Boston, Spring of 2012

Waynflete School’s team has made it to the finals of the Boston Federal Reserve Cup Challenge for Economics and Personal Finance, and we wouldn’t have gotten that far without Alysa, who was the team’s default personal finance expert, successfully fielding questions on credit score, insurance, banking, and more.

And…we won!

Fast forward to 2025, and here I am once again turning to Alysa – this time for professional help on a critical topic: cyber hygiene (her phrase, not mine, and I love it). Who knew that she’d continue to do great things? I did!

Alysa, tell me about your work at Avalara.

During the pandemic, I was hired as an Operations Analyst by DAVO Sales Tax, which has since been acquired by Avalara Inc. Avalara is a B2B tax compliance company, serving all sizes and types of businesses in the business-tax space. I am just about to start my fifth year with this organization and am currently an Analyst of Global Client Payments (I work on the Treasury team). I manage company and customer funding and payments, bank reconciliations, customer refunds, and merchant account balances. I also audit sales tax filings and bank transactions for fraudulent or inaccurate payments and work closely with our tech engineering team to make product improvements to our funding processes.

It seems that our financial security is being compromised daily through cyberattacks and scams. Is there more danger more often, or does it just seem that way because it is so highly reported?

There is no nice way to say this, so I will give it to you straight. Yes, the danger is growing and growing at an exponential rate. Cyber-attacks, especially financially motivated ones, are increasing in volume, sophistication, and impact.

Everything is digital now. We are quickly moving out of the analog world where we pay with cash and transact in person. I can’t think of a single bill or purchase that requires you to pay with physical money or a check. Everything from mortgage payments to movie tickets is paid online. This rapid increase in digital transactions creates more opportunities for cyber attackers.

Then we must consider advances in technology, which benefit us as consumers, but also benefits the scammers.

Sure, there is some cognitive bias at play. When the media and headlines show a constant stream of cyberattacks and scams, it is to be expected that this adds to our perception of a growing danger.

What are the most common threats in 2025?

The big three attacks that everybody should know about are phishing, ransomware, and credential stuffing.

Phishing is the most experienced type of attack on a day-to-day basis. Phishing, and its many subcategories such as targeting phishing, whaling, smishing, vishing, business email compromise, etc., all fall under the umbrella of social engineering. In this type of attack, the scammer impersonates a trusted party to trick victims into revealing sensitive information such as login credentials, credit card numbers, or other personal data. Usually, this involves playing on the victim’s emotions by creating a false sense of urgency, which causes them to overlook their logic and better judgment and then take action by divulging personal information. This can be done via email, text, call, social media messaging, QR codes, or malicious websites.

A perfect and recent example of this in Maine and surrounding states was the EZ Pass toll scam text. A text was sent to thousands of people saying that they had unpaid tolls and that unless they took immediate action an additional fee would be charged. Of course, this was not true. The attacker played on people’s desire to be law abiding citizens, and a fear of incurring additional charges to get the information they wanted.  

Phishing is often accompanied by ransomware—malicious software that encrypts a victim’s files or systems, demanding a ransom payment to unlock them. Ransomware is generally delivered via a phishing email, manipulating the victim’s emotions to click a link or download the software. While ransomware attacks are more common for businesses, individuals can also be impacted.

Credential stuffing is a little different than phishing and ransomware in that it does not require any action to be taken by the victim. In this type of attack, cyber criminals obtain login credentials from past data breaches, which are easily found on the dark web, and then use them to attempt to gain access to multiple accounts. It is an automated process, requiring little manual work for the fraudster and allowing them to target a wide audience of victims.

How does, or will, AI factor into this world, for the attackers and for the defending public?

I alluded to this earlier, but AI is the next frontier in the technology space and will continue to create areas of increased risk of, and improved protection from, cyberattacks. 

Hackers are now using AI to make their attacks smarter, faster, and harder to spot. They can create super convincing phishing emails or even fake a voice or video call from a trusted party, including family and friends, to trick someone into handing over sensitive info. AI tools also help them scan huge networks to identify weak spots much more efficiently than a human ever could. With AI, even less experienced attackers can launch advanced scams. That’s what makes it so dangerous, the attacks are getting more believable, more targeted, and a lot more frequent.

Luckily, AI is doing a lot of good on the defensive side, too.  It’s like having a super smart security guard that never sleeps. It can spot unusual behavior quickly; like if someone logs into your account from a strange location or suddenly downloads a ton of files. It also helps filter out phishing emails, detect malware before it spreads, and even predict where attacks might happen next by analyzing patterns and past incidents. And AI can respond in real-time, isolating infected devices, blocking suspicious traffic, or locking down accounts automatically before things get worse.

So, while attackers are using AI, so are the defenders. At this point, it is a matter of who uses it better, sooner.

I recently heard you use the phrase, “practice good cyber hygiene”. I love it! What are some of the specifics to that end?

I love it, too! Let’s talk cyber hygiene and how we can improve our own.

Cyber hygiene is the digital equivalent to personal hygiene. It’s the habitual practices and behaviors that we follow to maintain health, prevent infections, and minimize vulnerabilities. The same way we wash our hands to decrease the risk of spreading germs or contracting an illness, there are things we can do in the digital space to decrease our risk or impact of cyberattacks. Cyber hygiene can be boiled down to good password practices, smart cyber use, and responsibly managing devices.

• Check out these password tips from Alysa

Social media platforms are a cesspool for cybercrime. They are an open door to your personal information, and the scammers don’t even have to try hard. People proudly broadcast their personal lives and information. It is so imperative that we are highly selective with what we relay to the world. While reusing passwords is more prevalent with older generations that only needed one password to survive, the younger generation lives almost entirely online and opens themselves up to a more targeted type of attack.

Presenting yourself on social media is the same as presenting yourself to the entire world, scammers included. What you do, where you go, who you talk to, what you like… It can all be used against you. Remember a few minutes ago when I said that phishing, the most common form of attack, is a type of social engineering? This is where the scammers get the ammo.

• For more advice on social media safety, head to Alysa’s Cyber Hygiene Tips

Lastly, responsible physical device use. Boring, but classic and effective.

• Lock your computer when you aren’t using it. Lock your phone when you aren’t using it. Don’t leave your things in public places. Know where your technology is at all times.

I want to emphasize that cyber hygiene is not a one-and-done thing. It is an ongoing practice. Just like washing your face only makes it clean until you sweat or get dirty, cyber hygiene is only as good as its maintenance. The more we live online, the more we need to treat digital decisions as the real-life decisions that they are.

Alysa is my former student and advisee from Waynflete (Class of 2012). I was lucky enough to have taught Alysa several times, including Personal Finance. She attended Southern Maine Community College and earned an associate’s degree in hospitality management and business administration. That is where she discovered a love of accounting. After SMCC, Alysa transferred to Ohio Wesleyan University, where she earned a BA in Accounting with a Business minor. She works from home with her two dogs and in her free time rides her horse, reads, and, of course, investigates recent cyberattacks.

Recently I’ve been running into “top financial mistakes” lists in the form of articles, social media posts, news stories, etc. I imagine this has something to do with my internet browsing and cookies, even though I haven’t been purposefully reading up on that exact topic. Maybe the www is trying to tell me something.

Whether it’s that or just a financially reflective time of year, it got me thinking about my own money mistakes… And then categorizing them by things like avoidable, should have known better, didn’t know better, darn capitalism, etc.

Since this is a just a blog post, I tried to narrow it down to my greatest hits, not necessarily in $$ terms, but also in terms of the impact on my future decisions and my financial journey in general.

The Classic: signing up for the CC on the CC  (credit card on the college campus).

I was barely 18 when I stepped into the student center to get a slice and a coke, but instead found a table with smiling people handing out applications for a Sears Card – along with its $250 limit, 24% interest rate, and a free t-shirt! How could I resist? I should be grateful for this bit of history because this is THE moment when my financial train went rogue, and without it I wouldn’t know the experience of having gotten back on track. Until this moment I was still more of the paper boy, wise with my pennies, turning them into dollars. But very soon after getting my t-shirt and filling out the application I had my card, my first credit card. I quickly maxed it out on whatever an 18 year old could buy at Sears in the mid-80s, got used to the comfort of minimum payments, and as Senator Elizabeth Warren described in the documentary Maxed Out, I “developed a taste for credit.”

My parents couldn’t have prepared me because they didn’t know (no one from previous generations knew) that credit cards were being handed out to us 18-year-olds. It was a relatively new thing at the time. Maybe something in my brain should have realized that getting stuff without paying for it up front was probably not good, but again, I was 18.  It’s interesting to note that the CARD Act of 2010 made it illegal for credit cards to be “sold” on college campuses.

The Verdict: I didn’t know better

The Follow-up Flub: getting store credit cards even though I already had a Visa.

After a few years of practice with my Sears card, I graduated to my first real credit card, a nice Visa with a Miami Dolphins logo. The biggest mystery today is wondering how I was ever a Miami Dolphins fan. I could use that card anywhere, and it wasn’t (always) maxed out, so why did I have to get cards from Macy’s, Eddie Bauer, etc.? Oh, this one is pretty much on me. By that time, I had some idea of the impact of paying interest, but I was a consumer peacock, flashing those cards in place of feathers. I bought stuff, and I enjoyed doing so with specific cards for various stores and their 24% interest rates.

The Verdict: should have known better and darn capitalism

U-Haul, You Learn: this one still annoys me.

I was moving from a studio apartment in Connecticut to a one-bedroom in Tennessee, and I decided to rent a small U-Haul truck for the job. The truck wasn’t the only small thing involved as it cost a small fortune for this rental. Where do I begin with how foolish a (financial) move this was? It was 30 years ago, and I am still stinging from the nearly $1,500 I spent including gas. Why was it silly? My belongings at that time were probably worth $500 at most, keepsakes could have fit easily into my Subaru wagon, and I’m sure I could have replaced that crappy desk lamp for a few bucks at Goodwill. I remember clearly that I simply did not analyze the cost or the alternatives. I was single-minded and focused on the move and lost the good sense that had recently led me to stop buying new cars (and to getting the old Subaru which, ironically was a really well spent $1,500). The U-Haul $1,500 was a ton of money for me at that time – too much money to spend so frivolously. How did I do it? Yep, Miami Dolphins Visa.

The Verdict: avoidable, I absolutely should have known better

The One Mistake to Rule All Others: not understanding opportunity cost (a top argument for requiring personal financial education in school).

I can add plenty more mistakes of various financial impact to this list (see this post about cars), and they all matter in some way. But what matters more is what ties them all together – opportunity cost.

My credit card adventures cost me hundreds in interest and thousands in overspending. Buying cars that were out of my reach but nevertheless came to me thanks to creative financing cost me thousands. Unnecessary U-Hauling cost $1,500 for one trip.

So what?

Stage one of “so what” was when I came to grips with the amount of money I recklessly spent over the years, and that was an important stage loaded with critical realizations.

Stage two, however, is where my increasing financial literacy made me begin to connect with not only what I spent, but also, and more importantly, what I could have done with that money.

Stage three, let’s say current day, is when I look at my expected retirement age and lifestyle and realize the impact of those decisions on today’s choices.

stage one + stage two + stage three = understanding opportunity cost.

Yes, that concept which in my first college economics course seemed so boring when presented in the mechanical terms of production possibilities curves, but when applied to personal finance is not boring and drives home the consequences of living beyond our means.

Decades of experience teaching OC in elective courses and clubs tells me that it does sink in, students get it, and it makes a difference.

The Verdict: I really didn’t know better. It’s not natural for humans to think about our future self, especially at 20 years old.

———-

So, come on Maine, how about we take this tool which covers choice, consequence, future self, and financial wellness, and cement it into our school curriculums. I don’t know that it would have protected me 100% from unfortunate financial choices, but even a fraction of that protection would have gone a long way.

If you’ve made or are making these mistakes, no judgement here, just a chance to reflect and/or chart a new course. Despite the costs involved, I can’t say that I regret these decisions as they led to changes and led to me wanting to share and hopefully help others on their financial journey.

Teaching is Sharing and Sharing is Teaching

In the 20 or years that I have taught and talked personal finance, I have found no better tool than sharing my mistakes with students. Is it impactful when a successful or wealthy person shares their tips? Yes. But experience has shown me that it’s even more impactful to talk about what went wrong, what was learned, and what was lost. (I’ve been told that) It feels more like teaching, rather than preaching.

Stories are emotional, emotion prints memory, and those memories can have a profound effect on our students.