“firms check for clients’ difficulty navigating security protocols or need for frequent password resets. In such cases, a designated family member might be informed.”