4. The risk that the problem is you

Risk 7: The risk that is not in the prices

There remains the risk that carries no premium, no counterparty, no historical series and no way of being paid for taking it: operational risk. Nobody pays you for managing your logins badly, for typing an order with one zero too many or for not knowing what you own. It is pure risk, with no expected compensation, and that is why it is the only one in the whole course worth reducing to zero as far as you possibly can. It is also the most uncomfortable module, because here the counterparty is you.

Access: the single point of failure is you

The real security chain of a portfolio does not begin with your broker password. It begins with your email, which is where every other credential gets recovered. Whoever controls that email controls the securities account, however long the password.

The second weak link is the phone number. Two-step verification by text message depends on a SIM card a third party can clone by talking a mobile operator into it, a fraud with a name of its own and common enough that serious firms have stopped recommending it. An authenticator app or a physical key removes that route.

And the third, the most forgotten of all: the recovery codes. They exist precisely for the day you lose your phone, and hardly anybody remembers where they put them. If you cannot say right now where yours are, you do not have them.

The finger: mistyping an order

In December 2005, a trader at Mizuho Securities meant to sell one share in the company J-Com at 610,000 yen and typed the opposite: 610,000 shares at one yen. The order was absurd, the system accepted it, the Tokyo exchange did not allow it to be canceled quickly enough and the loss was estimated in the tens of billions of yen, hundreds of millions of dollars. It was not an error of judgment: it was a slip of the finger at a professional house with controls in place.

The private investor has the same surface area for failure and fewer safety nets:

• Confusing the quantity box with the amount box. Wanting to invest 3,000 euros in a stock trading at 30 euros and typing 3,000 in the quantity box comes to 90,000 euros, thirty times what was intended.
• Market orders in thinly traded stocks. This links back to the first module: an order with no limit in a narrow stock sweeps the spread and fills at prices nobody would have accepted.
• Similar tickers. Two nearly identical products with a different currency, a different domicile or different treatment of dividends.
• The wrong market. The same stock listed on two venues, with liquidity and costs that bear no resemblance to each other.

The defense is not sophisticated: limit orders by default, checking the total amount before confirming, and mistrusting yourself outside your usual hours or when in a hurry.

Nobody knows what you own, starting with you

Here is where drift appears: the distance between the portfolio you think you have and the one you have. It forms on its own, without any specific mistake. Three funds that turn out to track the same index. A hedge that expired two years ago and that you are still counting. A pension plan from a previous job. Cash piled up in a currency you never chose. A product that changed its investment policy and told you by letter.

There is also a concrete and little-known ending for forgotten accounts. In Spain, balances and securities deposited at financial institutions that go twenty years without any movement or claim are deemed abandoned and pass to the General State Administration. It is not a legend: it is in the public administrations' assets act, and institutions are obliged to report it.

What happens if tomorrow you cannot manage your portfolio

A will divides up assets, but it does not say where they are. If your heirs do not know an account exists at a foreign broker, that account does not turn up. If your logins are in a password manager whose master key only you know, nobody gets in. If you hold crypto-assets in self-custody, the loss is not likely: it is certain.

Temporary incapacity is treated even worse, because inheritance does not solve it. In Spain, an enduring power of attorney granted before a notary allows someone you trust to act if you cannot, and it costs practically nothing against what it prevents.

Checklist

• A written inventory of every account, institution and product, with approximate amounts and the date it was last reviewed.
• Email with a unique password, two-step verification that does not depend on text messages and a recovery address you control.
• Recovery codes for each institution, kept in a physical place you can name.
• Limit orders by default and a check of the total amount before confirming any trade.
• An annual review of hedges still in force, overlaps between funds, currencies and idle cash.
• Dormant accounts: move something or close them, never leave them still for years.
• Instructions for other people: where the inventory is and how to get in, with an enduring power of attorney and an up-to-date will.
• One person who knows all of this exists.

A real case: lost keys

Stefan Thomas, a programmer, kept 7,002 bitcoins on an encrypted drive and lost the password. The device allows ten attempts before wiping the contents irreversibly; he has been down to two for years. Nobody has stolen anything from him: the balance is there for anyone to see on the blockchain and it is inaccessible for ever. At the valuations of recent years, the figure has swung between several hundred million dollars.

It is not a rare case. Industry analyses estimate that of the order of a fifth of all bitcoins ever issued sit at addresses whose keys have been lost. And the mechanism is not exclusive to crypto-assets: it is the same one that leaves securities accounts unclaimed for twenty years until they pass to the State. In none of these cases was there an adverse market, an insolvent issuer or an intermediary in administration. Only an investor who did not write down what he had and how to get to it.

All of this material is education, not financial advice. Nothing above is a recommendation about specific products, institutions or structures, nor does it replace the tax or legal advice your own situation may require.