So, a friend just had an Interac transfer stolen from their eMail account. Not a lot of money, and police are involved, but a pain in the ass nonetheless.

1) Make your security question something that cannot be easily guessed or looked up. In fact, make it impossible... make the question "What is the password?"

2) Deliver the password via a DIFFERENT communications method -- if you sent the transfer via eMail, use Signal, RCS, iMessage, etc.

3) Secure your eMail address with 2FA.