Regulators are warning about a surge in a type of crime known as ACATS fraud, where thieves use the brokerage industry’s Automated Customer Account Transfer Service to steal investor assets, the New York Times reported Friday. The system, designed to quickly move money between firms, has become a weak link in financial security because it emphasizes speed over fraud detection.
Criminals typically open new accounts online with stolen personal details, then request transfers from legitimate brokerage accounts through ACATS. Because firms have only a short window to confirm account information, transfers can be completed within days -- often without the customer realizing until it’s too late.
“The ACATS process was designed for speed, and doesn’t really have good fraud controls in place,” Gavin Holland, a financial crimes expert at SAS, told the newspaper.
One recent case shows how easily it can happen. Tien Tran, a California resident who manages his family’s retirement accounts, logged into his wife’s Roth IRA at Vanguard and found that half the holdings had disappeared. Days earlier, a fraudster had opened two Merrill Edge accounts in his wife’s name and initiated a transfer of assets from Vanguard. Luckily, the money had not yet been withdrawn; both Vanguard and Merrill froze the accounts.
“I was lucky it happened when I was at home and I caught it right away,” Tran said to the Times. His wife’s funds were restored within a week.
The incident left the couple unsettled. They never received a detailed explanation of how the impostor obtained account details, and Tran worried what might have happened if they had been traveling. He has since filed complaints with local police and FINRA, which oversees brokerages.
Experts say investors should take proactive steps: enable transaction alerts, use two-factor authentication, guard account numbers and pay close attention to any unexpected mail from financial institutions. What looks like a routine solicitation may in fact be a notice that an account has been opened in your name.
“It’s scary,” Tran said to the Times. “It can happen to anyone.”





