Senators say big brokerages leave accounts open to theft
Senators Ron Wyden and Elizabeth Warren say structural gaps in brokerage transfer rules leave customer accounts open to theft. Fraudsters can abuse the Automated Customer Account Transfer Service (ACATS) to move stocks, bonds, and cash before victims notice. The senators urged FINRA to require notifications, transfer locks, and stronger login defenses.
In an August 20, 2026 letter to FINRA President and CEO Robert W. Cook, the Oregon and Massachusetts Democrats warned that millions of Americans’ life savings are at risk because leading brokerages lack basic online account-holder features. Law360 reported the same day that the senators pointed to “structural weaknesses” bad actors exploit to drain brokerage accounts. For related coverage, see BlasterPost’s Fintech & Crypto Alerts.
Key Takeaways
- Wyden and Warren say ACATS gaps leave accounts open to theft through unauthorized transfers.
- Brokerages get one business day to validate or object and three to complete asset moves.
- FINRA recommends—but does not require—notifying customers before transfers.
- Fidelity and Vanguard offer self-serve transfer blocks; Webull, Robinhood, and Interactive Brokers pledged upgrades after Senate outreach.
- Senators want mandatory ACATS alerts and phishing-resistant multi-factor authentication, such as passkeys.
What is ACATS, and why does speed create a theft risk?
ACATS is an automated system managed by the National Securities Clearing Corporation. It lets investors move stocks, bonds, and cash from one brokerage to another without long delays.
That speed was meant to stop firms from dragging their feet. Senators say it also gives fraudsters a window to exploit weak security before victims can respond.
Under current rules, brokerages have one business day to validate or object to a transfer request and three business days to complete the move. Most firms rely on a bare-bones electronic check and do not confirm the transfer with the outgoing account holder. Some do not even notify customers that assets are leaving.
Press reports cited by the senators describe fraudsters opening accounts in victims’ names, then using ACATS to empty investments before anyone notices.
Which brokerages already block unauthorized transfers?
An analysis by the senators’ offices found an uneven security landscape. Only a fraction of brokerages voluntarily give customers strong protections against fraudulent ACATS transfers.
Fidelity and Vanguard let customers independently block outgoing ACATS transfers. Several other firms will block transfers if customers ask through customer service. Several others, the senators said, offer no way for customers to lock their accounts against this form of theft.
After direct outreach from Wyden and Warren, Webull, Robinhood, and Interactive Brokers agreed to upgrade security by building self-service transfer locks. The senators argue voluntary steps are not enough for every retail investor.
What do Wyden and Warren want FINRA to require?
“It is unacceptable that major brokerage firms are putting customers’ life savings at risk of being ripped off by criminals because of inadequate account protections,” the senators wrote. “FINRA must step in to protect consumers.”
They called on FINRA to require firms to notify account holders of ACATS requests—practice FINRA already recommends but does not mandate. They also demanded phishing-resistant multi-factor authentication, including passkeys, to harden logins against hackers.
Stronger ACATS rules and cybersecurity standards, they said, would close vulnerabilities for millions of retail investors no matter where accounts are held. Every American, they argued, should trust that life savings sit behind the strongest measures available.