The Watchword Kit is not a service and not an app. It's the assembled system — scripts, grids, cards, and one honest rule — for installing fraud protection at your own institutions. Every word of it is on this page, free, no signup, no paywall. Prefer paper? The printed workbook and the $29/yr re-audit are at the bottom, both optional.
You'll need: a phone, your list of accounts, and a pen. Two steps involve asking a person for something — the scripts for those conversations are included, because they're the hard part.
How I built this
I built this because “name someone you trust” stopped being useful advice the day I realized I didn't have an obvious someone. When the standard financial-safety guidance says “just appoint a power of attorney,” it assumes a person I'd have to go find — and hand the power to withdraw my money, sell my property, and add themselves to my accounts. That is not protection. That is a bigger risk with a nicer name.
So I did the opposite. I built a system out of watchers who cannot touch a dime. People who get told, not people who get access. Settings my own bank and brokerage already offer, which I turned on myself. A short list of the scams actually aimed at women my age, and the one move that defeats each one.
It is not a service. I never see your accounts, I never touch your money, and there is nothing to link. You do the setup, at your own institutions, and you keep every bit of control. This reduces your risk. It does not erase it. No kit does, and anyone who tells you otherwise is selling you something worse than this.
Work in order
The six components
The components build on each other, and the last one only makes sense once the first five are done. Jump to any of them, or read straight through.
Investment and brokerage accounts only. Also readable on its own at the free guide.
There is a feature at every U.S. brokerage that installs a second person your firm can call if something looks wrong with your account — and that person cannot touch, trade, or decide anything. It costs nothing. It takes one phone call or one secure message.
As of 2024, about 42% of investors have named a trusted contact. That means roughly 58% still have not. It is free, and most solo women are in the second group. This walkthrough moves you to the first.
Adoption figure: FINRA Foundation, 2024. Trusted contacts exist under FINRA Rule 4512, which requires broker-dealers to make reasonable efforts to obtain one.
What a trusted contact is — and what it is not
Here is the part that matters, in FINRA's own words. Naming a trusted contact:
“does not give that person any authority over your account. A trusted contact cannot make trades in your account, cannot make decisions about your account, and does not become a power of attorney, legal guardian, trustee, or executor by virtue of being named your trusted contact.”
This is a watcher who cannot steal. The designation grants no power at all — though a person you've named power of attorney can also be your trusted contact; the two are separate roles, not opposites.
Do this for every investment account
A brokerage account, an IRA at a fund company, an old 401(k) at a former employer's plan provider, a robo-advisor — each is a separate institution and each needs its own trusted contact on file. FINRA Rule 4512 covers broker-dealers only. It does not cover your bank or credit union — that's Component 2.
Three tasks, three scripts
By phone — call the number on your statement, then say:
Check: “I'd like to confirm whether I have a trusted contact person on file for this account, and if so, who is listed.” Add: “I'd like to add a trusted contact person to my account. I understand this person cannot trade or make decisions on my account and does not become a power of attorney.” Change: “I'd like to change the trusted contact person on my account. Can you remove the current one and add the new one now?”
Before you hang up: “Can you tell me it's now showing on my account, and is there a confirmation you can send me?”
By secure message — look under Profile, Account Settings, or Beneficiaries & Trusted Contact in your online account, or send:
“Please add the following person as my trusted contact person. I understand a trusted contact has no authority to trade, make decisions, or act as my power of attorney. Name: __________ Relationship: __________ Phone: __________ Email/Address: __________ Please confirm once it is on file.”
The conversation with the person you're naming
“I'm setting up my accounts so there's a second person my brokerage can call if something ever looks off. I'd like that person to be you. To be clear: you can't see my balances, you can't move any money, and you can't make any decisions. All it means is that if my firm has a concern, they've got someone to call. Would you be willing to be that person?”
If they hesitate: “There's nothing to do wrong. You can't make a mistake with money you can't touch.”
Worksheet — Trusted Contact by account
Account / type
Institution
On file? (Y/N)
Trusted contact named
Date done
Confirmed?
When every row has a date, this component is done — record it on the Done Ledger (Component 6).
2 · The Bank Alert Grid
Banks and credit unions.
Component 1's trusted contact is a brokerage feature under FINRA Rule 4512. It does not cover banks or credit unions. Your checking account, your savings, your credit union have something different: alerts. Set up well, alerts make you your own second set of eyes — the thing a spouse across the kitchen table used to be.
The three alerts that matter most
1. Transaction-amount alerts. Notify me on any charge, withdrawal, or transfer over a dollar amount I choose — low enough to catch theft, high enough that groceries don't ping you.
2. New-payee / new-Zelle-recipient alerts. Notify me when a new person or company is added as someone I can send money to. Scammers often add themselves as a payee first; this fires before the money moves.
3. Login / new-device alerts. Notify me when my account is accessed from a device or location it hasn't seen before.
Turn on all three at every bank and credit union where you keep money. Log in and look for Alerts, Notifications, or Settings → Alerts. If you can't find it, call.
Phone script
“I'd like to turn on three account alerts. First, notify me by text and email on any transaction over [your amount]. Second, notify me whenever a new payee or a new Zelle recipient is added. Third, notify me when my account is logged into from a new device. Can you set those up with me now?”
Then ask the two questions many people never think to: “Does this bank offer a trusted contact or emergency contact I can put on file? And do you offer any view-only access I could give to a person I choose?” Honest expectation: many banks offer neither. Ask anyway.
A caution: if a banker suggests adding someone as a joint owner or authorized signer “to help watch the account,” pause — that person can move your money. That's a key, not a watcher. The words you want are “view-only” or “read-only.”
The printable Alert Grid
Bank
Account
Txn-amount alert — threshold & date
New-payee alert — date
New-device alert — date
Trusted/view-only?
$______ / ____
$______ / ____
$______ / ____
An alert you ignore protects no one — read them. When every account has all three dated, record it on the Done Ledger.
3 · The Scam Reference Deck
One card per scam family. Read once. Keep for reference.
In 2024, Americans 60 and older reported $4.885 billion lost to fraud — up 43% in a single year — across 147,127 complaints, with 7,500 people losing more than $100,000 each. Roughly 80% of elder financial-exploitation reports involve strangers, not relatives. The cards below are about the strangers.
FBI Internet Crime Complaint Center, 2024 Annual Report, ic3.gov.
Every card has four parts: how it opens, the tell, the counter-move, and what to do if you already engaged.
Tech-Support
Opens: a pop-up or a caller claiming to be Microsoft, Apple, or your internet provider, asking for remote access to “fix” a virus. Tell: a real company doesn't call about a virus and never gives you a number to call. Counter-move: close the browser or turn off the computer; call a technician you already know. If engaged: disconnect, change passwords from a different device, watch your alerts.
Government / Imposter
Opens: a call from “Social Security,” the “IRS,” or a “sheriff” — benefits suspended, back taxes, a warrant. Tell: threats plus gift cards, wire, or crypto equals a scam, every time. Counter-move: hang up, call the agency's real number yourself. If engaged: stop payments, report to the agency's fraud line and ReportFraud.ftc.gov.
Romance / Confidence
Opens: an attentive online connection who's always working abroad and can never quite meet, then an emergency or an “opportunity.” Tell: intense, fast, and never in person. Counter-move: never send money to someone you haven't met; insist on a live video call. If engaged: stop, tell your Circle-of-Three (Component 4), report it — there's no shame here.
Family Emergency (and the voice-clone twist)
Opens: a call — a grandchild in trouble, needs money now, “don't tell the family.” The voice may sound exactly like your relative; voices can now be cloned from seconds of audio. Tell: urgency plus secrecy plus an unusual payment. Counter-move: hang up, call your relative back on the number you already have. This is what the watchword is for. If engaged: stop payment, confirm they're fine, then tell your family — the secrecy was the scam's tool, not yours.
Investment & Crypto
Opens: a tip on a “can't lose” investment from an online acquaintance; small early withdrawals build trust before you put in more. This is the fastest-growing loss category. Tell: guaranteed returns, pressure to act, a “fee” to withdraw your own money. Counter-move: check the seller with your state securities regulator (nasaa.org) or FINRA BrokerCheck before moving money. If engaged: stop depositing, never pay a “withdrawal fee,” report to IC3.gov and the FTC.
Phantom Hacker
Opens: a “tech support” call, then a “bank fraud” caller, then a “government official” — each confirming the last — telling you to move your money to a “safe” account. Tell: anyone telling you to move your own money to protect it is running a scam. Counter-move: hang up, call your bank on the number on your card. If engaged: stop transfers immediately, call your bank's fraud line, report to IC3.gov.
Check / Overpayment
Opens: a check for more than expected — a sale, a prize, a remote job — asking you to deposit it and send back the difference. Tell: any arrangement where you deposit a check and send money back is a scam; the check bounces later. Counter-move: never send money against a check until it has fully cleared. If engaged: tell your bank it may be fraudulent, stop any pending payment.
The pattern under every card
Urgency, an unusual payment method, and a reason you mustn't check with anyone. When you feel all three at once, you're not in an emergency — you're in a script. Components 4 and 5 are built for exactly that moment.
4 · The Circle-of-Three & the watchword
Three watchers who cannot touch a dime — and a word only they know.
The old advice is “name one person you trust with everything.” The Circle-of-Three flips it: instead of one person with all the power, you name three people with none of it — watchers you'd call when a request feels wrong. Nobody signs anything. Nobody gets access to anything.
How to choose your three
They need zero financial skill. Good criteria: reachable (they answer the phone), level-headed (they say “let's slow down,” not “oh no, hurry”), and not entangled in your money. You don't need three perfect people — two willing ones today beats none. Your trusted contact from Component 1 can be one of your three.
The ask
“I'm setting up a simple safety net for my finances — three people I can call if I ever get a request for money that feels off. I'd want to run it past a calm person before I do anything. I'd like you to be one of my three. You get no access to anything of mine — you can't see my accounts, you can't touch my money. Would you be one of my three?”
Choose your watchword
Your Circle-of-Three has phone numbers. It should also have a word. A phone call proves someone dialed a number — it no longer proves who's talking. Voices can now be cloned from a few seconds of audio (see the Family Emergency card). A watchword fixes that: one word or short phrase, agreed on ahead of time, that only the two of you know. Say it correctly, and you've proven it's really you. Can't produce it, and something's wrong.
When to pick it: right after someone says yes to being one of your three — same call, same visit. Or do it once with all three together, so everyone shares the one word.
The script: “One more thing — let's pick a watchword. It's a word only the two of us know. If either of us ever calls the other and something feels off, we ask ‘what's the watchword?’ Let's pick something we'd never say by accident. Any word come to mind?”
Where it gets used: any of your three can ask you for it, and you can ask any of them, whenever a call or a request feels off — a “grandchild in trouble” call, a voice that sounds right but a story that doesn't. Correct word, keep talking. Wrong word, or no word, that's your answer.
The printable wallet / fridge card
Print two: one for your wallet, one for the fridge. Fill it in by hand — name, phone, and the one shared watchword, for all three.
Watcher
Phone
1.
2.
3.
Watchword (same for all three)
None of them can touch my money. All of them can help me think. Rule: no money moves for 48 hours. When all three names are filled in and each person has agreed, this component is done.
5 · The 48-Hour Rule
The one habit that neutralizes every scam.
No money moves, no codes get shared, and nothing gets “verified” for 48 hours — for any request that arrives with urgency. During those two days, run the request past one of your Circle-of-Three and check it against the matching card in the Scam Reference Deck. You don't have to decide if it's a scam. You only have to wait.
Your self-script
“I don't move money on anyone else's clock. If this is real, it will still be real in two days. I'm going to hang up, and I'll check it myself before I do anything.”
Shorter version, for when your mind goes blank: “Not for 48 hours. I don't decide about money on the phone.”
The three “exceptions” that are not exceptions
“Your account is compromised — act NOW.” That's the phantom-hacker scam. A real bank never tells you to move money to a “safe” account. “This is a legal emergency — no time.” That's the government-imposter or family-emergency scam. Real legal processes don't resolve by gift card within the hour. “The offer closes today.” That's the investment scam. A real opportunity that's real today is real enough to check tomorrow.
Every “this is the one time the rule doesn't apply” is itself the scam. The rule has no exceptions.
Lock-screen card text
Set this as your phone's lock-screen image, or print it and tape it to the phone:
THE 48-HOUR RULE — I don't move money on anyone's clock. No money. No codes. No “verifying.” Not for 48 hours. If it's real, it's real in 2 days. First call: one of my Circle-of-Three. Then: my bank, on the number I already have. Hanging up is not rude. It's the move.
6 · The “Done” Ledger
One page. Every account, every protection, every date.
The other five components are things you do. This one is the record that you did them. Fill it in as you finish each component. When it's full, you're done.
The people and the habits
Protection
Done?
Date
Circle-of-Three — all three asked and agreed, watchword chosen
☐
Trusted contact told what they agreed to
☐
48-Hour Rule — lock-screen card in place
☐
Scam Reference Deck — read, kept for reference
☐
The annual re-check
Once a year, take fifteen minutes and run down this same page: add new accounts, remove closed ones, confirm alerts still fire, re-confirm trusted contacts, look at your Circle-of-Three, re-read the Scam Deck.
What this costs: nothing. Every step is free and you can do it yourself, forever, with the kit you already have.
What the paid re-audit is, honestly: if you'd rather not track the changing scam landscape yourself, the $29/year re-audit does that reading for you. It's a convenience, not a requirement, and it buys you nothing you couldn't assemble yourself for free.
You're done
You built a defense for your money out of parts that grant no one any power over you. About 58% of investors don't even have the free trusted contact. You now have that and five more layers besides. It does not make you untouchable — nothing does. What it does is close the specific doors the people in the Scam Reference Deck are counting on finding open.
Everything above is free — this is what isn't
Prefer paper? Or giving this to someone?
The Printed Workbook
$49 once
All six components, assembled as a spiral-bound, fill-in-by-hand workbook. Shipped to you, or shipped straight to someone you're keeping an eye on — the gift for the niece to send the aunt who keeps an eye on everyone but has no one keeping an eye on her. Not required to use any part of this kit.
Annual Re-Audit
$29 /year, optional
A refreshed Scam Deck reflecting the year's new tactics, a re-confirm checklist, updated scripts if any institution's process has changed. Priced yearly, not monthly, because the value changes yearly. Never required — the Done Ledger above walks you through the same re-check for free.
Subscribe to get the kit delivered as a short email series, and to hear when the Scam Deck updates.