As we learned recently, the Automated Customer Account Transfer Service (ACATS) that is used to transfer assets between brokerages can be a potential avenue for fraud, where criminals can drain the assets out of your account without your permission.
Fidelity already offers ACATS blocking, and Vanguard now does as well. Here’s how to do it (AI generated)
Via the Vanguard App:
Tap on your Profile.Go to Settings → Security profile.
Select Fraud prevention tools.
Choose Lock your account and toggle the setting.
Via the Vanguard Website:
Log in at Vanguard and click Profile in the top-right corner.
Select Security Profile.
Scroll down to the Outgoing transfer lock section and click Manage.
Select the specific accounts you want to lock and save your changes
I’d been checking my Vanguard account twice a day since that $900,000 disappeared from it in an ACATS transfer theft 2 years ago. The scoundrels got my account number from the big Turbo Tax breech.
Please tell us more of the story, intercst. They transfered shares from your brokerage account w/o your permission. Did they do this w/o hacking your password?
How did you find out? Did you get your stuff returned? Did Vanguard help? Police etc?
Yes, Vanguard cyber security experts checked my computer, I had no security breech on my end. I reported the problem quickly enough so that the brokerage account used by thieves at a Denver firm got locked down before my money was withdrawn. My Vanguard account was locked up for about 2 weeks while they investigated if I was in cahoots with the criminals, but all the funds were returned and dividends accurately credited. I made a police report, but everything got resolved before the detective contacted me. This was the first the local police dept had heard of an ACATs transfer theft.
You need my login, password, and account number to do an ACATs transfer. The thieves probably got the account number through the Turbo Tax security breech. When I file my return I download everything from Vanguard to Turbo Tax, which includes individual acct numbers.
@intercst thanks to your warning I locked down all my Fidelity accounts. I also got Google Authenticator which links to my Fidelity log in with a code that changes every 30 seconds.
How does doing this impact your ability to withdraw your own funds into your checking account, for example? And if ACATS required your login credentials anyway, can’t they simply undo this action?