Mysterious Vanguard Security Code

Non-investing personal finance issues including insurance, credit, real estate, taxes, employment and legal issues such as trusts and wills.
Post Reply
Topic Author
Lynn1987
Posts: 143
Joined: Tue Jun 18, 2013 9:00 pm

Mysterious Vanguard Security Code

Post by Lynn1987 »

I noticed a Vanguard security code text came through this morning, but I did not generate it. So, I logged into my account and it actually showed the last login as earlier this morning. There doesn't appear to be any pending activity, but it's very concerning and of course, they are closed today, so I can't contact them. I've now changed the password.

Anyone else had something like this happen?
johnubc
Posts: 870
Joined: Wed Jan 06, 2010 5:54 am

Re: Mysterious Vanguard Security Code

Post by johnubc »

Stop reading this and Change your password NOW, before you do anything else!
Topic Author
Lynn1987
Posts: 143
Joined: Tue Jun 18, 2013 9:00 pm

Re: Mysterious Vanguard Security Code

Post by Lynn1987 »

Yes, I did change my password before I wrote the OP.
DrChronzworth
Posts: 154
Joined: Wed Dec 10, 2014 5:42 pm

Re: Mysterious Vanguard Security Code

Post by DrChronzworth »

I would encourage you to change your password, but most of the times this happens, it's merely someone who has a similar username to you and is putting in the username wrong.

I used to work in customer service, and I probably had at least one call a day where someone would call in saying they had locked themselves out of their account and were quite mad their website access wasn't working. About half the time, I would just confirm the username with the client, and they were using the wrong username!
Topic Author
Lynn1987
Posts: 143
Joined: Tue Jun 18, 2013 9:00 pm

Re: Mysterious Vanguard Security Code

Post by Lynn1987 »

DrChronzworth wrote:I would encourage you to change your password, but most of the times this happens, it's merely someone who has a similar username to you and is putting in the username wrong.

I used to work in customer service, and I probably had at least one call a day where someone would call in saying they had locked themselves out of their account and were quite mad their website access wasn't working. About half the time, I would just confirm the username with the client, and they were using the wrong username!
That's what I thought initially when I received the text, but when I logged into my account, it showed the last login as this morning.
User avatar
ResearchMed
Posts: 16795
Joined: Fri Dec 26, 2008 10:25 pm

Re: Mysterious Vanguard Security Code

Post by ResearchMed »

Lynn1987 wrote:
DrChronzworth wrote:I would encourage you to change your password, but most of the times this happens, it's merely someone who has a similar username to you and is putting in the username wrong.

I used to work in customer service, and I probably had at least one call a day where someone would call in saying they had locked themselves out of their account and were quite mad their website access wasn't working. About half the time, I would just confirm the username with the client, and they were using the wrong username!
That's what I thought initially when I received the text, but when I logged into my account, it showed the last login as this morning.
Was that an actual login, or a login attempt?

We do not have this system (2-stage) set up at Vanguard, but we do have it for banking.
There, the "texted code" is sent (if one clicks to do so) after entering the UserID, but then the password prompt does not appear until after the secret code is entered.

So... if someone entered our UserID in error (perhaps similar to theirs, or just a typo), then they'd click "yes" to receive the code, but it would come to us, not them.
Presumably they'd wait, and then repeat the process, hopefully typing in the UserID correctly.

In such a case, there was NOT any actual login to our account.

Could this be occurring at Vanguard?

RM
This signature is a placebo. You are in the control group.
Geologist
Posts: 3056
Joined: Fri Jan 02, 2009 6:35 pm

Re: Mysterious Vanguard Security Code

Post by Geologist »

You might want to experiment with logging into your Vanguard account, but typing the password incorrectly. Then log in correctly a few minutes later and see what it says for "last login." I don't know what Vanguard shows, but one of my credit cards did show my failed login attempt (because I typed the password wrong) a couple of minutes before as the "last login" when I did login. If Vanguard does the same thing, then you could have what earlier posters suggested, someone with a similar logon name entering that wrong.

Mind you, there would be nothing wrong with calling Vanguard tomorrow.
jerryk68
Posts: 269
Joined: Wed Jan 22, 2014 6:56 pm

Re: Mysterious Vanguard Security Code

Post by jerryk68 »

Consider Vanguard's two-factor authentication. You type in your user name, they send you a text number to your cell phone that you enter and that gets you to the password logon screen. It's added steps but there are no virus worries. I do it everytime I check my account. Love it.

https://personal.vanguard.com/us/insigh ... ity-122014
User avatar
ResearchMed
Posts: 16795
Joined: Fri Dec 26, 2008 10:25 pm

Re: Mysterious Vanguard Security Code

Post by ResearchMed »

jerryk68 wrote:Consider Vanguard's two-factor authentication. You type in your user name, they send you a text number to your cell phone that you enter and that gets you to the password logon screen. It's added steps but there are no virus worries. I do it everytime I check my account. Love it.

https://personal.vanguard.com/us/insigh ... ity-122014
I think that is exactly what OP is using.

If so, then the system "worked", and it almost (?) doesn't matter if it was a typo in the UserID or an attempted hack.
The security code got texted to OP, and the "intruder" could get no further.

That's what it sounds like...

RM
This signature is a placebo. You are in the control group.
Topic Author
Lynn1987
Posts: 143
Joined: Tue Jun 18, 2013 9:00 pm

Re: Mysterious Vanguard Security Code

Post by Lynn1987 »

Geologist wrote:You might want to experiment with logging into your Vanguard account, but typing the password incorrectly. Then log in correctly a few minutes later and see what it says for "last login." I don't know what Vanguard shows, but one of my credit cards did show my failed login attempt (because I typed the password wrong) a couple of minutes before as the "last login" when I did login. If Vanguard does the same thing, then you could have what earlier posters suggested, someone with a similar logon name entering that wrong.
I tried entering my username, which prompted a security text to my phone. I did not go any further, as that would simulate what would happen if someone typed in my user name (they would not have access to my phone). I waited 14 minutes (the security code is supposed to be good for 10 minutes), then cancelled that log-in, closed the browser, and tried logging in from there. It now doesn't even have a last login - it's just blank beside it. But the wording is "Last Logon"...not "Last Logon Attempt"....
User avatar
ResearchMed
Posts: 16795
Joined: Fri Dec 26, 2008 10:25 pm

Re: Mysterious Vanguard Security Code

Post by ResearchMed »

Lynn1987 wrote:
Geologist wrote:You might want to experiment with logging into your Vanguard account, but typing the password incorrectly. Then log in correctly a few minutes later and see what it says for "last login." I don't know what Vanguard shows, but one of my credit cards did show my failed login attempt (because I typed the password wrong) a couple of minutes before as the "last login" when I did login. If Vanguard does the same thing, then you could have what earlier posters suggested, someone with a similar logon name entering that wrong.
I tried entering my username, which prompted a security text to my phone. I did not go any further, as that would simulate what would happen if someone typed in my user name (they would not have access to my phone). I waited 14 minutes (the security code is supposed to be good for 10 minutes), then cancelled that log-in, closed the browser, and tried logging in from there. It now doesn't even have a last login - it's just blank beside it. But the wording is "Last Logon"...not "Last Logon Attempt"....
It's not what it is "called", it's what happened.
It does not seem that anyone else was actually able to complete a login and get into your account.

If the password can only be entered AFTER entering the security code, then, as mentioned, the system "worked".

The other person could not actually "log in" (unless she/he could see your phone, etc.).

This is precisely why those texted security codes are so useful.
No one else can start guessing at passwords, as no one else can get to the "enter password" prompt.

If that is what happened, then it's no doubt someone else mis-typing own UserID (and entering yours in error).

Again, it sounds like the system *worked*.

Is there something else amiss?

RM
This signature is a placebo. You are in the control group.
xenial
Posts: 2876
Joined: Tue Feb 27, 2007 12:36 am
Location: USA

Re: Mysterious Vanguard Security Code

Post by xenial »

Lynn, do you by any chance use aggregation software, like Mint? The software logging in might account for what you saw.
Topic Author
Lynn1987
Posts: 143
Joined: Tue Jun 18, 2013 9:00 pm

Re: Mysterious Vanguard Security Code

Post by Lynn1987 »

Ken Schwartz wrote:Lynn, do you by any chance use aggregation software, like Mint? The software logging in might account for what you saw.


Yes, I do use Mint, so maybe that's it. It still seems odd though, because I've used the text code since shortly after it was offered and don't remember this happening before. Hopefully I can get an answer when I call tomorrow.
User avatar
whaleknives
Posts: 1238
Joined: Sun Jun 24, 2012 7:19 pm

Re: Mysterious Vanguard Security Code

Post by whaleknives »

Lynn1987 wrote:
Ken Schwartz wrote:Lynn, do you by any chance use aggregation software, like Mint? The software logging in might account for what you saw.
Yes, I do use Mint, so maybe that's it. It still seems odd though, because I've used the text code since shortly after it was offered and don't remember this happening before. Hopefully I can get an answer when I call tomorrow.
My experience has been that enabling the two-step security code login prevented both Mint and Quicken downloads from Vanguard. Was Mint working for you with the security code?
"I'm an indexer. I own the market. And I'm happy." (John Bogle, "BusinessWeek", 8/17/07) ☕ Maritime signal flag W - Whiskey: "I require medical assistance."
User avatar
zaboomafoozarg
Posts: 2431
Joined: Sun Jun 12, 2011 12:34 pm

Re: Mysterious Vanguard Security Code

Post by zaboomafoozarg »

Lynn1987 wrote:Yes, I do use Mint, so maybe that's it.
Most likely it is. As soon as I turned on Vanguard's two-factor auth, I started getting texts from Vanguard every few days. It was Mint trying to log in. Eventually I got tired of it and turned two-factor off.

I guess when push comes to shove, I like convenience more than security :oops:
Topic Author
Lynn1987
Posts: 143
Joined: Tue Jun 18, 2013 9:00 pm

Re: Mysterious Vanguard Security Code

Post by Lynn1987 »

whaleknives wrote:
Lynn1987 wrote:
Ken Schwartz wrote:Lynn, do you by any chance use aggregation software, like Mint? The software logging in might account for what you saw.
Yes, I do use Mint, so maybe that's it. It still seems odd though, because I've used the text code since shortly after it was offered and don't remember this happening before. Hopefully I can get an answer when I call tomorrow.
My experience has been that enabling the two-step security code login prevented both Mint and Quicken downloads from Vanguard. Was Mint working for you with the security code?
I think the mystery may be solved. Vanguard does show up on my Mint; however, I have agent authorization on my husband's account and I think that's where it pulls from. I just set up the security text for his account a couple of days ago, so I'm thinking when Mint tried to update, the security text was sent. Sorry - I had forgotten about doing that - I rarely log into his account, since his info shows up when I log into mine. Still going to call tomorrow to be sure. Sincere thanks to everyone who tried to help!
User avatar
BolderBoy
Posts: 6753
Joined: Wed Apr 07, 2010 12:16 pm
Location: Colorado

Re: Mysterious Vanguard Security Code

Post by BolderBoy »

Just FYI -

If you use a password manager, VG's site allows for usernames that are random sequences of letters and numbers - something that a password generator can generate. With a randomly generated, long username and a randomly generated, long password the chances of someone accidentally logging into your account exceeds all the grains of sand on the planet.
drwtsn32
Posts: 127
Joined: Wed Dec 31, 2014 11:28 am

Re: Mysterious Vanguard Security Code

Post by drwtsn32 »

Yeah I was going to ask if you used an aggregator like Mint or Personal Capital. Those services 'log in' to your account regularly when they update.
User avatar
Munir
Posts: 3200
Joined: Mon Feb 26, 2007 3:39 pm
Location: Oregon

Re: Mysterious Vanguard Security Code

Post by Munir »

Has anyone had their Vanguard account hacked or heard of others being hacked? How common is this hacking- if it is occurring?
Post Reply