How to secure the logins, alerts and phone number behind your card

The short answer

When a message says a payment failed, don't start with its link. Open the retailer's saved order page and your bank's app yourself. If the order is paid and the charge has posted, you'll see that there, and you never have to type a password into a text.

Then look at what sits behind the card. The email account that receives password resets, the phone number that receives verification codes and the alerts you'll actually notice all decide whether a thief can get around the card's own protections. Julia's approach is one manageable session: secure the email and bank logins, save recovery details and turn on useful alerts.

After that, check what your carrier and card issuer offer, such as number-transfer protection and virtual card numbers. Each tool does one job, and none of them does all of it.

Check the message without trusting it

Julia's example is a lamp ordered for the home. A text arrives saying it can't ship until she enters her card details and her bank password. The timing makes it feel believable, because she really is waiting on an order.

Her answer is not to decide whether the text looks convincing. She opens the retailer's saved order page and her bank app on her own. If something truly needs fixing, she can fix it there and go back to waiting for the lamp.

The same rule applies to phone calls. If an unexpected caller asks for a one-time login code and says they're from fraud prevention, don't give it. End the call and contact the bank through a route you already know. A caller can know your name or account details and still be an impostor.

Secure the email behind the card

Once the order is checked, Julia looks at the email account connected to her bank. It's easy to focus on the card password and forget where a password-reset message would go. That inbox may also receive new-device notices and account-change alerts, so if someone can get into it, a strong bank password leaves a gap. Protect both.

• Use a different strong password for each important account. A password manager makes that easier to keep up.
• Turn on the strongest extra sign-in protection your provider supports.
• Save recovery information somewhere safe that you can reach if your phone is unavailable.

Options vary by provider. A security key or authenticator app can avoid some of the risks that come with text messages. If text verification is your only choice, use it, and check the security of your phone account too.

Protect the phone number

In a SIM-swap attack, someone may persuade a carrier to move your number to a device they control. They can then receive the verification texts meant for you.

Ask your carrier about an account PIN and about ways to block unauthorized transfers of your number, and follow the carrier's official instructions. One detail causes confusion: a PIN that unlocks the physical SIM in your phone is not the same as protection against moving your number. Make sure you're turning on the feature you actually need.

If your phone suddenly loses service and you suspect a takeover, don't wait for the next card alert. Contact the carrier promptly through a trusted route and check your financial accounts as well.

Set alerts you'll notice, and include travel rewards

Where your issuer offers them, Julia turns on alerts for transactions, failed payments and changes to contact information. They have to fit your routine. If you're ignoring most of the messages, adjust the settings until the alerts stay useful.

Her check also covers airline and hotel accounts. Miles and points are worth protecting even when no card charge appears. If a program offers alerts for redemptions or profile changes, turn them on, and use separate passwords and whatever extra sign-in protection each program supports. If a reward disappears or your contact details change unexpectedly, contact the program through its official site, ideally before you open the app to book the next trip.

An unfamiliar charge deserves a look through the issuer. Don't assume a small amount is harmless, and don't wait for more charges before checking. Merchant names can look unfamiliar for legitimate reasons, so compare receipts and household purchases as part of the check.

What virtual numbers, locks and freezes do

Each of these tools has a narrower job than it may sound.

• **Virtual card numbers.** Eligible Capital One accounts, for example, can offer a general online number or merchant-specific numbers. They reduce how often you share the physical card number, and individual numbers can have their own controls. They are still linked to the underlying card. They aren't anonymous accounts, separate credit limits or protection against every type of fraud. If someone controls your bank login, changing the number used for a purchase may not solve that.
• **Merchants and virtual numbers.** Some hotels, rentals and ticket pickups want the physical card for booking. Ask how their verification works before the trip, while you still have options. To cancel a service paid with a virtual number, contact the merchant. Deleting the number might make a future charge fail, but it doesn't automatically end the agreement. Follow the cancellation process, save the confirmation, then manage the payment details.
• **Card lock.** A lock can help if you misplace the card, but the issuer decides which transactions it blocks. Don't assume it stops all recurring charges or replaces a stolen-card report.
• **Credit freeze.** A freeze restricts access to a credit file and can help prevent certain new accounts from being opened. It doesn't secure an existing account's password, stop every charge on an existing card or protect your email. Those need their own controls.

Where the Wallet Score fits

Julia's Wallet Check is simple: secure the logins, turn on useful alerts and know how to reach each provider yourself. A card's Wallet Score compares its value and features. It doesn't certify that your accounts are secure, and it doesn't replace these habits.

Before you act

Check each setting on the provider's own page or app, reached through a saved bookmark or the app you already use, not through a message. Confirm which protections your bank, email provider, carrier and reward programs support, and follow their official instructions, because options and names differ.

Features such as virtual numbers are available only on eligible accounts, and issuer terms can change, so confirm the current details before relying on them. If you report unauthorized changes to the relevant institutions and personal information has been misused, IdentityTheft.gov has recovery guidance.

This guide reflects Julia's script as written. No card records were attached, so there are no card-specific figures or verification dates to cite.