When I checked my account this morning about $900,000 was missing. It appears that an outgoing transfer to another brokerage firm was underway. I immediately told them I did not authorize this. The Vanguard Customer Service tech tells me that these brokerage firm to brokerage firm asset transfers are all done electronically without human intervention. I said, “Wait a minute, your telling me that someone can fill out a form with Merrill Lynch and transfer millions of dollars out of my account without Vanguard warning me what’s happening?” The Customer Service tech said that was how it worked. It’s the industry standard.
I’m astonished at this. The Vanguard Tech couldn’t transfer me to someone who could explain what was happening. Nor could he tell me when someone from the fraud department would contact me.
Vanguard’s customer service has really gone down hill.
I left Vanguard three years ago, with regret about what they have lost but happiness to say good-bye as it had become clear to me that their main aim was to get in on the skim game big time that they for so long described and provided good avenues to avoid.
I am now at Schwab, but it too is becoming ever more about rackets.
I just got off the phone with the Vanguard fraud investigator. The asset transfer was to a Denver brokerage firm which I had reported as a fraud on Monday and they (the Denver firm) locked the fraudulent account. The Vanguard fraud guy says the money is still in the Denver firm account but it could take 2 or 3 weeks to have the assets returned to Vanguard.
The Vanguard fraud guy told me to do a virus scan on my computer and I’ll call him back tomorrow to restore access to my Vanguard accounts – everything is obviously currently locked down with my Vanguard accounts.
So there are numerous concerns here. From my understanding of your summary,
you have an account we’ll call D served by an institution in Denver or someone added account D as a destination for transfers in your Vanguard account
you have an account we’ll call V at Vanguard
both accounts support online trading and both support inbound and outbound transfers (common function expected of most providers)
you had already seen another sign of fraud with the D account and notified the institution of that likely fraud on Monday
today, 3 days later, you see signs that $900,000 had been pulled OUT of the V account and the destination was the D account but you didn’t authorize that transfer as a push from V or pull into D
So what did the institution for D do in response to your Monday fraud notification? What was the nature of the suspected fraud you saw on the D account? An attempt to change a contact cell phone or contact email? An actual financial transaction? Did you ask the institution for D to lock the account until they completed their investigation into how access to it was compromised? Did they acknowledge your request but not actually lock the account? Or are they claiming their lock process takes 2-3 days to complete and they didn’t get it done before this transfer was attempted?
Normally, an account lock should be IMMEDIATE. Support systems in front of agents should test for that fraud lock status and immediately notify any agent who searches for your account in response to an incoming call for “support” to do NOTHING to the account and notify the fraud department of the inbound call attempting to reference that locked account, which becomes part of the evidence trail used by their investigators.
For various historical reasons, my main brokerage funds are split between Fidelity, Merrill/BOA and Schwab. Based on this tale, I wonder if there is a way to lock all of them down. This should be a feature exposed to customers to apply such locks to accounts and require a lengthy interaction with a human to disable them. And all institutions should use some form of two-factor authentication not only to validate all transfers but also to validate any change in contact email or contact cellphone that might be used in a 2FA flow for a transfer. At a minimum, they could require any transfer to involve a previously configured target institution and put a 24 hour waiting period with a notification flow to collect approval to add a routing number to the list of known / allowed institutions.
With one’s life savings at stake, I’d prefer having less flexibility for moving six-figure sums around than finding a six-figure sum is MISSING from my account because the bank wanted to make transfers “easy.”
Is it the industry standard? I have money with Vanguard and another brokerage firm that I don’t like because of reported scandals and annoying fees. I am not sure I trust any of them.
No. That was my complaint. Apparently anyone can fill out a form to transfer assets out of your Vanguard account and it happens immediately without Vanguard contacting you to ask if you authorized this.
The $900,000 is now sitting in that Denver brokerage firm. I was just lucky that I got letter on Monday from the Denver firm with a pin number for accessing a new account and I immediately called them to report it as a fraud. It took 3 calls over 2 days to get the Denver firm to lock down the new brokerage account I DIDN’T OPEN.
I also got a letter saying that an account at Merrill Lynch had been opened in my name and called Merrill to shut that down.
I was just lucky that I’m at home and attentive to opening the mail. The $900,000 would be gone if I was on vacation for a week. This is clearly a gap in the brokerage firm system fraud protection.
The fact that the account with the Denver firm had been opened. I am not a customer of the Denver firm and have no financial relationship with them.
And that’s my complaint. Anyone can apparently open up a fraudulent account with a brokerage firm and request that millions of dollars be transferred from your Vanguard account and Vanguard doesn’t contact you before making the transfer to see if it’s legit.
And note, I’m not typically making $900,000 funds requests in my Vanguard accounts, this is way out of the ordinary.
The whole thing doesn’t make sense. When I do that kind of transfer, they will only do it if both accounts are titled the same way - same names, same ss number.
Fidelity accounts are able to be locked down for money transfers without affecting trading at all. They are also able to be unlocked once in the account, which requires two factor authentication. Once money transfer is enabled, an email is sent within seconds. I don’t know if you can set it up to text as well.
That’s all I got.
A few random observations / suggestions for everyone.
If you absolutely do not anticipate needing a new account or loan or credit card, get accounts created with all three credit bureaus then configure ALL of them to lock your credit report and lock the ability to open new accounts. If you suddenly want to open a new CD at a new bank, this is a PITA but a simple aggrevation, not a problem that will take you weeks to undo. Most allow you to “unfreeze” your credit report for a fixed number of days so you can lock it by default, then open it up for (say) 3 days if you realize you need to open a new account or get a car loan, etc. while having it automatically re-lock. I had to do this a few months back to fund a CD at a standalone bank with money from Merrill.
Many banks are now performing transfers by exercising one or two small test transactions for $1 or $3 over a couple of days before executing the full transaction. These act as a sanity test for both the source and destination account of the transfer to give their owners a chance to read any warnings sent out by the transfer and call the bank before the big dollars are moved.
This means you need to validate the contact notification method(s) you have on file with each account and pay attention anytime you get a notification email about ANY transfer. And even this is problematic because fraudsters know banks do this and craft phishing emails under this premise to attempt to steal your credentials to then compromise your accounts to actually set up a transfer.
If you get an email or verfication text / call from a bank you think is suspect, don’t respond “in channel” to the email or text. If you HAVE an account at that institution, look up their fraud hotline number separately online and call them and notify them of the attempt.
If you get a phishing email for Joe Blow Bank & Trust and you don’t have an account there, you should still scan the notification to see if it references a bank you DO have an account with and if so, do the same thing… Don’t respond to the email, don’t click on a link in the email or text message. Call that institution directly and report it.
I am going to check all three of my brokers to see if they have a feature to “freeze” their transfer tool or at least limit sources / destinations to previously configured accounts in my transfer list while freezing the ability to edit that list.
As breeches seem to be routine these days, I have my credit report locked at all three bureaus. That is supposed to prevent any sort of account being opened.
I have a fraud alert and credit freeze with all 3 credit bureaus. But does that cover opening a bank account or brokerage account? When I reported this to the identity theft detective at the local police department she said an alert with a credit card credit bureau doesn’t necessarily prevent someone from opening a brokerage account in your name.
This. A brokerage or bank account is not the same as a credit card or other debt-type account. This is apparently a new trick utilizing a little known loophole. Open a brokerage or bank account? that doesn’t “obligate” anybody or get anybody on some hook to pay something. How can that be bad? Well, if they use it to, in effect, launder the money you don’t get charged anything, you don’t have to pay for anything, but they still managed to get your money.
When I reported this to the identity theft detective at the local police department she said an alert with a credit card credit bureau doesn’t necessarily prevent someone from opening a brokerage account in your name.
In my recent case, I attempted to open an account online at Bank C and spent 10 minutes going through the process and got a confirmation email at the end saying account registration was complete and that the status was “pending verification-manual” or something like that. I expected that to last for a few hours.
The next day, it was still “pending verification-manual”. Same thing the next day. I finally called their 800# and the first question asked was “do you have a credit freeze on your accounts?” Yup. Went back online to all three (Equifax, Transunion, Experion) and set up an “un-freeze” for 3 days, then went back and re-submitted the account application online starting from scratch and that cleared within a day. So in this case involving essentially a deposit account, the freeze process did prevent a new account from being opened.
As FCorelli has mentioned up-thread, it could be there is some legal semantic distinction between a brokerage account and a deposit account predicated on the assumption that merely creating a brokerage account isn’t posing a fraud risk until you get to the point of FUNDING the brokerage account. But if that brokerage has security flaws in their account transfer protections and verfications, then these credit freeze functions at the bureaus are worthless cuz now you have a low-friction account creation gap that chains you to a flawed funds transfer process that circumvents “protections” the bureaus claim to provide.
Yes. With Vanguard, a nefarious actor can fund his new brokerage account with a brokerage firm to brokerage firm asset transfer from a Vanguard account, and Vanguard will not check with the account holder up-front to see if the transfer is legit.
