I got an email yesterday, and I suspect all of you who use Vanguard received the same. It’s rare for me to write within one day of something happening, but this one is worth it. If you deleted it, dig it out of your trash when you’re done reading this, and click that button.
You all need to be aware of that email, even if you use someone other than Vanguard. If you’re with a different firm, read this article, then find out what they have to offer that’s comparable.
This is important stuff.
Here’s what the email said:
I clicked…and here’s what happened…
I just ran the Vanguard Security Audit, and here's what I learned. Share on XVanguard’s Security Audit – What I Learned
I clicked that “Check your profile” button at 11:32 am on July 29th, and at 12:30 pm I started writing this article. In one hour, I completed 100% of the Vanguard audit steps (and implemented 100% of the recommended upgrades).
I completed all of the suggested tasks and moved from “Good” to “Excellent” in less than an hour.
Amazingly, that even included some serious security upgrades on my Samsung phone (everything is now biometric and PassCode-based, also within the hour!)
Here’s how things flowed. (I’ve got to say, it was incredibly efficient.)
1. My Security Dashboard Opened … And Gave Me This:
Sure, it’s Great to be Great, but what would it take to fill out that rainbow?
Vanguard immediately follows up, of course, with those “personalized suggestions,” a checklist of recommendations directly below the rainbow, presented in the form of a 10-Item scorecard.
2. The 10-Item Scorecard
Unfortunately, I didn’t think to grab a screenshot of my initial scorecard (the idea of writing about the audit was still just a small seed in my brain). Suffice it to say, my scorecard wasn’t all green, which resulted in my “Great” vs. “Excellent” headline score shown above.
The scorecard shows a “Red/Yellow/Green” for each of 10 security items, with hyperlinks to each red/yellow item to lead you through the fix. I clicked every one of those links, and did a complete security update in less than an hour. I did capture the completed list at the end of the audit, and have pasted that below:
Note it’s all now green. Wink. More importantly, it is the same scorecard format you see at the very beginning of the process, but you’ll likely see many yellow items. I had ~4 yellows to fix, if memory serves correctly.
Take the time to turn your scorecard green!
3. The Security Updates I Implemented
I can’t recall every update I implemented, and I didn’t take enough screenshots to walk through each step. I simply followed those yellow links and did what they suggested. I should state I am far from an expert with regards to modern security techniques, so some of what I say may not be entirely technically correct.
I’m just a guy out here trying to figure it out, like the rest of you.
That’s why I decided to click that button…to figure it out. I couldn’t be happier with how smoothly it went, and that’s what inspired me to write this article. Based on my experience with the process…
…I strongly recommend everyone click that “Check your profile” button.
When you do, you’ll be doing things like this:
3a) Locked Outgoing Money Transfers
By far, the upgrade I was most pleased about was the ease of implementing a lock on outgoing money transfers. I had recently listened to a ChooseFI podcast about the importance of doing an ACATS lock, and had it as a “to do” on my calendar for this week.
Not to get into the weeds, but an important note. I did some research as I wrote this section, asking ChatGPT to compare an ACATS to the “Locking Outgoing Money Transfers” I had just implemented. Chat says this upgrade is not the same as the ACATS, and I would recommend Vanguard add the ACATS feature to their audit process flow. As it stands, it is not addressed in the audit and needs to be implemented separately.
Update after publication: ChatGPT was wrong (proof that it happens). I talked to Vanguard on 7/30, ACTATs lock was part of the process, automatically. Vanguard 1, ChatGPT 0. Here’s the proof:
For the record, here’s how ChatGPT explains the difference between ACATS and Lock Outgoing Money Transfers (both of which are implemented when you lock money transfers through the audit process):
- ACATS Lock: Prevents an Automated Customer Account Transfer Service (ACATS) transfer, which is the system brokers use to move an entire account or specific securities from one brokerage to another. If someone tried to transfer your Vanguard account to another firm without your authorization, an ACATS lock is designed to stop that.
- Lock Outgoing Money Transfers: Prevents cash from leaving your account through methods such as ACH transfers to linked bank accounts, wire transfers, or other cash disbursements (depending on how Vanguard implements the feature).
Importantly, the Lock does NOT impede your ability to move your money to other institutions. If the transfer is initiated by you, it’s the same as it always was. The Lock ensures that no one else can move your money without express approval by you.
Seems like a good security setting to turn green, so I did.
3b) Implemented Biometrics Security
One of the items on the checklist was to implement biometrics, so I clicked the button. I’ve been having some issues with my fingerprint ID on my phone (probably my screen protector’s fault), and wanted to reset my fingerprint scan anyway.
A couple of clicks later, and my money at Vanguard is now secured by biometrics. And…I have a new fingerprint scan that works (and Face ID, of course).
Better than a password, and a lot more secure.
3c) Implemented Pass-Code Authentication
For years, like most of you, I have had to keep my cell phone nearby when I’m logging in to a secure website, so I can dutifully retype that annoying security code that was just texted to me.
As of one hour ago, I’m using passcode authentication, a much more secure (and easy-to-use) code generator to confirm it’s you trying to log in somewhere.
I’ve been reading about passcode superiority for a while, but just hadn’t gotten around to setting it up. Of relevance, a UK security agency recently declared “Passkeys superior to passwords – passkeys should be the ‘first choice” for authentication.:
I now have Pass-Codes in place, and still had 15 minutes of my hour left.
Within 45 minutes, I had completed all of the suggested tasks and moved from “Great” to “Excellent”, as confirmed below:
3d) Phone Security Upgrades
I got an unexpected bonus when I did the Vanguard Audit, and I ended up doing a cell phone security audit at the same time. It wasn’t expected, but (as mentioned earlier) I was trying to figure out how to update my fingerprint scan on my phone to set up the biometrics.
That search through the Security Settings on my Samsung Android phone led to some additional security updates recommended by Samsung. I figured, “why not”, and spent the last 15 minutes doing some upgrades to my phone’s security. Similar to the VG scorecard, here’s what Samsung’s looks like:
After a few quick clicks, my cell phone’s scorecard is now entirely green (and passkey protected), as well.
Conclusion
Taking steps to review and enhance the security around your financial assets is critical, especially now. With the advancements of AI and the dueling forces of good vs. evil, it’s simply not responsible to ignore this stuff and hope it goes away.
It won’t.
So pay attention, and don’t procrastinate (I’m guilty as charged).
If you get an email from a trusted firm like Vanguard suggesting you review your account’s security, don’t delete it. Make sure it’s from a reliable source (if any doubt, log in directly to your account and search for your Security Settings there), but keep an eye on suggestions to enhance your security. If you didn’t get the Vanguard email, take a few minutes to search the “Security” area on your firm’s website, then implement the recommended upgrades.
Within one hour, I…
- Ran The Vanguard Security Audit
- Implemented numerous key security measures
- Increased my security score from “Great” to “Excellent”
- Increased my cell phone security.
- And started this article about it.
An hour well spent.
I encourage you to do the same.
Your Turn: Are you paying attention to updating your security settings, or have you been procrastinating? Did you click the Vanguard button yesterday? What other security measures are you using that you’d recommend to other readers? Let’s chat…
What happens if you lose your cell phone? Are you also then locked out of your Vanguard accounts? I work as a Park Ranger and we get a couple of lost cell phones almost every day during the summer. I love the new security dashboard on Vanguard but I was concerned it tied so much to a single physical device you carry with you everywhere.
Good question, dap. I did find that there’s a “Find Your Phone” feature when you log in to your online Samsung account, so I’d obviously do that first. To be honest, I’m not sure how you restore your security measures when you replace the phone. Something I need to check into, and hope it never happens. Valid concern.
Purchase a YubiKey (or 2) and restrict access to your account to utilize it instead of phone 2FA. They are small devices that plug into a USB port. You have to register them with Vanguard first, then disable other 2FA methods. This way you won’t fall prey to a sim swap scam.
Spot on but I’d buy 3 at least, one you carry with you, one you have in a very save location outside of your home and another spare somehwere hidden in your home. And make sure you setup recovery keys with Apple for example and your password manager. If you lose one, that’s bad, if your house burns down the same day, that’s very bad and that’s why you want one somewhere else just in the worst case. Keep in mind.
I totally agree! Too many scams and hacks involving phones. I’m surprised more companies don’t use these hardware authenticators.
Agree 100%!!! Works well. Can also use on password managers and email to ensure key security tools are locked down.
Generate back up codes when you use 2FA.
Two-factor authentication (2FA) backup codes are emergency single-use passwords used to access your online accounts if you lose your phone, delete your authenticator app, or cannot receive text messages. You generate a set of these codes when you first turn on 2FA for a service.
How They Work
Single use: Each code works only one time. Once you type it in, it becomes inactive.Replacement: Generating a new list of backup codes automatically cancels your old list.Emergency prompt: If your main 2FA method fails, choose the “use a backup code” option on the sign-in screen.
Best Practices for Storage-
Keep them offline: Print them out or write them down on paper rather than saving them on the device you use to log in.
Store safely: Put the paper in a secure location, like a home safe or a locked drawer.
Track usage: Cross out codes as you use them so you know when to generate a fresh batch
I retract my prior comment about generating backup codes because Fidelity, Vanguard, and Schwab don’t offer that. So I asked AI, “what alternate method i can use if i lose my phone?” Here’s the answer (which admittedly is pretty dense and requires a lot of technical understanding):
None of these brokerages offer system-generated backup codes. If you lose your phone, here are your alternative access methods:
Fidelity: Use a physical Symantec VIP hardware token, a secondary device with your duplicated setup, or call support at 800-343-0860 for identity verification.
Schwab: Use a physical Symantec VIP hardware token, Symantec desktop app, a backup landline number on your profile, or call support at 800-435-4000.
Vanguard: Use a secondary backup YubiKey hardware key, desktop browser Passkeys via computer biometrics, a backup voice landline, or call support at 877-662-7447.
Recommendation: For Fidelity and Schwab, register a physical Symantec VIP fob or duplicate your authenticator setup onto a tablet ahead of time. For Vanguard, register at least two hardware YubiKeys.
I got the same email. I clicked on the same link, wanting to see how secure my Vanguard account was.
Then I remembered – “DON’T click on a link in an unsolicited email; despite how authentic it appears, it could be a scam.”
I immediately closed the website and shut down my computer.
A little later, I went to the Vanguard website I have bookmarked, and completed the security audit.
Apparently I didn’t need to be so cautious this time. But I’m glad I was, and I hope I continue to be.
I had to smile when I read your note, H. I’ve done the same thing, and am VERY careful now to review the source and authenticity before clicking that button. It’s definitely a good practice to always just go to the website directly and search the item there.
Better safe than sorry, thanks for the reminder.
(BTW, curious, were you “Great” on your initial dashboard?)
My take is Vanguard specifically DOES address ACATS? At least it did in what I reviewed yesterday. Appreciate all your work!
This is my next task, hope to tackle it today. I quite sure the audit does NOT address ACATS, so I’m going to check into it to see how to implement it directly. On my “To Do” list this afternoon…no procrastination. š
I believe that Vanguard has implemented a ACAT lock:
āWhat is an outgoing transfer lock?
An outgoing transfer lock prevents ACAT, or Automated Customer Account Transfer. This is a standard system brokerages use to transfer assets between institutions.ā
My understanding (naive, at best), is that you can still do Account Transfers after you implement ACATS, but they have to be initiated by you (perhaps even just “approved” by you, I need to investigate). Regardless, they still allow a means to transfer assets, it just stops the possibility of it happening without your approval.
Thx for this Fritz… these days being fully FI and retired I don’t even pay much attention to money things, I’m just loving retirement and having fun. I just made a few changes. Cheers!
Great to hear from you, Dave. I miss that early bird. Still loving your writing, read every one. Keep it up, you’re good at it (you’re one of my favorites parts about Fridays…)
As typical, I could not complete everything due to “Vanguard experiencing technical difficulties” I get these errors often with Vanguard. Just need to try again later. This time it was the passkey attempt that failed.
User-error, Kev. What can I say. š Love ya, man.
Even though passkeys are a great first step, for your most important accounts / logins consider physical security keys (Yubikey for example). No one will ever be able to log into your accounts without that physical key even if they get a hold of your computer for example (breaking in your home, hacking into your computer and using the passkey stored on the computer can get one in, but if your physical key is with you all the time, it’s impossible to log in). Your password manager should also be secured by a physical security keys. There is some great write ups on Mike Piper’s Oblivious investor blog for much more detail on those security keys.
Great trip, Peter. I’ve read about Yubikeys, but haven’t investigated them yet. Thanks for the tip, going to start researching it (big fan of Mike Piper’s work). I just started a “Security To Do” note from these comments, thanks for the help as we all sort it out.
FYI: Fidelity has the same security audit and capacities.
Excellent, thanks for confirming.
hi, You wrote, “ChooseFI podcast about the importance of doing an ACATS lock”, and I’d like to listen to the episode but I can’t locate it on ChooseFI. Can you link directly to that specific episode or share the specific ep title? Thanks.
You caught me! I listened to the tax discussion with Cody, but not sure if it was on there or perhaps Brad’s weekly email. I looked briefly for the source to add a direct link, but wasn’t sure which it was. I consume too much of this stuff to keep it all straight. Sorry about that. I’ll see if Brad can weigh in with the direct source.
Hi Lynn,
I mentioned it in my newsletter here: https://choosefi.com/newsletter/fi-weekly-january-20-2026
I know Sean and I talked about ACATS on this episode, but I don’t think in reference to a lock: https://choosefi.com/podcast-episode/mailbag-breaking-up-with-your-advisor-i-bonds-4-rule-accounts-for-kids-roth-iras-sean-mullaney-ep-447
Dang, Brad, that was FAST!! Thanks for the help, it was, indeed, that newsletter (yes, I DO read your stuff – wink). Looking forward to our upcoming chat.
One additional form of security is to not have all or most of your assets under one brokerage/bank/institution. We have three separate corporations holding the bulk of our investments. I know many preach to simplify accounts but to me its common sense to keep totally unconnected accounts so that if one institution has a security breach, a terrorist shutdown or a governmental freeze on accounts, that you still have access to most of your resources. If diversified asset classes are important then it stands to reason that diversification in the number and types of accounts held is just as important. Also if security fails, and all security measures are breakable, then you only stand to lose a portion of your assets. This isn’t a popular opinion and it has always puzzled me why.
Great point, Steveark. We also heard a tip that you should have a small emergency fund at a local credit union, so we set them up when we retired. Local money, out of the larger “network”. I also keep the majority of our liquid funds (Bucket 1) outside my primary brokerage account for exactly that reason. That said, we still have the majority at Vanguard, as I suspect is also true of most others.
I’ve read the same advice, but boy having investments scattered across 3 institutions can really make rebalancing a pain. I wanted to consolidate my accounts just so the investments are easier to manage. Maybe the sweet spot would be to have brokerage at Firm #1, pretax at Firm #2, and Roth at Firm #3?
I would add go to each of the credit report agencies and freeze your credit. This will prevent anyone from taking out a loan in your name.
BINGO! I did this about 10 years ago when it first started hitting the radar. Has worked fine for us, very minor inconvenience and a great security move. Thanks for adding to the discussion.
Hi Fritz. When a person sets up Biometrics on their accounts, what happens when that person dies? How are their heirs able to access those accounts?
Thanks.
Hi – make sure to have your beneficiaries setup for all financial accounts, that will address that problem and also speed up the process of transfer as then those accounts are not part of the estate and the lengthy procedure there. A trust will address that too but is more complicated and costly. Mike Piper has written another great little book on the overall “death” issue – “After the Death of Your Spouse: Next Financial Steps for Surviving Spouses” . Quick and easy read.
Great response, thanks for jumping in. Just added Piper’s book to my list, thanks for the tip.
Thanks Peter.
Glad to see ACATS transfer beginning to be taken seriously. You can easily lock at Fidelity and now Vanguard. Schwab? Not so much…
NP Fritz – love Piper’s writings and his overall style, straight to the point. I learned a whole lot from him from the Boglehead conference recordings and his books, big building block in my DIY retirement – went live with that 4/2 š
Congrats on crossing “The Starting Line” in April, you’re going to love life on this side of the line. Yeah, Mike’s a sharp guy. I’m heading to Bogleheads this November, hope to see him there (and maybe you?).
Thanks and already loving every minute of it! Always wanted to attend but the dates were always mid October and over my wife’s birthday, but since you brought it up, it looks this year is in November – I should take a look, don’t think we have travel plans yet for November – thanks for reminding!
Thanks Fritz for the roundup!
I’m still stuck on the biometrics – reluctant for a variety of reasons. Passkey yes.
Another thing you can do besides credit agency freezes to prevent fraud is to prevent someone impersonating you and opening a banking account using your name and info.
Go to Chexsystems.com to create a unique identifier.
From what I understand, if someone tries to create an account elsewhere in your name (with the intent to transfer money from your existing bank to the new bank account), they need your pin and other info. Haven’t seen anything written about it other than on the website. Anybody else know more about how that works and how widely that’s used?
Harry Sit, the Finance Buff, wrote about it. I immediately implemented for myself, my spouse and my mother in law.
https://thefinancebuff.com/chexsystems-security-freeze-login-report-score.html
I saw this email from Fritz and I just gazed at it until this happenedā¦.. scroll downā¦
I clicked in itā¦.andā¦..it opened..and thenā¦I read it..and ā¦scroll downā¦
The article was about a very important aspect of of digital account securityā¦ and I ponderedā¦.should I actually do this?ā¦.and I clicked on about 3 more buttonsā¦. and this happenedā¦. Scroll down
I actually went to the Vanguard site andā¦.clicked 4 different buttonsā¦ and..upgraded my security. Very helpful. Scroll downā¦Thanks Fritz.
The one thing I did that Vanguard allows (and Fidelity does not) is to implement a PHYSICAL KEY instead of an authenticator app/code. I also locked my SIM card on my iphone which prevents a hacked from SIM stealing. Whenever Vanguard has implemented a MFA requiring a SMS text code, this can be hacked. An authenticator app is the next best thing. BUT a PHYSICAL KEY at your location computer and iphone is the best. It requires a physical touch to sign into the Vanguard account. However, beware, Vanguard does NOT turn off the MFA text code unless you call them to take it off. Ther’s no use in having a physical key if the MFA text option is still engaged. So, call Vanguard and have that turned off so the only way to sign on with their website is the physical key. Caution: You should get 3-4 keys to make and keep them in separate places – home, office, etc. When you use the iphone app, you can still use it with faceID after you have set it up with the physical key. for the iphone, you will need the NFD version which will allow you to scan to the top of your phone. You can also get an iphone adapter to plug it in like your computer.
Great info to write about, Fritz, and a great write-up! I had gotten that email, too, but I’m proud to say that I was already all in the green on my account (and my wife and daughter’s, too). That’s the one area where I don’t mess around. Nice job on crushing your account and spreading the word!
I bought 3 Yubikeys to upgrade the security on my Van Guard accounts but their stipulations / disclaimers regarding their liability when you use them had me hold off on implementing. I worry that if my account is compromised in some way that liability for account losses are pretty much your problem then. How would you have a chance of fighting Van Guard if it occurred??
I need to follow up about this with Schwab. I hate that we all have to work so hard to protect ourselves. Especially scary the older we get! In 2020 at the beginning of the pandemic, we were hacked and they managed to āportā our phone numbers to another carrier. It happened after business hours, and as you can imagine the fact that when they went in to change passwords etc, the banks text the security codes to our phone numbersāso the criminals were receiving them š. It was a total nightmare, and the only reason they didnāt get any money is because our daughter, who was still on our plan, saw something weird and alerted us, and helped us shut them down quickly! They even tried to access our tax return from CPA, fortunately that was encrypted. Not only did we get no sleep that night, but had nightmares for some time.
Thanks for the reminder Fritzš
Great article Fritz. One thing that always throws me off is re: usage of mobile appsā¦ā¦ when I get those emails showing security strengthening checklists (and for those of us that just use a PC) it feels like they WANT us to use the mobile apps to achieve maximum strengthen security. I may be interpreting them wrong and overthinking it, but Iām like ā¦.should I ignore the mobile app security stuff if we donāt use it or are they saying āuse the mobile app to add further security even if you donāt use it since a bad guy may use it that wayāā¦ā¦.
I feel the same way! I don’t need to check my investments every hour of every day. I typically don’t use an app for important access. I have every alert tuned on, and monitor my accounts monthly on my PC with a hardware key. Cell phones play no part in my account monitoring.
The ACATS account lock at Vanguard is not available for Trust accounts.
Great info butā¦ PLEASE! Do not tell people – especially retirees – to click on a link in an unsolicited email! We should never do that! Thatās how people get scammed out of their retirement savings!
Instead, please tell them to navigate directly to the Vanguard website and log in there.
Very interesting. This looks very similar to what Fidelity has had for years. They even have that fancy rainbow rating you showedā¦ the one thing you noted that Fidelity doesnāt have is Passkey. Iām hoping they add it soon. One of the reasons I moved to Fidelity was theyāve had ACATS and transfer lock and the ability to turn it on and off via the website. I think Vanguard had it but you had to call to turn it on and off ( from what I read on Bogleheads). Fidelity had it for a while, at least 3 years. Glad to see Vanguard improving their services. Iām a big fan of Vanguardās funds, but had many issues with them as a custodian over the years so I ended up switching to Fidelity. Iām not against switching back so very happy to see this move on their part.
I posted an earlier comment about Vanguard lock not available for Trust accounts based on attempting it last week. I notified Vanguard about the restriction and was told there were special legal requirements which prevented the lock. I explained that Fidelity allows the lock. Today I tried it again and it locked the Trust account. Someone must have looked into it further and allowed it.
This article repeatedly suggested to click the link in the email. If you care about security, DO NOT CLICK LINKS IN EMAILS! Go to the website from your browser and log in and go from there. Can’t believe i’m having to say this for an article about online security!