August 20,2026
Millions of Americans’ life savings at risk due to a lack of basic online account holder features by leading brokerages
Washington, D.C. – U.S. Senators Ron Wyden and Elizabeth Warren today called for the Financial Industry Regulatory Authority (FINRA) to strengthen consumer protections and prevent Automated Customer Account Transfer Service (ACATS) brokerage fraud.
ACATS is an automated system managed by the National Securities Clearing Corporation which allows investors to seamlessly transfer their stocks, bonds, and cash from one brokerage firm to another. Designed to keep brokerages from slowing transfers, ACATS’ rapid process also gives fraudsters an opportunity to exploit the system’s weak security measures before victims can respond.
Under current regulations, brokerages have one business day to validate or object to a transfer request and three business days to complete asset transfers. FINRA recommends, but does not require, that brokerages notify customers before they transfer their assets to another company. Most firms rely on a bare-bones electronic verification process and do not verify the transfer with the outgoing account holder. Some do not even notify customers about the transfer of their assets. As a result, the press has reported that fraudsters can open accounts in victims’ names and use the ACATS system to drain their investments before they realize what has happened.
“It is unacceptable that major brokerage firms are putting customers’ life savings at risk of being ripped off by criminals because of inadequate account protections,” the senators said in their letter to Robert W. Cook, the President and CEO of FINRA. “FINRA must step in to protect consumers.”
An analysis conducted by the senators’ offices revealed an inconsistent security landscape, with only a fraction of brokerages voluntarily providing customers with strong protections. While firms like Fidelity and Vanguard allow customers to independently block outgoing ACATS transfers, and several others will block transfers if requested through customer service, several others offer customers no way to protect their account from fraudulent ACATS transfers. Following direct outreach from the senators, several brokerages—including Webull, Robinhood, and Interactive Brokers—agreed to upgrade their security by developing self-service transfer locks.
The senators called for the regulator to require that brokerage firms notify account holders of ACATS requests. FINRA currently recommends this practice. Similarly, the senators also demanded that FINRA require brokerages to protect customer accounts from hackers with phishing-resistant multi-factor authentication technology, such as passkeys. These are important cyber defenses that many financial institutions already offer.
Strengthening the ACATS process and forcing brokerages to upgrade their cybersecurity standards will eliminate account vulnerabilities for millions of retail investors, regardless of where they hold their assets. Every American should feel confident that their life savings are protected by the strongest measures available.
The text of this letter is here.
###
Previous Article
