Meet the Frankenstein Fraudster

October is Cybersecurity Awareness Month, and at PC Solutions we’re spending it with the Cyber Monsters, the threats that could haunt your business. This week, meet the Frankenstein Fraudster.

He doesn’t break down your front door. He builds his way in, one stolen piece at a time: a pet’s name from Facebook, a birthday from LinkedIn, a password someone reused from a shopping site that was breached years ago. Stitch enough of those pieces together and he has a working key to your email, your bank, or your business systems.

He doesn’t even have to do the work by hand. In its 2026 Cybersecurity Awareness Month campaign, the National Cybersecurity Alliance told the story of a hacker known as “dpxaker,” who sold password-cracking software to other criminals for just $250. Tools like his test thousands of password guesses every second.

The good news is that the Frankenstein Fraudster has a weakness. Long, unique, random passwords take far too much work to crack. Here’s how to make yours one of them.

The problem: passwords are still the easiest way in

Ask yourself a few honest questions:

• If one of your passwords leaked today, how many other accounts would it open?
• How many people on your team use the same password at work and at home?
• If someone logged in with a real employee’s username and password, would anything stop them?

If those questions make you uneasy, you’re not alone. The 2026 Verizon Data Breach Investigations Report found that credential abuse shows up at some point in 39% of breaches. In its small and mid-sized business analysis, the report found that compromised credentials were behind 38% of the opportunistic attacks it reviewed.

The Frankenstein Fraudster doesn’t need to be clever. He just needs one reused or guessable password.

The usual alternatives (and why they don’t hold up)

The National Cybersecurity Alliance estimates the average person has more than 100 online accounts. Nobody can remember 100 strong passwords, so most of us take shortcuts:

• One “good” password everywhere. It feels safe until one site is breached and every account falls with it.
• Clever substitutions. Swapping letters for symbols, like “P@ssw0rd!”, fools people more than it fools cracking software.
• Adding a number when it’s time to change. Spring2025! becomes Spring2026!, and attackers know the pattern.
• Sticky notes and spreadsheets. Easy to use, and just as easy for someone else to find.
• Letting the browser remember everything. It’s convenient, but a business gets no visibility or control, and no clean way to cut off access when someone leaves.

None of these are reckless. They’re what happens when people are handed too many logins and no system to manage them.

The solution: how to create strong passwords (and remember them)

1. Follow the three rules

The National Cybersecurity Alliance recommends that every password be:

• Long: at least 16 characters. NCA notes that short passwords can be cracked in hours or days, while a long, random one would take far longer than any attacker has.
• Unique: a different password for every account, so one breach can’t unlock the rest.
• Random: a random mix of letters, numbers, and symbols. Randomness beats cleverness every time.

2. Let a password manager do the remembering

A password manager is an encrypted vault for your passwords. It can generate long, random passwords for you, fill them in on websites and apps, and leave you with only one master password to remember. Many are free or low cost. Make that master password strong, and turn on MFA for the password manager itself.

3. Turn on multi-factor authentication (MFA)

MFA adds a second step when you log in, such as an app-generated code, a text message code, a fingerprint, or a face scan. Even if the Frankenstein Fraudster gets your password, he still can’t get in. Start with your email, financial, and work accounts.

4. Stop changing passwords for no reason

Current guidance, including NIST’s, is to change a password when there’s a reason to: a data breach notice, or a sign that someone else has accessed your account. Forced changes on a schedule tend to produce weaker passwords, like Spring2026!.

5. Look into passkeys

Passkeys let you sign in with a trusted device and your fingerprint or face instead of a password. They’re convenient and resistant to phishing. Not every account supports them yet, but many password managers can store them alongside your passwords.

How PC Solutions helps

Good habits matter, but a business can’t count on every employee getting every password right on their own. That’s where a company-wide approach comes in.

PC Solutions helps businesses across California’s Central Valley keep the Frankenstein Fraudster out by:

• Rolling out a business password manager for the whole team
• Turning on MFA across email, cloud apps, and remote access
• Writing password policies that follow current guidance
• Training staff to spot the shortcuts attackers count on

Not sure where your business stands? Call us at (559) 825-3200 or visit gopcsolutions.com to schedule a password and MFA review.

Next week: another Cyber Monster crawls out of the shadows. Check back on the PC Solutions blog.

Sources

• How to Create Strong Passwords (and Remember Them!), National Cybersecurity Alliance
• National Cybersecurity Alliance, Cybersecurity Awareness Month 2026 Week 1 email (dpxaker story)
• 2026 Verizon Data Breach Investigations Report (credential abuse 39%; SMB compromised credentials 38%)