,000 more to savings in this example. Five more years of 7% annual returns with no withdrawals provides over $530,000 more in portfolio savings. Together these amounts create a portfolio at retirement five years later that is $531,756 larger. Because the 70-year old has a 4-year shorter remaining life expectancy, he can spend 4.6% of this portfolio, according to Milevsky, which is 15% more than the 4% he could spend at age 65. The increase in spending from 4% of $1.18M to 4.6% of 1.71M is more than $30,000 a year.

A lot of this difference comes from the huge growth in the portfolio the last few years of retirement resulting from compound earnings. These portfolios grow exponentially and each year that you delay spending affects your savings balance more than it did the year before. (This is why most financial planners urge you to be very cautious with your investments the last decade of your working career.)

A substantial amount of the sustainable spending difference also comes from the increased SWR – the retiree gets to spend a larger percentage of a larger portfolio. In this example, the additional spending increases $21,269 a year from a larger portfolio at retirement and another $10,278 from an increased SWR.

This scenario is an example and there is no guarantee that your portfolio will grow at all in the final five years of your career, let alone that it will grow as much as 7% annually. The intent is only to show how changes in retirement age affect retirement spending. How much it affects spending depends on market returns and life expectancy, things we can't predict.

The earlier you retire, the less money you can spend after you retire. A significant portion of the reduction of retirement spending can be attributed to the fact that you stopped saving earlier, and a larger portion of additional cost is attributable to spending savings earlier. Toss in the lower sustainable spending amount at younger ages because we have to plan for a longer retirement and the body blows add up quickly.

So far, those body blows from retiring early include:

• a longer (and consequently more expensive) retirement, 
• fewer years to save, 
• lost returns on those forgone savings, 
• lost returns on savings that we spend at an earlier age, and 
• a lower sustainable withdrawal rate (or life annuity payout) due to the longer expected lifetime in retirement.

Of course, you can turn that frown upside down by looking at the flip side of those bullets as advantages to delaying retirement: a shorter, less expensive retirement, more years to save, etc.

There is still at least one major financial risk to consider when deciding to retire early, or evaluating the impact of forced early retirement, and that is the impact on Social Security benefits. I'll cover that next time in Early Retirement and Social Security Benefits.


--------------------------------------------
Note: The assumptions for these calculations are the same as in the initial post, The Risk of Retiring (or Being Retired) Early. I assume the worker will earn the "typical" annual incomes shown in the charts in that post and will save 10% of earnings every year. I assume he or she will earn a consistent 7% annual return on all savings (an optimistic assumption in current capital markets). All calculations are in nominal dollars except for expected market returns used for the Milevsky formula, for which I assume a 5.6% real annual return with 11% standard deviation.