Wyden and Warren warn brokerage customers could lose retirement savings through a little-known transfer scam
Senators Ron Wyden and Elizabeth Warren are pressing financial regulators to strengthen protections for brokerage customers after finding that major firms have widely different safeguards against a type of fraud that can drain investment and retirement accounts.
The lawmakers say criminals are exploiting weaknesses in the Automated Customer Account Transfer Service, or ACATS, to move assets from legitimate brokerage accounts into fraudulent accounts opened using stolen personal information.
Wyden and Warren, the ranking Democrats on the Senate Finance and Banking Committees, urged the Financial Industry Regulatory Authority, or FINRA, to take immediate action to protect investors from ACATS fraud.
“Bad actors are increasingly exploiting structural weaknesses in the ACATS system to illicitly drain consumers’ brokerage accounts, including retirement funds,” the senators wrote in a letter to Robert W. Cook, chief executive of FINRA.
The lawmakers said their review of major brokerage firms found a “deeply concerning lack of standardized, consumer-controlled protections across the industry.”
The concern centers on the ability of criminals to impersonate legitimate customers, establish fraudulent accounts and then request that assets be transferred from the victim’s actual brokerage account.
How criminals can move money without the customer knowing
ACATS is an automated system used by brokerage firms to transfer stocks, bonds and cash between financial institutions. The system was designed in part to make it easier for customers to move their investments when switching brokerages.
Under current rules, the receiving brokerage initiates the transfer after receiving a request from the customer. The brokerage holding the assets generally has one business day to validate or object to the request and, if approved, must complete the transfer within three business days.
The senators argue that a process designed to prevent brokerages from delaying legitimate transfers has created a security weakness because the outgoing brokerage is not required to obtain direct confirmation from the actual account holder.
Fraudsters can exploit the system by using stolen personal information to open an account in a victim’s name at another brokerage. They can then submit an ACATS request designed to pull assets from the victim’s legitimate account.
Some brokerages do not offer customer-managed transfer locks
The senators’ review found major differences in the tools available to customers who want to block unauthorized ACATS transfers.
Fidelity and Vanguard offer self-directed features that allow customers to block transfers. JPMorgan Chase, Robinhood, Webull and Wells Fargo told the lawmakers they also offer transfer locks, but customers must contact customer service to enable or disable them.
According to the senators’ letter, “Unfortunately, other major brokerage companies,
including Citi, E*TRADE, Merrill Lynch (Bank of America) and Morgan Stanley Wealth
Management do not offer similar mechanisms, which leaves their customers completely
exposed to the vulnerable ACATS process. Charles Schwab similarly fails to offer ACATS
transfer lock protection for its customers and has refused to provide written confirmation of
future plans.”
The lawmakers said this leaves customers with different levels of protection depending on which brokerage holds their assets.
Customers may not be warned when transfers begin
The senators also raised concerns about inconsistent notifications when an ACATS transfer request is received.
According to their review, Citi and Wells Fargo do not alert customers when their money is redirected into another account. That can eliminate an important opportunity for a customer to identify a fraudulent request before the assets leave the account.
FINRA previously addressed the issue in Regulatory Notice 23-06, published in March 2023. The regulator identified customer notifications through email, phone calls or mobile push notifications as an “effective practice” for reducing the risk of fraudulent ACATS transfers.
However, the senators said FINRA made notification a recommendation rather than a mandatory requirement.
The lawmakers are now asking FINRA to turn that voluntary guidance into a binding rule requiring brokers to notify customers when an outgoing ACATS transfer is requested.
A Vanguard account case highlighted the danger
The potential consequences were illustrated by a case involving a Vanguard customer whose wife’s Roth individual retirement account holdings appeared to have disappeared.
According to the senators’ letter, a criminal opened two accounts in the wife’s name at Merrill Edge and requested a transfer from Vanguard.
The couple was fortunate because the fraudster had not yet taken the money. Merrill was able to freeze the fraudulent account before the assets disappeared permanently.
The senators cited the case as an example of how quickly an unauthorized transfer can move through the existing system and why customers need a way to intervene before their investments are transferred.
Lawmakers want customers to approve outgoing transfers
Wyden and Warren want FINRA to fundamentally change the ACATS process by requiring the account holder whose assets are being withdrawn to confirm the transfer.
For customers who manage their brokerage accounts online, the senators proposed requiring the transfer to be explicitly approved during an authenticated session on the outgoing brokerage’s website or mobile application.
They argue that many financial institutions already have the technology to securely authenticate customers for other financial services, making a similar confirmation process possible for ACATS transfers.
The lawmakers also want brokerages to offer customers self-managed, opt-in transfer locks that can be used to prevent unauthorized transfers.
For customers who do not manage their accounts online, the senators proposed a different safeguard: requiring a Medallion Signature Guarantee on the transfer application. That process requires an in-person visit to a financial institution and would create a verified paper trail before assets could be moved.
Senators call for stronger authentication with passkeys
The lawmakers also urged FINRA to require brokerages to adopt phishing-resistant multifactor authentication, specifically passkeys.
They argue that traditional methods such as verification codes sent by text message or email, as well as some mobile push notifications, can be bypassed by sophisticated criminals.
Several brokerage firms already support passkeys, including Interactive Brokers, Merrill Lynch through Bank of America, Morgan Stanley Wealth Management, Robinhood, Vanguard, Webull and Wells Fargo. However, the senators said these firms continue to support less secure authentication methods as well.
JPMorgan supports passkeys for web-based account access but not its mobile application, according to the letter. Fidelity was targeting September 2026 for its rollout, while E-Trade was also working to add support.
The senators said Charles Schwab and Citi lag behind because they only support less secure authentication methods that do not meet federal cybersecurity standards. Charles Schwab has refused to provide written confirmation of future plans.
Brokerages have begun adding protections
The congressional inquiry has already prompted several firms to expand their security measures.
Webull told lawmakers it had recently enabled a customer-managed transfer lock ahead of its previously agreed deadline. Robinhood said it planned to install a user-managed locking feature, while Interactive Brokers committed to developing a self-service ACATS lock.
The senators’ letter said Webull and Robinhood had agreed to upgrade their existing transfer blocks to user-managed features by Q3 2026 and Q1 2027, respectively. Interactive Brokers committed to developing a self-service transfer lock with an expected launch in Q3 2026.
The lawmakers pointed to these changes as evidence that brokerage firms can introduce stronger customer controls without abandoning the ability to process legitimate account transfers efficiently.
FINRA faces a September deadline from senators
FINRA has not indicated whether it will adopt all of the measures requested by Wyden and Warren.
The regulator declined to comment directly on the senators’ letter but said it had been among the first regulators to identify the misconduct and warn its member firms.
“We are actively engaged with the wider securities industry,” FINRA said in a statement, “to determine what further actions are necessary to protect investors.”
The senators are asking FINRA to establish mandatory transfer notifications and customer-managed transfer locks in the short term, followed by stronger authenticated approval requirements for outgoing transfers.
They also want passkeys and other phishing-resistant authentication measures incorporated into brokerage security requirements.
Wyden and Warren requested a response from FINRA by September 17, 2026, detailing the steps the regulator intends to take to protect investors from ACATS fraud.
For brokerage customers, the dispute highlights a broader security issue: having an investment account protected by a password or conventional multifactor authentication may not be enough if criminals can impersonate the account holder at another institution and initiate a transfer of the underlying assets.
Like Financial Freedom Countdown content? Be sure to follow us!
11 reasons you should claim Social Security early
Deciding when to claim Social Security is often about maximizing your benefit. Financial planners usually advise delaying your claim for as long as possible to secure the highest monthly payment. Your benefit is based on your lifetime earnings, with a full payout available at your full retirement age (FRA), which is currently between 66 and 67 depending on your birth year. Claiming before FRA results in a permanent reduction in your monthly benefit, while waiting beyond FRA leads to a permanent increase. However, the decision isn’t solely about maximizing the monthly check. Personal factors such as health, family circumstances, and financial needs can play a significant role in determining the right time to claim.
11 Reasons You Should Claim Social Security Early
Did you find this article helpful? We’d love to hear your thoughts! Leave a comment with the box on the left-hand side of the screen and share your thoughts.
Also, do you want to stay up-to-date on our latest content?
1. Follow us by clicking the [+ Follow] button above,
2. Give the article a Thumbs Up on the top-left side of the screen.
3. And lastly, if you think this information would benefit your friends and family, don’t hesitate to share it with them!
John Dealbreuin came from a third world country to the US with only $1,000 not knowing anyone; guided by an immigrant dream. In 12 years, he achieved his retirement number.
He started Financial Freedom Countdown to help everyone think differently about their financial challenges and live their best lives. John resides in the San Francisco Bay Area enjoying nature trails and weight training.
Here are his recommended tools
Personal Capital: This is a free tool John uses to track his net worth on a regular basis and as a retirement planner. It also alerts him wrt hidden fees and has a budget tracker included.
Platforms like Yieldstreet provide investment options in art, legal, real estate, structured notes, venture capital, etc. They also have fixed-income portfolios spread across multiple asset classes with a single investment with low minimums of $10,000.
