r/Bogleheads • u/bxparks • 4h ago
Activating ACATS transfer lock is probably a good idea
I have read about how hackers could steal money from your brokerage account using ACATS transfer. Recently I created a new Fidelity brokerage account and transferred one of my Vanguard accounts to Fidelity. It was so easy. Too easy. I can see how ACATS theft can happen.
I created the Fidelity account completely online. They asked for the usual information: name, address, citizenship, birthday, SSN, email, and phone. All of them have been leaked dozens of times over the years. Fidelity did not ask me to upload any ID documents, such as driver's license or passport.
I have security freezes on all the credit bureaus and banking data brokers (Equifax, Experion, TransUnion, Innovis, ChexSystems, LexisNexus). They did nothing. Fidelity created my account without triggering any warnings.
Fidelity did not ask me to verify my email address. Usually companies send an email that says something like, "please click here to verify your email address". Fidelity sent nothing. I could have mistyped my email address, or a hacker could have use their own email address.
Fidelity did not verify my phone number. They just sent an SMS txt that said something like, "Your phone number has been added to your account. Call 800-xxx-xxxx if you did not do this." A hacker could have just used their own phone number.
Initiating an ACATS transfer from Vanguard to Fidelity was straightforward. I just provided Fidelity with my Vanguard account number. This might be hardest part for a hacker, obtaining the exact account number of the Vanguard account.
On the Vanguard side, I had already blocked ACATS transfers on all accounts. I logged into their website and temporarily disabled the lock on that one account. That took effect within a few minutes.
When I initiated the ACATS transfer, Vanguard emailed me a notification about that transfer within a few hours. Which is good. However, the account transfer from Vanguard to Fidelity completed in 2 days. If I had been traveling or busy, I could have missed that email notification from Vanguard.
With the funds now at Fidelity, I think a hacker could just wire those funds and run away.
My conclusion is that it is probably a good idea to enable ACATS locking on all brokerage accounts. At Vanguard it's called "Outgoing transfer lock". At Fidelity it is called "Money Transfer Lock". It's not clear if Schwab offers that feature. I will have to call them.