ACATS security risks?

Have a question about your personal investments? No matter how simple or complex, you can ask it here.
Post Reply
User avatar
Topic Author
Orangutan
Posts: 309
Joined: Mon Feb 08, 2021 3:36 pm
Location: NYC

ACATS security risks?

Post by Orangutan »

Hello all,

I have recently begun the process of moving some funds over to another brokerage in order to take advantage of a bonus. I have been a bit surprised by the simplicity of the process. All I did was open the new brokerage account (5 min) and submit a transfer form (30 sec) which asked for the account name, number, and ticker symbols.

This seems to be the standard, and has been for ages, but are there not obvious security risks with this? I imagine if someone has my SSN, they could open a new brokerage account under my name. All else that would be required is an old brokerage statement laying around or in a folder on my computer. This would allow someone to transfer the entirety of the assets held at the prior brokerage.

I know next to nothing about cybersecurity, so I apologize in advance if this is not the brightest question.

Thank you!
User avatar
NewMoneyMustBeSmart
Posts: 729
Joined: Sat Jun 01, 2019 10:28 pm
Location: Midwest

Re: ACATS security risks?

Post by NewMoneyMustBeSmart »

Orangutan wrote: Tue Jul 20, 2021 7:19 pm This seems to be the standard, and has been for ages, but are there not obvious security risks with this?
Yes. Most of the world operates on trust. There are also security risks with ACH and checks, similar to this.

In theory, this is not "cyber security" - this is bank fraud. Banks have algorithms to defend against it. And they sorta take on the risk of the consequences, although they'll often stick one with the consequences if obe did anything contributory or if one allows them to do so.

Which reminds me, it's bank fraud, not identify theft. Banks have worked to change that narrative to pretend like it's not there fault.

Caveat emptor. But I've done dozens of ACATS/DTC in the past with no issue. It's good to have more security on your account so that when the bank verifies it more is needed.

As far Joe Schmoe opening an account as you and ACH all your loot; I am pretty sure that would be on the bank that improperly opened the account, but it'd be a mess for sure.

Also - doors are a security risk :-)
-- | Few are those who see with their own eyes and feel with their own hearts - Einstein | *Everything I write here is an unreliable opinion*
MrJedi
Posts: 3540
Joined: Wed May 06, 2020 11:42 am

Re: ACATS security risks?

Post by MrJedi »

Many brokers offer guarantees against any losses from unauthorized/fraudulent activity. Here's the Fidelity version for example: https://www.fidelity.com/security/custo ... -guarantee

How it works in practice, I am not sure.
nalor511
Posts: 5058
Joined: Mon Jul 27, 2015 1:00 am

Re: ACATS security risks?

Post by nalor511 »

Orangutan wrote: Tue Jul 20, 2021 7:19 pm Hello all,

I have recently begun the process of moving some funds over to another brokerage in order to take advantage of a bonus. I have been a bit surprised by the simplicity of the process. All I did was open the new brokerage account (5 min) and submit a transfer form (30 sec) which asked for the account name, number, and ticker symbols.

This seems to be the standard, and has been for ages, but are there not obvious security risks with this? I imagine if someone has my SSN, they could open a new brokerage account under my name. All else that would be required is an old brokerage statement laying around or in a folder on my computer. This would allow someone to transfer the entirety of the assets held at the prior brokerage.

I know next to nothing about cybersecurity, so I apologize in advance if this is not the brightest question.

Thank you!
Do you have your credit frozen? Then they cannot open you a Brokerage account.

The name/SSN/etc on both ends must match exactly for ACATs to succeed.

They also would need to get the money out somehow. And you would have needed to not notice the missing money and whatever alerts that generated.
Iridium
Posts: 768
Joined: Thu May 19, 2016 10:49 am

Re: ACATS security risks?

Post by Iridium »

Orangutan wrote: Tue Jul 20, 2021 7:19 pm This would allow someone to transfer the entirety of the assets held at the prior brokerage.
They can move the assets to a new brokerage account IN YOUR NAME. If they want to switch the name on the account, that requires a Medallion signature.

The higher risk seems to be that after the shares are turned into cash, the various mechanisms for transferring cash around don't seem to verify the ownership of the account receiving the funds. However, that is a problem somewhat different from ACATS itself. Generally, that seems to be resolved through a combination of reversibility, money holds, transfer limits, and verification of who is actually opening accounts.
02nz
Posts: 10508
Joined: Wed Feb 21, 2018 2:17 pm

Re: ACATS security risks?

Post by 02nz »

The scenario is unlikely but definitely not impossible. Another reason why "never look at your portfolio" is terrible advice. I have my accounts sync'd up to Mint, any transaction shows up within hours or at most one day.
Oregano
Posts: 365
Joined: Fri Nov 22, 2019 8:30 pm

Re: ACATS security risks?

Post by Oregano »

nalor511 wrote: Tue Jul 20, 2021 8:00 pm Do you have your credit frozen? Then they cannot open you a Brokerage account.
That's not true. Brokerage accounts can be opened with no consideration whatsoever of a credit freeze.
User avatar
burritoLover
Posts: 4097
Joined: Sun Jul 05, 2020 12:13 pm

Re: ACATS security risks?

Post by burritoLover »

It was pretty scary transferring stuff out of Vanguard to another brokerage. Absolutely no communication from Vanguard - no email, no text, no nothing - just gone one day and they even closed the brokerage account (despite having an IRA as well).
nalor511
Posts: 5058
Joined: Mon Jul 27, 2015 1:00 am

Re: ACATS security risks?

Post by nalor511 »

Oregano wrote: Fri Jul 23, 2021 12:26 pm
nalor511 wrote: Tue Jul 20, 2021 8:00 pm Do you have your credit frozen? Then they cannot open you a Brokerage account.
That's not true. Brokerage accounts can be opened with no consideration whatsoever of a credit freeze.
That's not true. If the OP has an account somewhere already, and the thief can get into that login, sure they can open a new account there. Presumably the OP would receive some notification of this.

If the thief wants to open a new account at a NEW brokerage, such that the OP receives no notification because they've never done business with this brokerage, then yes there will need to be a soft pull.
nrkv
Posts: 247
Joined: Thu Jan 21, 2021 1:34 pm

Re: ACATS security risks?

Post by nrkv »

burritoLover wrote: Fri Jul 23, 2021 12:59 pm It was pretty scary transferring stuff out of Vanguard to another brokerage. Absolutely no communication from Vanguard - no email, no text, no nothing - just gone one day and they even closed the brokerage account (despite having an IRA as well).
I got an email similar to trade confirmation from vanguard after the funds are moved.
User avatar
burritoLover
Posts: 4097
Joined: Sun Jul 05, 2020 12:13 pm

Re: ACATS security risks?

Post by burritoLover »

nrkv wrote: Fri Jul 23, 2021 2:26 pm
burritoLover wrote: Fri Jul 23, 2021 12:59 pm It was pretty scary transferring stuff out of Vanguard to another brokerage. Absolutely no communication from Vanguard - no email, no text, no nothing - just gone one day and they even closed the brokerage account (despite having an IRA as well).
I got an email similar to trade confirmation from vanguard after the funds are moved.
Yeah, that is what I was expecting as I've traded individual stocks previously with Vanguard and would receive an email and text alerts but no such luck here.
nalor511
Posts: 5058
Joined: Mon Jul 27, 2015 1:00 am

Re: ACATS security risks?

Post by nalor511 »

burritoLover wrote: Fri Jul 23, 2021 2:42 pm
nrkv wrote: Fri Jul 23, 2021 2:26 pm
burritoLover wrote: Fri Jul 23, 2021 12:59 pm It was pretty scary transferring stuff out of Vanguard to another brokerage. Absolutely no communication from Vanguard - no email, no text, no nothing - just gone one day and they even closed the brokerage account (despite having an IRA as well).
I got an email similar to trade confirmation from vanguard after the funds are moved.
Yeah, that is what I was expecting as I've traded individual stocks previously with Vanguard and would receive an email and text alerts but no such luck here.
I can confirm that transferred securities out of vanguard do not generate an email nor a secure email for some subset of customers (myself included). Sketchy, I expected *some* notification.

Receiving brokerage notified me very clearly on the transfer progression though.
Luckywon
Posts: 2406
Joined: Tue Mar 28, 2017 10:33 am

Re: ACATS security risks?

Post by Luckywon »

Fidelity has a feature called "account lockdown" and E-Trade has a feature called "no funds out". These provide some security against unauthorized ACAT transfers. The process of toggling on and off the features at Fidelity is online with two-factor identification, and at E-Trade a phone call is required.
Luckywon
Posts: 2406
Joined: Tue Mar 28, 2017 10:33 am

Re: ACATS security risks?

Post by Luckywon »

nalor511 wrote: Fri Jul 23, 2021 2:14 pm
If the thief wants to open a new account at a NEW brokerage, such that the OP receives no notification because they've never done business with this brokerage, then yes there will need to be a soft pull.
When I opened up accounts at Ameritrade and Etrade, which were brand new to me, there was no requirement for me to unfreeze my credit.
nalor511
Posts: 5058
Joined: Mon Jul 27, 2015 1:00 am

Re: ACATS security risks?

Post by nalor511 »

Luckywon wrote: Fri Jul 23, 2021 2:58 pm
nalor511 wrote: Fri Jul 23, 2021 2:14 pm
If the thief wants to open a new account at a NEW brokerage, such that the OP receives no notification because they've never done business with this brokerage, then yes there will need to be a soft pull.
When I opened up accounts at Ameritrade and Etrade, which were brand new to me, there was no requirement for me to unfreeze my credit.
That's super weird, and violates the "know your customer" regulations. Schwab def does a soft pull. But you answered the security questions from the credit report?

You're sure you never had any affiliation with those brokerages before, maybe a previous 401k or stock option plan?
Luckywon
Posts: 2406
Joined: Tue Mar 28, 2017 10:33 am

Re: ACATS security risks?

Post by Luckywon »

nalor511 wrote: Fri Jul 23, 2021 3:00 pm
Luckywon wrote: Fri Jul 23, 2021 2:58 pm
nalor511 wrote: Fri Jul 23, 2021 2:14 pm
If the thief wants to open a new account at a NEW brokerage, such that the OP receives no notification because they've never done business with this brokerage, then yes there will need to be a soft pull.
When I opened up accounts at Ameritrade and Etrade, which were brand new to me, there was no requirement for me to unfreeze my credit.
But you answered the security questions from the credit report?
This was a while back. I do not recall such a process but I cannot be certain.
User avatar
happenstance
Posts: 306
Joined: Sun Jul 26, 2015 11:24 am
Location: NYC

Re: ACATS security risks?

Post by happenstance »

I moved some assets from Schwab recently for a mortgage relationship discount, and a representative called me for verbal confirmation before releasing the assets. I don’t know if I would rely on this, but it was a nice bit of reassurance.

I also moved and closed-out an entire account from Vanguard and was not contacted at all.
sycamore
Posts: 6360
Joined: Tue May 08, 2018 12:06 pm

Re: ACATS security risks?

Post by sycamore »

burritoLover wrote: Fri Jul 23, 2021 12:59 pm It was pretty scary transferring stuff out of Vanguard to another brokerage. Absolutely no communication from Vanguard - no email, no text, no nothing - just gone one day and they even closed the brokerage account (despite having an IRA as well).
This has been my experience as well, not just at Vanguard. I don't know if it's "industry standard" but my assumption is that me requesting an asset transfer of all assets to a new brokerage is treated as "oh, and close my account too". The old brokerage wants to cut costs by closing accounts that don't have any money which is understandable.

None of this is to excuse what I'd call poor communication.
User avatar
Topic Author
Orangutan
Posts: 309
Joined: Mon Feb 08, 2021 3:36 pm
Location: NYC

Re: ACATS security risks?

Post by Orangutan »

Update:

Zero communication on Vanguard’s end (outgoing). I received a call from E*Trade (receiving) confirming the transfer.

To note, the E*Trade rep who called is an assigned local consultant. He sped up the process, manually increased the bonus by nearly double, will ensure cost basis goes through properly, and was not pushy at all (said passive indexing is a good way to go). Wonderful experience so far.
Oregano
Posts: 365
Joined: Fri Nov 22, 2019 8:30 pm

Re: ACATS security risks?

Post by Oregano »

nalor511 wrote: Fri Jul 23, 2021 3:00 pm
Luckywon wrote: Fri Jul 23, 2021 2:58 pm
nalor511 wrote: Fri Jul 23, 2021 2:14 pm
If the thief wants to open a new account at a NEW brokerage, such that the OP receives no notification because they've never done business with this brokerage, then yes there will need to be a soft pull.
When I opened up accounts at Ameritrade and Etrade, which were brand new to me, there was no requirement for me to unfreeze my credit.
That's super weird, and violates the "know your customer" regulations. Schwab def does a soft pull. But you answered the security questions from the credit report?

You're sure you never had any affiliation with those brokerages before, maybe a previous 401k or stock option plan?
A brokerage account is not a credit account.
nalor511
Posts: 5058
Joined: Mon Jul 27, 2015 1:00 am

Re: ACATS security risks?

Post by nalor511 »

Oregano wrote: Fri Jul 23, 2021 8:26 pm
nalor511 wrote: Fri Jul 23, 2021 3:00 pm
Luckywon wrote: Fri Jul 23, 2021 2:58 pm
nalor511 wrote: Fri Jul 23, 2021 2:14 pm
If the thief wants to open a new account at a NEW brokerage, such that the OP receives no notification because they've never done business with this brokerage, then yes there will need to be a soft pull.
When I opened up accounts at Ameritrade and Etrade, which were brand new to me, there was no requirement for me to unfreeze my credit.
That's super weird, and violates the "know your customer" regulations. Schwab def does a soft pull. But you answered the security questions from the credit report?

You're sure you never had any affiliation with those brokerages before, maybe a previous 401k or stock option plan?
A brokerage account is not a credit account.
https://www.finra.org/rules-guidance/ru ... rules/2090
Oregano
Posts: 365
Joined: Fri Nov 22, 2019 8:30 pm

Re: ACATS security risks?

Post by Oregano »

nalor511 wrote: Sat Jul 24, 2021 1:43 pm
Oregano wrote: Fri Jul 23, 2021 8:26 pm
nalor511 wrote: Fri Jul 23, 2021 3:00 pm
Luckywon wrote: Fri Jul 23, 2021 2:58 pm
nalor511 wrote: Fri Jul 23, 2021 2:14 pm
If the thief wants to open a new account at a NEW brokerage, such that the OP receives no notification because they've never done business with this brokerage, then yes there will need to be a soft pull.
When I opened up accounts at Ameritrade and Etrade, which were brand new to me, there was no requirement for me to unfreeze my credit.
That's super weird, and violates the "know your customer" regulations. Schwab def does a soft pull. But you answered the security questions from the credit report?

You're sure you never had any affiliation with those brokerages before, maybe a previous 401k or stock option plan?
A brokerage account is not a credit account.
https://www.finra.org/rules-guidance/ru ... rules/2090
Nothing about that says that an advisor needs to know a client's credit status. It is simply not a requirement. Trust me, no one's brokerage account will be refused due to a credit freeze.
Post Reply