By Jonathan Ping, originally published at My Money Blog.
Vanguard recently rolled out a new “Security Score” that encourages folks to activate all of the various security features they have available, and included is a new feature called “Outgoing Transfer Lock”. This is an important and useful option that I think all Vanguard customers should activate immediately.
Background on ACAT transfer scams. Instead of hacking your Vanguard account directly, a thief will obtain enough of your personal information to open a new brokerage account somewhere else, say E*Trade, and then they will request an ACAT transfer of the entire contents of your existing brokerage account (ex. Vanguard) to that new fake E*Trade account which they control. At this point, they can quickly liquidate the account and send the money elsewhere. The key here is that they just need to be able to open an empty, new brokerage account in your name plus find your Vanguard account numbers from somewhere. They don’t need your Vanguard username and password (or pass two-factor authentication, etc).
This loophole, ironically, comes from FINRA Rule 11870, which was created to protect consumers from a broker not letting you leave them. If you request a transfer, the old broker has one business day to validate the authenticity, and then they only have 3 business days to complete the transfer. If they don’t complete the transfer in a timely manner, the old broker gets into trouble with the regulatory agency FINRA. Thus, the pressure is actually on your old broker to approve it quickly. They are not even required to notify you of the transfer. In fact, with nearly every legitimate ACAT transfer I’ve completed, the old broker never made a peep.
Fidelity was the first major brokerage to create a Money Transfer Lockdown feature in response, where you can opt-in to an extra layer of verification to prevent unauthorized transfers (both ACAT and certain bank transfers). Vanguard’s “Outgoing Transfer Lock” applies to ACATs only, with a different option called “Full Transfer Lock” that includes bank transfers coming later. Here’s the wording taken directly from the Vanguard website:
