Cybersecurity Awareness

Finish Cybersecurity Awareness Month Strong: Protect Your Benefits Logins

Posted on by Miasha Wilson

Open enrollment draws many of us to health and financial benefits portals—and that makes October a prime time for phishers and account-takeover attempts. A few evidence-based habits can significantly reduce risk.

Go direct; don’t click through emails.

When you receive a benefits message, open a new tab and type the portal URL or use a saved bookmark. Before signing in, confirm you see https:// and the padlock, which indicates an encrypted connection. This simple step sidesteps look-alike phishing pages and protects credentials in transit (CISA, 2025; FTC, n.d.).

Turn on multi-factor authentication (MFA).

MFA adds a second proof of identity (e.g., an app code or security key) so a stolen password alone cannot unlock your account. Federal guidance consistently recommends enabling MFA on email, benefits, and financial portals; where available, prefer phishing-resistant methods (e.g., FIDO security keys or passkeys) (CISA, 2025; HHS OCR, 2023).

Use long, unique passwords (or passphrases) and a password manager.

Reused or short passwords let one breach cascade into others. NIST’s digital identity guidelines emphasize allowing users to create long passphrases and encourage the use of password managers to maintain uniqueness across accounts (Grassi et al., 2020).

Avoid sensitive logins on public Wi-Fi.

Café or airport networks can expose traffic to eavesdropping. If you must connect, use a personal hotspot or trusted VPN, and always verify the lock icon/https before entering credentials (FTC, n.d.).

Keep software current.

Updates patch known vulnerabilities actively exploited by attackers. Make it a habit to update your device and browser before visiting benefits sites; automatic updates reduce the chance you’ll forget (CISA, 2025).

Slow down on “urgent” messages.

Phishing often uses urgency (“Your benefits were suspended—click now”). Red flags include generic greetings, mismatched sender addresses, or unexpected attachments. When in doubt, don’t click; report to IT and visit the site directly via a known URL (CISA, 2025; HHS OCR, 2024).

Treat health portals like online banking.

HIPAA security guidance highlights MFA, secure remote access, and ongoing risk analysis to protect electronic protected health information (ePHI). Even outside HIPAA-covered settings, applying these safeguards to your insurer, HSA/FSA, and retirement portals is prudent (HHS OCR, 2023; HHS, 2024).

If something looks off:

  1. Stop before entering your password.
  2. Screenshot and forward to Help.Desk@kzoo.edu.
  3. For benefits-account concerns, contact HR.Benefits@kzoo.edu and/or the vendor using a verified phone number or URL.

As Cybersecurity Awareness Month wraps up, make your benefits logins the safest places you visit online: go direct, use MFA, favor long unique passphrases, avoid risky networks, keep software updated, and report suspicious messages. These habits take seconds—and can prevent hours of recovery later.

References