I've worked with information security departments in many companies and watch how these things happen.
Social engineering is the most vulnerable. Mostly an email that looks legit in every way, and people respond.
The best way to avoid email scams and fake login links is to hover over the senders email (or right click). This usually is where they get caught and validates the email is a scam. The email address is nothing like the company sending the email.
Credit cards are always better than debit cards or paper checks. This is a direct pipeline into your account and with some banks, difficult to get your money back, plus the hassle of redoing your accounts. Having the routing code and account information gives the 'hacker' the ability to go to any check company site and create a batch of new checks with your info on them and they can just start writing checks, so its important to shut down the account as soon as possible.
Smarter check hacks would look at the routing code and you can tell which federal reserve the check must clear to get to your bank account.
What they do is, if your on the east coast of the US they will alter the routing code to a federal reserve on the west coast. By the time the 'mix up' is found, its been 5,6,7 days before the fraud is found and show up in your bank. Some banks put a hold on the check while its in-process, but sometimes, depending on the applications used, could automatically approve the check once it passes a few days and doesn't show up on the fraud list.
I use credit card for everything I can. Lately, companies are stopping credit card payments for reoccurring bills and require a debit card. 1) there is exposure to you, and 2) any reward points you would have gotten with the credit card is gone.
A way to set yourself for less exposure is to keep most of your funds in a savings account and only put a small amount into the debit card connected account, and make sure your passwords are different for each account.
Password hackers will usually try to hack small passwords (3,4,5 characters), if they see passwords that are 10,12,15 characters, they tend to pass on trying to hack those. Keep that in mind when setting up a password. Using a mix of numbers, letters, caps, signs such as (@&*) also help.