2 factor authentication - What if something happens to you?

Non-investing personal finance issues including insurance, credit, real estate, taxes, employment and legal issues such as trusts and wills
Sunsolar
Posts: 24
Joined: Tue Jan 19, 2016 11:27 pm

2 factor authentication - What if something happens to you?

Post by Sunsolar » Mon Oct 09, 2017 9:52 pm

With all of the security risks and advent of 2FA, have y'all thought about contingencies in case something happens to you and your significant other needs to access your accounts, etc? If you go missing with your cell phone, isn't your SO, SOL?

jebmke
Posts: 7005
Joined: Thu Apr 05, 2007 2:44 pm

Re: 2 factor authentication - What if something happens to you?

Post by jebmke » Mon Oct 09, 2017 10:35 pm

Sunsolar wrote:
Mon Oct 09, 2017 9:52 pm
With all of the security risks and advent of 2FA, have y'all thought about contingencies in case something happens to you and your significant other needs to access your accounts, etc? If you go missing with your cell phone, isn't your SO, SOL?
My spouse has her own online accounts. She isn't authorized to trade on my individual account anyway. For her to use my online account would be a violation of the VG account policy. For the joint accounts she has a separate log in.
When you discover that you are riding a dead horse, the best strategy is to dismount.

User avatar
bogleblitz
Posts: 409
Joined: Mon Oct 01, 2012 2:51 pm

Re: 2 factor authentication - What if something happens to you?

Post by bogleblitz » Mon Oct 09, 2017 10:47 pm

If I die, then my spouse gets all the money from my vanguard account. She does not need to use 2 factor authentication. My spouse needs to provide vanguard with my death certificate.

If I go missing, my spouse does not need to touch my vanguard account. Buy and hold forever until I die.

blueman457
Posts: 270
Joined: Sun Jul 26, 2015 12:19 pm

Re: 2 factor authentication - What if something happens to you?

Post by blueman457 » Mon Oct 09, 2017 10:50 pm

She probably shouldn't be using your login to access accounts. And for financial accounts, protocols exist (usually involve a death certificate and some forms) to give beneficiaries access. If you want to give her access to your email.... that may be a different story.

Blue Man

User avatar
FrugalInvestor
Posts: 4495
Joined: Fri Nov 07, 2008 12:20 am

Re: 2 factor authentication - What if something happens to you?

Post by FrugalInvestor » Mon Oct 09, 2017 11:06 pm

I have signed the necessary paperwork with Vanguard which allows me to manage my wife's accounts using my login and for her to manage my accounts using her login. The only account we couldn't do this with was our granddaughter's 529 (which is in my name) so I signed a POA for my wife should she need it. The POA is on file with Vanguard.
IGNORE the noise! | Our life is frittered away by detail... simplify, simplify. - Henry David Thoreau

rrppve
Posts: 832
Joined: Sun Aug 12, 2012 12:35 am

Re: 2 factor authentication - What if something happens to you?

Post by rrppve » Tue Oct 10, 2017 1:01 am

With most 2FA systems, you can print out a set of backup codes to provide access. That's what I have stashed away in case my device is unavailable. Could put in a safe place for your SO in case something happens.

User avatar
BolderBoy
Posts: 3461
Joined: Wed Apr 07, 2010 12:16 pm
Location: Colorado

Re: 2 factor authentication - What if something happens to you?

Post by BolderBoy » Tue Oct 10, 2017 12:08 pm

Sunsolar wrote:
Mon Oct 09, 2017 9:52 pm
With all of the security risks and advent of 2FA, have y'all thought about contingencies in case something happens to you and your significant other needs to access your accounts, etc? If you go missing with your cell phone, isn't your SO, SOL?
My buddy just added a Yubikey to his VG account for 2FA. His wife knows about it and how to use it, too.
"Never underestimate one's capacity to overestimate one's abilities" - The Dunning-Kruger Effect

2015
Posts: 976
Joined: Mon Feb 10, 2014 2:32 pm

Re: 2 factor authentication - What if something happens to you?

Post by 2015 » Tue Oct 10, 2017 12:25 pm

I have an extensive "death book" entitled "Everything You Need To Know To Handle My Estate" in excel which contains all the information my executor will ever need to quickly and efficiently handle my estate (including access to PW, backup access information, and a whole lot of other details). The excel workbook is stored digitally via 5 diversified storage devices, both at home and off site. I modeled it on the downloadable excel workbook on this site:

http://www.erikdewey.com/bigbook.htm

User avatar
DaftInvestor
Posts: 3220
Joined: Wed Feb 19, 2014 10:11 am

Re: 2 factor authentication - What if something happens to you?

Post by DaftInvestor » Tue Oct 10, 2017 12:28 pm

All our bank and taxable-investment accounts are joint so we both have our own access.
The only exception are retirement accounts which would go through a process in case of death anyway.

ztn
Posts: 27
Joined: Sat Mar 25, 2017 9:13 pm

Re: 2 factor authentication - What if something happens to you?

Post by ztn » Tue Oct 10, 2017 1:36 pm

2015 wrote:
Tue Oct 10, 2017 12:25 pm
I have an extensive "death book" entitled "Everything You Need To Know To Handle My Estate" in excel which contains all the information my executor will ever need to quickly and efficiently handle my estate (including access to PW, backup access information, and a whole lot of other details). The excel workbook is stored digitally via 5 diversified storage devices, both at home and off site. I modeled it on the downloadable excel workbook on this site:

http://www.erikdewey.com/bigbook.htm
This! I have a folder entitled "Information for the Estate of Ztn". My executor has been shown where it is located. In the event of a fire or disaster, my executor knows who my lawyer is and my lawyer has copies of the will and estate info document.

jalbert
Posts: 2288
Joined: Fri Apr 10, 2015 12:29 am

Re: 2 factor authentication - What if something happens to you?

Post by jalbert » Tue Oct 10, 2017 1:59 pm

BolderBoy wrote:
Tue Oct 10, 2017 12:08 pm
Sunsolar wrote:
Mon Oct 09, 2017 9:52 pm
With all of the security risks and advent of 2FA, have y'all thought about contingencies in case something happens to you and your significant other needs to access your accounts, etc? If you go missing with your cell phone, isn't your SO, SOL?
My buddy just added a Yubikey to his VG account for 2FA. His wife knows about it and how to use it, too.
This is not a good idea. Vanguard's policy, that you agree to when creating an online account, is that if an online user shares their password or other authentication credentials with another person, then Vanguard assumes
no liability if the account is compromised. This is a reasonable and appropriate policy.

The correct way to deal with the matter is for the other person to have their own login to the account or other access (e.g. phone access). If the other person is not a joint owner of the account, then a power of attorney for the other person, at least for the account or for Vanguard, is also needed.
Risk is not a guarantor of return.

User avatar
VictoriaF
Posts: 17578
Joined: Tue Feb 27, 2007 7:27 am
Location: Black Swan Lake

Re: 2 factor authentication - What if something happens to you?

Post by VictoriaF » Tue Oct 10, 2017 2:07 pm

If you have one child, let her inherit all your factors.
If you have two children, give one factor to each.
If you have three or more children, allocate factors according to rock-paper-scissors.

Victoria
WINNER of the 2015 Boglehead Contest. | Every joke has a bit of a joke. ... The rest is the truth. (Marat F)

2015
Posts: 976
Joined: Mon Feb 10, 2014 2:32 pm

Re: 2 factor authentication - What if something happens to you?

Post by 2015 » Tue Oct 10, 2017 6:19 pm

jalbert wrote:
Tue Oct 10, 2017 1:59 pm
BolderBoy wrote:
Tue Oct 10, 2017 12:08 pm
Sunsolar wrote:
Mon Oct 09, 2017 9:52 pm
With all of the security risks and advent of 2FA, have y'all thought about contingencies in case something happens to you and your significant other needs to access your accounts, etc? If you go missing with your cell phone, isn't your SO, SOL?
My buddy just added a Yubikey to his VG account for 2FA. His wife knows about it and how to use it, too.
This is not a good idea. Vanguard's policy, that you agree to when creating an online account, is that if an online user shares their password or other authentication credentials with another person, then Vanguard assumes
no liability if the account is compromised. This is a reasonable and appropriate policy.

The correct way to deal with the matter is for the other person to have their own login to the account or other access (e.g. phone access). If the other person is not a joint owner of the account, then a power of attorney for the other person, at least for the account or for Vanguard, is also needed.
I am interpreting VG's policy to mean if one's account is compromised by the individual(s) the online access information is shared with (otherwise, how could one engage in effective estate planning?). If the wife of Boulderboy's buddy's is going to compromise his buddy's account, his friend has even bigger problems, like wondering if he should have the dog test her cooking before he eats it!

jalbert
Posts: 2288
Joined: Fri Apr 10, 2015 12:29 am

Re: 2 factor authentication - What if something happens to you?

Post by jalbert » Tue Oct 10, 2017 7:54 pm

I am interpreting VG's policy to mean if one's account is compromised by the individual(s) the online access information is shared with (otherwise, how could one engage in effective estate planning?). If the wife of Boulderboy's buddy's is going to compromise his buddy's account, his friend has even bigger problems, like wondering if he should have the dog test her cooking before he eats it!
My interpretation of the policy is that if a Vanguard customer shares their login credentials with any other person, including a spouse or other family member, then Vanguard has no liability if the account is compromised by anyone, even if neither the password sharing nor the person with whom shared had anything to do with the compromise,

Issues arising from incapacity or death of an account holder are addressed with having an account held jointly with right of survivorship, beneficiary declarations, or execution of wills after the death of an account holder, and with holding an account jointly or with power of attorney assignments before the death of an account holder.
Risk is not a guarantor of return.

User avatar
FIREchief
Posts: 1415
Joined: Fri Aug 19, 2016 6:40 pm

Re: 2 factor authentication - What if something happens to you?

Post by FIREchief » Tue Oct 10, 2017 8:08 pm

2015 wrote:
Tue Oct 10, 2017 6:19 pm
I am interpreting VG's policy to mean if one's account is compromised by the individual(s) the online access information is shared with (otherwise, how could one engage in effective estate planning?). If the wife of Boulderboy's buddy's is going to compromise his buddy's account, his friend has even bigger problems, like wondering if he should have the dog test her cooking before he eats it!
I think this is a dangerous interpretation / assumption. Consider the following:

Joe and Jane are happily married (at least Joe thinks so and so do family/friends). The truth is that Jane despises Joe and can't wait to go back to her high school sweetheart Jeff with as much of Joe's money as possible. Jeff isn't successful in much, but he is really good at stealing stuff. Jane slips him Joe's username and password and they go to work.....

VG: so Joe, sorry you lost $200,000. Did you share your username and password with anybody?
Joe: only my dear wife Jane, but we have a very happy marriage and she doesn't even understand computers.
VG: sorry, you're out $200K. Here's a copy of our security policy with a highlighted section where "nobody" really does mean "nobody."

I'm not sure I understand your point about estate planning. Due process will be particularly important to me when I'm sitting on a cloud watching my heirs receive their inheritances.
I am not a lawyer, accountant or financial advisor. Any advice or suggestions that I may provide shall be considered for entertainment purposes only.

jalbert
Posts: 2288
Joined: Fri Apr 10, 2015 12:29 am

Re: 2 factor authentication - What if something happens to you?

Post by jalbert » Tue Oct 10, 2017 10:27 pm

The principle is that authority and privilege enabled by account credentials should align with legal authority and privileges based on account title, estate executors, and power of attorneys.

Vanguard is legally responsible to provide access and account privileges based on legal authority, and they are acting reasonably and rationally to insist that online account credentials are not used to get around what is legally allowed.

If someone is trusted enough to have a password, they are trusted enough to be named on title of the account, named as a power of attorney, or named as executor of an estate, and should be so named if that is what is desired.
Risk is not a guarantor of return.

User avatar
FIREchief
Posts: 1415
Joined: Fri Aug 19, 2016 6:40 pm

Re: 2 factor authentication - What if something happens to you?

Post by FIREchief » Tue Oct 10, 2017 10:43 pm

jalbert wrote:
Tue Oct 10, 2017 10:27 pm
The principle is that authority and privilege enabled by account credentials should align with legal authority and privileges based on account title, estate executors, and power of attorneys.

Vanguard is legally responsible to provide access and account privileges based on legal authority, and they are acting reasonably and rationally to insist that online account credentials are not used to get around what is legally allowed.

If someone is trusted enough to have a password, they are trusted enough to be named on title of the account, named as a power of attorney, or named as executor of an estate, and should be so named if that is what is desired.
+1 I will also add/clarify that I'm not trying to be "right" about this. I'm trying to help readers to understand that sharing their username and password with their spouse, trusted advisor, #1 son/daughter, the Pope, etc. is absolutely not acceptable. There are clear responsible/legal avenues for providing account access to others both before and after death (see jalbert's post), but sharing logon credentials is not among them. Stop it!!! 8-)
I am not a lawyer, accountant or financial advisor. Any advice or suggestions that I may provide shall be considered for entertainment purposes only.

aqan
Posts: 272
Joined: Fri Nov 06, 2015 7:07 am

Re: 2 factor authentication - What if something happens to you?

Post by aqan » Tue Oct 10, 2017 10:54 pm

2015 wrote:
Tue Oct 10, 2017 12:25 pm
I have an extensive "death book" entitled "Everything You Need To Know To Handle My Estate" in excel which contains all the information my executor will ever need to quickly and efficiently handle my estate (including access to PW, backup access information, and a whole lot of other details). The excel workbook is stored digitally via 5 diversified storage devices, both at home and off site. I modeled it on the downloadable excel workbook on this site:

http://www.erikdewey.com/bigbook.htm
wow.. I can really store my life history here.
how do you protect it? excel password or save as encrypted file? if this falls into wrong hands it can do some serious damage.

jalbert
Posts: 2288
Joined: Fri Apr 10, 2015 12:29 am

Re: 2 factor authentication - What if something happens to you?

Post by jalbert » Tue Oct 10, 2017 11:04 pm

A second principle is that account access should be auditable. Any login should be traceable to precisely one individual.
Risk is not a guarantor of return.

2015
Posts: 976
Joined: Mon Feb 10, 2014 2:32 pm

Re: 2 factor authentication - What if something happens to you?

Post by 2015 » Wed Oct 11, 2017 1:46 pm

aqan wrote:
Tue Oct 10, 2017 10:54 pm
2015 wrote:
Tue Oct 10, 2017 12:25 pm
I have an extensive "death book" entitled "Everything You Need To Know To Handle My Estate" in excel which contains all the information my executor will ever need to quickly and efficiently handle my estate (including access to PW, backup access information, and a whole lot of other details). The excel workbook is stored digitally via 5 diversified storage devices, both at home and off site. I modeled it on the downloadable excel workbook on this site:

http://www.erikdewey.com/bigbook.htm
wow.. I can really store my life history here.
how do you protect it? excel password or save as encrypted file? if this falls into wrong hands it can do some serious damage.
This is why I have it and all other important data stored behind encryption on two identical thumb drives at home (one in a fireproof safe, one elsewhere), along with an encrypted external hard drive, along with two similarly identical unencrypted thumb drives and one DVD in my safe deposit box. I may at some point change my mind and encrypt all the data in my SDB, but that may just be overkill. I don't know. I vacillate. Will probably end up encrypting everything in the SDB at some point. Right now I'm on the whole Yubikey train, in the process of changing my dedicated financial transactions email over to gmail, and it's going to be a bit of a...project.

As I've stated before, my laptop stores virtually no personally identifiable information. It's the dedicated device for all financial transactions (you'll never catch me accessing anything over a phone!), and all accessing is done in Avast banking mode, whose browsing session vanishes as if it never happened after session end. If the laptop is stolen, thieves will get a used laptop, no more. If they should want a couple of randomly placed used thumb drives or external HD, they get encrypted devices. Same goes if there is a fire.

Additionally, I can take just 10 items in less than 30 seconds with me if there's an emergency and start my life over anywhere, due to the external duplicate data storage.

2015
Posts: 976
Joined: Mon Feb 10, 2014 2:32 pm

Re: 2 factor authentication - What if something happens to you?

Post by 2015 » Wed Oct 11, 2017 1:58 pm

FIREchief wrote:
Tue Oct 10, 2017 10:43 pm
jalbert wrote:
Tue Oct 10, 2017 10:27 pm
The principle is that authority and privilege enabled by account credentials should align with legal authority and privileges based on account title, estate executors, and power of attorneys.

Vanguard is legally responsible to provide access and account privileges based on legal authority, and they are acting reasonably and rationally to insist that online account credentials are not used to get around what is legally allowed.

If someone is trusted enough to have a password, they are trusted enough to be named on title of the account, named as a power of attorney, or named as executor of an estate, and should be so named if that is what is desired.
+1 I will also add/clarify that I'm not trying to be "right" about this. I'm trying to help readers to understand that sharing their username and password with their spouse, trusted advisor, #1 son/daughter, the Pope, etc. is absolutely not acceptable. There are clear responsible/legal avenues for providing account access to others both before and after death (see jalbert's post), but sharing logon credentials is not among them. Stop it!!! 8-)
In your example, I can see how Joe would be "out of luck" (then again, if the guy doesn't know that Jane in reality despises him, well...). OTOH, isn't it common practice for married individuals to share access? What about joint accounts? If Jane secretly despises Joe after all those years, then I can see how he's out of luck here again (but so is she, because he'd probably kill her!).

So is your interpretation that an estate executor does not need access credentials, that a POA will simply suffice? What are the "clear responsible/legal" avenues you are referencing? I'm interested because I hadn't thought of it from this perspective, and your insight would be helpful.

User avatar
MrGreen
Posts: 15
Joined: Sun Jan 04, 2015 10:31 am
Location: California

Re: 2 factor authentication - What if something happens to you?

Post by MrGreen » Wed Oct 11, 2017 2:22 pm

2015 wrote:
Wed Oct 11, 2017 1:58 pm
FIREchief wrote:
Tue Oct 10, 2017 10:43 pm
jalbert wrote:
Tue Oct 10, 2017 10:27 pm
The principle is that authority and privilege enabled by account credentials should align with legal authority and privileges based on account title, estate executors, and power of attorneys.

Vanguard is legally responsible to provide access and account privileges based on legal authority, and they are acting reasonably and rationally to insist that online account credentials are not used to get around what is legally allowed.

If someone is trusted enough to have a password, they are trusted enough to be named on title of the account, named as a power of attorney, or named as executor of an estate, and should be so named if that is what is desired.
+1 I will also add/clarify that I'm not trying to be "right" about this. I'm trying to help readers to understand that sharing their username and password with their spouse, trusted advisor, #1 son/daughter, the Pope, etc. is absolutely not acceptable. There are clear responsible/legal avenues for providing account access to others both before and after death (see jalbert's post), but sharing logon credentials is not among them. Stop it!!! 8-)
In your example, I can see how Joe would be "out of luck" (then again, if the guy doesn't know that Jane in reality despises him, well...). OTOH, isn't it common practice for married individuals to share access? What about joint accounts? If Jane secretly despises Joe after all those years, then I can see how he's out of luck here again (but so is she, because he'd probably kill her!).

So is your interpretation that an estate executor does not need access credentials, that a POA will simply suffice? What are the "clear responsible/legal" avenues you are referencing? I'm interested because I hadn't thought of it from this perspective, and your insight would be helpful.
It’s been my experience that after someone dies, account access is no longer possible by anyone. The financial institution then divides the account among the beneficiaries. I assume jointly held accounts, or accounts benefiting the estate, are probably handled differently but it would not be using old login names and passwords of the deceased person.

jebmke
Posts: 7005
Joined: Thu Apr 05, 2007 2:44 pm

Re: 2 factor authentication - What if something happens to you?

Post by jebmke » Wed Oct 11, 2017 2:31 pm

When my BIL died, my wife sent the paperwork from the court designating her the executor of the estate to Vanguard. They re-titled his account to the estate and then they hooked this account to her Vanguard log in.
When you discover that you are riding a dead horse, the best strategy is to dismount.

User avatar
Toons
Posts: 12104
Joined: Fri Nov 21, 2008 10:20 am
Location: Hills of Tennessee

Re: 2 factor authentication - What if something happens to you?

Post by Toons » Wed Oct 11, 2017 2:34 pm

Sunsolar wrote:
Mon Oct 09, 2017 9:52 pm
With all of the security risks and advent of 2FA, have y'all thought about contingencies in case something happens to you and your significant other needs to access your accounts, etc? If you go missing with your cell phone, isn't your SO, SOL?


All of my info is shared with spouse,,,,passwords,email,accounts,,etc etc :happy
"One does not accumulate but eliminate. It is not daily increase but daily decrease. The height of cultivation always runs to simplicity" –Bruce Lee

User avatar
FIREchief
Posts: 1415
Joined: Fri Aug 19, 2016 6:40 pm

Re: 2 factor authentication - What if something happens to you?

Post by FIREchief » Wed Oct 11, 2017 2:46 pm

2015 wrote:
Wed Oct 11, 2017 1:58 pm
In your example, I can see how Joe would be "out of luck" (then again, if the guy doesn't know that Jane in reality despises him, well...). OTOH, isn't it common practice for married individuals to share access? What about joint accounts? If Jane secretly despises Joe after all those years, then I can see how he's out of luck here again (but so is she, because he'd probably kill her!).
I have no idea how common it is for married individuals to share their username and password with their spouse. We see enough comments on the forum to suggest that it does occur. If a person has both individual and joint accounts at a brokerage (which is very common), then in order to preserve the security of the individually owned accounts, each user can not share login credentials.
So is your interpretation that an estate executor does not need access credentials, that a POA will simply suffice? What are the "clear responsible/legal" avenues you are referencing? I'm interested because I hadn't thought of it from this perspective, and your insight would be helpful.
To clarify, POA ends when a person dies so it has nothing to do with estate administration. I believe an estate executor would need to present their court issued letters of office to an account custodian to take control of the account. This might involve transferring the assets to an estate owned account, or maybe the existing account ownership could be transferred to the estate (I know nothing about this because I have never served as executor and would likely decline any such future nomination). If the executor were to use the decedent's login directly it might be considered fraud. If the estate does not require probate, some states allow assets to be claimed via affidavit by a person who is administering the estate.

None of the above applies if the account(s) have named beneficiaries. In that case, I believe that a named beneficiary just needs to provide a death certificate to the custodian to claim their inheritance. An executor might help this process (by providing account information to the beneficiaries), but I don't believe they have any formal role. In this scenario, if the executor used the decedent's credentials to access an account with a named beneficiary, things could really get "dicey."

I believe that it is much simpler if a decedent's accounts were owned by a trust. In that case, there is no immediate change of ownership, and the successor trustee just needs to provide acceptable evidence to the custodian to prove that they are now the trustee.

Please see my signature, as I am not an expert in any of this (but I have tried to understand these issues for my own planning purposes).
I am not a lawyer, accountant or financial advisor. Any advice or suggestions that I may provide shall be considered for entertainment purposes only.

Cheyenne
Posts: 277
Joined: Sun Jun 14, 2015 6:46 am

Re: 2 factor authentication - What if something happens to you?

Post by Cheyenne » Wed Oct 11, 2017 2:55 pm

named on title of the account
DW and I each have separate IRAs at Vanguard in our individual names. If I were to log-in to my account and change the title to both of our names would that change legal ownership to both of us? I already have her listed as the beneficiary.

jebmke
Posts: 7005
Joined: Thu Apr 05, 2007 2:44 pm

Re: 2 factor authentication - What if something happens to you?

Post by jebmke » Wed Oct 11, 2017 3:03 pm

Cheyenne wrote:
Wed Oct 11, 2017 2:55 pm
named on title of the account
DW and I each have separate IRAs at Vanguard in our individual names. If I were to log-in to my account and change the title to both of our names would that change legal ownership to both of us? I already have her listed as the beneficiary.
You can't title an IRA in any name other than yours (until you die). The I in IRA is "Individual."
When you discover that you are riding a dead horse, the best strategy is to dismount.

jalbert
Posts: 2288
Joined: Fri Apr 10, 2015 12:29 am

Re: 2 factor authentication - What if something happens to you?

Post by jalbert » Wed Oct 11, 2017 8:43 pm

You can't title an IRA in any name other than yours (until you die). The I in IRA is "Individual."
You can grant power of attorney, typically using an institution's form instead of using a legal document activated by a court.
Risk is not a guarantor of return.

2015
Posts: 976
Joined: Mon Feb 10, 2014 2:32 pm

Re: 2 factor authentication - What if something happens to you?

Post by 2015 » Wed Oct 11, 2017 9:34 pm

FIREchief wrote:
Wed Oct 11, 2017 2:46 pm
2015 wrote:
Wed Oct 11, 2017 1:58 pm
In your example, I can see how Joe would be "out of luck" (then again, if the guy doesn't know that Jane in reality despises him, well...). OTOH, isn't it common practice for married individuals to share access? What about joint accounts? If Jane secretly despises Joe after all those years, then I can see how he's out of luck here again (but so is she, because he'd probably kill her!).
I have no idea how common it is for married individuals to share their username and password with their spouse. We see enough comments on the forum to suggest that it does occur. If a person has both individual and joint accounts at a brokerage (which is very common), then in order to preserve the security of the individually owned accounts, each user can not share login credentials.
So is your interpretation that an estate executor does not need access credentials, that a POA will simply suffice? What are the "clear responsible/legal" avenues you are referencing? I'm interested because I hadn't thought of it from this perspective, and your insight would be helpful.
To clarify, POA ends when a person dies so it has nothing to do with estate administration. I believe an estate executor would need to present their court issued letters of office to an account custodian to take control of the account. This might involve transferring the assets to an estate owned account, or maybe the existing account ownership could be transferred to the estate (I know nothing about this because I have never served as executor and would likely decline any such future nomination). If the executor were to use the decedent's login directly it might be considered fraud. If the estate does not require probate, some states allow assets to be claimed via affidavit by a person who is administering the estate.

None of the above applies if the account(s) have named beneficiaries. In that case, I believe that a named beneficiary just needs to provide a death certificate to the custodian to claim their inheritance. An executor might help this process (by providing account information to the beneficiaries), but I don't believe they have any formal role. In this scenario, if the executor used the decedent's credentials to access an account with a named beneficiary, things could really get "dicey."

I believe that it is much simpler if a decedent's accounts were owned by a trust. In that case, there is no immediate change of ownership, and the successor trustee just needs to provide acceptable evidence to the custodian to prove that they are now the trustee.

Please see my signature, as I am not an expert in any of this (but I have tried to understand these issues for my own planning purposes).
Right you are. Thanks for this. My father just finished serving as executor of an uncle's estate. I'm going to ask him how he accessed the uncle's accounts. I don't know why, but I never looked at estate planning in this fashion, even though I have a trust which gives my executor broad powers!

Actually, I will be doing estate planning for my mother in the next few months and will ask the attorney at that time. Not having others have access to one's account credentials does in fact seem to be a great way to avoid elder financial abuse.

2015
Posts: 976
Joined: Mon Feb 10, 2014 2:32 pm

Re: 2 factor authentication - What if something happens to you?

Post by 2015 » Wed Oct 11, 2017 9:36 pm

Toons wrote:
Wed Oct 11, 2017 2:34 pm
Sunsolar wrote:
Mon Oct 09, 2017 9:52 pm
With all of the security risks and advent of 2FA, have y'all thought about contingencies in case something happens to you and your significant other needs to access your accounts, etc? If you go missing with your cell phone, isn't your SO, SOL?


All of my info is shared with spouse,,,,passwords,email,accounts,,etc etc :happy
Per Firechief's example above, if her name is Jane, you may be in trouble... :shock:

2015
Posts: 976
Joined: Mon Feb 10, 2014 2:32 pm

Re: 2 factor authentication - What if something happens to you?

Post by 2015 » Wed Oct 11, 2017 9:37 pm

MrGreen, Jebmke, thanks for the responses. I'm going to look further into this. :beer

User avatar
FIREchief
Posts: 1415
Joined: Fri Aug 19, 2016 6:40 pm

Re: 2 factor authentication - What if something happens to you?

Post by FIREchief » Wed Oct 11, 2017 10:12 pm

2015 wrote:
Wed Oct 11, 2017 9:34 pm
I don't know why, but I never looked at estate planning in this fashion, even though I have a trust which gives my executor broad powers!
I'm guessing that your successor trustee and the person nominated as executor of your estate are the same person. Correct? (otherwise your comment would be problematic)
I am not a lawyer, accountant or financial advisor. Any advice or suggestions that I may provide shall be considered for entertainment purposes only.

2015
Posts: 976
Joined: Mon Feb 10, 2014 2:32 pm

Re: 2 factor authentication - What if something happens to you?

Post by 2015 » Wed Oct 11, 2017 10:45 pm

FIREchief wrote:
Wed Oct 11, 2017 10:12 pm
2015 wrote:
Wed Oct 11, 2017 9:34 pm
I don't know why, but I never looked at estate planning in this fashion, even though I have a trust which gives my executor broad powers!
I'm guessing that your successor trustee and the person nominated as executor of your estate are the same person. Correct? (otherwise your comment would be problematic)
Yes, they are. As it's set up now, my executor could have accounts credentials access, although I see from the posts above this is not only the best practice, but unnecessary (e.g., VG disables account access upon account holder death). Unlike "Joe" in your example, my executor doesn't secretly despise me, but from a SWAN perspective, I prefer my credentials be known only to me. Thanks again for pointing this all out.

jalbert
Posts: 2288
Joined: Fri Apr 10, 2015 12:29 am

Re: 2 factor authentication - What if something happens to you?

Post by jalbert » Thu Oct 12, 2017 1:53 am

An executor, POA, or joint account holder can access an account for which they are legally authorized. They need to have their own separate login name and password for online access, and their online account will be able to access the investment account if they are legally authorized to access the investment account.
Risk is not a guarantor of return.

User avatar
kramer
Posts: 1561
Joined: Wed Feb 21, 2007 2:28 am
Location: Philippines

Re: 2 factor authentication - What if something happens to you?

Post by kramer » Thu Oct 12, 2017 5:42 am

Regarding two factor authentication, I won't set up anything related to texting due to international travel. I have had multiple friends locked out of their email accounts for this reason (Yahoo, if I recall) ... when they logged into their email in another country, the email demanded secondary authentication and they had set it up with texting (instead of, for example, another email account) ... but their sim card didn't work in the country they were traveling in (they had bought a local sim card). And they had not forgotten their password or anything like that.

I have another friend in Australia right now completely locked out of her Iphone because she can't remember her Apple password ... to get help retrieving it she has to get a text on her local sim card which doesn't work in Australia, even the pros there say they can't help her and she is sending her phone back with a friend.

Cheyenne
Posts: 277
Joined: Sun Jun 14, 2015 6:46 am

Re: 2 factor authentication - What if something happens to you?

Post by Cheyenne » Thu Oct 12, 2017 6:58 am

I have no idea how common it is for married individuals to share their username and password with their spouse. We see enough comments on the forum to suggest that it does occur. If a person has both individual and joint accounts at a brokerage (which is very common), then in order to preserve the security of the individually owned accounts, each user can not share login credentials.
My friend and his wife have separate accounts at Vanguard and I asked him about this last night. He said he manages them both from his login and said that she never gave him her login and password because she never had a login and password. She never accessed her account online. She just submitted the form to Vanguard granting him permission. I wonder if that's the same as sharing a user name and password.

jebmke
Posts: 7005
Joined: Thu Apr 05, 2007 2:44 pm

Re: 2 factor authentication - What if something happens to you?

Post by jebmke » Thu Oct 12, 2017 7:01 am

Cheyenne wrote:
Thu Oct 12, 2017 6:58 am
I have no idea how common it is for married individuals to share their username and password with their spouse. We see enough comments on the forum to suggest that it does occur. If a person has both individual and joint accounts at a brokerage (which is very common), then in order to preserve the security of the individually owned accounts, each user can not share login credentials.
My friend and his wife have separate accounts at Vanguard and I asked him about this last night. He said he manages them both from his login and said that she never gave him her login and password because she never had a login and password. She never accessed her account online. She just submitted the form to Vanguard granting him permission. I wonder if that's the same as sharing a user name and password.
I don't think so. She authorized Vanguard to hook her accounts to his log-in and give him the ability to trade. Just sharing a PW isn't an authorization to VG.
When you discover that you are riding a dead horse, the best strategy is to dismount.

User avatar
JaneyLH
Posts: 322
Joined: Wed Oct 16, 2013 7:16 pm

Re: 2 factor authentication - What if something happens to you?

Post by JaneyLH » Thu Oct 12, 2017 11:42 am

My question is, if you disclose your login information to your spouse how would Vanguard know? It seems someone would have to tell Vanguard they had done this. If I had a theft of my Vanguard funds and were asked by Vanguard if I had shared my password with anyone, surely my answer would be “no”. Am I missing something here?

jalbert
Posts: 2288
Joined: Fri Apr 10, 2015 12:29 am

Re: 2 factor authentication - What if something happens to you?

Post by jalbert » Thu Oct 12, 2017 1:05 pm

JaneyLH wrote:
Thu Oct 12, 2017 11:42 am
My question is, if you disclose your login information to your spouse how would Vanguard know? It seems someone would have to tell Vanguard they had done this. If I had a theft of my Vanguard funds and were asked by Vanguard if I had shared my password with anyone, surely my answer would be “no”. Am I missing something here?
You may be missing that you will be giving that answer in a signed affidavit wherein you also agree to the consequences of misrepresenting any information, and also that logs of system access and logins on Vanguard systems will be analyzed after an online malfeasance.
Risk is not a guarantor of return.

wrongfunds
Posts: 921
Joined: Tue Dec 21, 2010 3:55 pm

Re: 2 factor authentication - What if something happens to you?

Post by wrongfunds » Thu Oct 12, 2017 1:20 pm

RE:
The so called encrypted excel file with your "life" on it.
Who else has the password to decrypt it? Do you encrypt that password and save it somewhere safe? Is there another password to decrypt that password?

Or is this information written down and in a sealed envelope only to be opened after death?

I am really having problem understanding how somebody avoids having to disclose the password.

2015
Posts: 976
Joined: Mon Feb 10, 2014 2:32 pm

Re: 2 factor authentication - What if something happens to you?

Post by 2015 » Thu Oct 12, 2017 8:04 pm

MrGreen wrote:
Wed Oct 11, 2017 2:22 pm
2015 wrote:
Wed Oct 11, 2017 1:58 pm
FIREchief wrote:
Tue Oct 10, 2017 10:43 pm
jalbert wrote:
Tue Oct 10, 2017 10:27 pm
The principle is that authority and privilege enabled by account credentials should align with legal authority and privileges based on account title, estate executors, and power of attorneys.

Vanguard is legally responsible to provide access and account privileges based on legal authority, and they are acting reasonably and rationally to insist that online account credentials are not used to get around what is legally allowed.

If someone is trusted enough to have a password, they are trusted enough to be named on title of the account, named as a power of attorney, or named as executor of an estate, and should be so named if that is what is desired.
+1 I will also add/clarify that I'm not trying to be "right" about this. I'm trying to help readers to understand that sharing their username and password with their spouse, trusted advisor, #1 son/daughter, the Pope, etc. is absolutely not acceptable. There are clear responsible/legal avenues for providing account access to others both before and after death (see jalbert's post), but sharing logon credentials is not among them. Stop it!!! 8-)
In your example, I can see how Joe would be "out of luck" (then again, if the guy doesn't know that Jane in reality despises him, well...). OTOH, isn't it common practice for married individuals to share access? What about joint accounts? If Jane secretly despises Joe after all those years, then I can see how he's out of luck here again (but so is she, because he'd probably kill her!).

So is your interpretation that an estate executor does not need access credentials, that a POA will simply suffice? What are the "clear responsible/legal" avenues you are referencing? I'm interested because I hadn't thought of it from this perspective, and your insight would be helpful.
It’s been my experience that after someone dies, account access is no longer possible by anyone. The financial institution then divides the account among the beneficiaries. I assume jointly held accounts, or accounts benefiting the estate, are probably handled differently but it would not be using old login names and passwords of the deceased person.
VG confirmed this today. Account is frozen once executor advises VG of a non-jointly held account holder's death. Executor then works with VG's Estate Planning department to provide appropriate documentation to gain access the account, which VG has retitled in the name of the estate.

Many thanks to Firechief. I have spent the last 24 hours revising my "death book" and have removed access to any account's login credentials. I have also verified that in California, under Probate Code Section 331, a financial institution must provide access to a deceased individual's safe deposit box, but only if the requesting individual can provide (a) a death certificate, and (b) has possession of the safe deposit box key.

jebmke
Posts: 7005
Joined: Thu Apr 05, 2007 2:44 pm

Re: 2 factor authentication - What if something happens to you?

Post by jebmke » Thu Oct 12, 2017 8:12 pm

2015 wrote:
Thu Oct 12, 2017 8:04 pm
VG confirmed this today. Account is frozen once executor advises VG of a non-jointly held account holder's death. Executor then works with VG's Estate Planning department to provide appropriate documentation to gain access the account, which VG has retitled in the name of the estate.
This was our experience in 2010 with my BIL's estate. In addition, VG hooked the account to my spouse's VG log-in so she could manage it without having to have a second log-in ID.
When you discover that you are riding a dead horse, the best strategy is to dismount.

2015
Posts: 976
Joined: Mon Feb 10, 2014 2:32 pm

Re: 2 factor authentication - What if something happens to you?

Post by 2015 » Thu Oct 12, 2017 8:16 pm

jebmke wrote:
Thu Oct 12, 2017 8:12 pm
2015 wrote:
Thu Oct 12, 2017 8:04 pm
VG confirmed this today. Account is frozen once executor advises VG of a non-jointly held account holder's death. Executor then works with VG's Estate Planning department to provide appropriate documentation to gain access the account, which VG has retitled in the name of the estate.
This was our experience in 2010 with my BIL's estate. In addition, VG hooked the account to my spouse's VG log-in so she could manage it without having to have a second log-in ID.
Thanks much to all of your for your contributions!

User avatar
celia
Posts: 7166
Joined: Sun Mar 09, 2008 6:32 am
Location: SoCal

Re: 2 factor authentication - What if something happens to you?

Post by celia » Thu Oct 12, 2017 8:35 pm

bogleblitz wrote:
Mon Oct 09, 2017 10:47 pm
If I die, then my spouse gets all the money from my vanguard account. She does not need to use 2 factor authentication. My spouse needs to provide vanguard with my death certificate.

If I go missing, my spouse does not need to touch my vanguard account. Buy and hold forever until I die.
+1

If something happens to me AND I can't speak, then someone will have to bring me my keyboard.

If something happens to me AND I can't speak AND I can't type, then someone will have to give me filled out forms to sign.

If something happens to me AND I can't speak AND I can't type, AND I can't sign my name, then I'm probably dead. :oops:

So, then they will send in my death certificate.

User avatar
celia
Posts: 7166
Joined: Sun Mar 09, 2008 6:32 am
Location: SoCal

Re: 2 factor authentication - What if something happens to you?

Post by celia » Thu Oct 12, 2017 8:54 pm

Cheyenne wrote:
Wed Oct 11, 2017 2:55 pm
DW and I each have separate IRAs at Vanguard in our individual names. If I were to log-in to my account and change the title to both of our names would that change legal ownership to both of us? I already have her listed as the beneficiary.
Customers don't have the ability to "edit" the title of the account. Only the custodian can do that. Actually, I don't think they can do it either, other than to fix a typo or correct something when the the account is set up wrong. They have to create a new account (with a new account number) according to the documents that are sent in, then transfer the assets to the new account. The history of each account has to be maintained and dividends and gains are credited to whoever is the account owner at the time they are distributed. If the accounts are owned by different people (different SSNs), the 1099s, -INT, -DIV statements have to be sent to the correct person who owned the asset at that time. They can't just create havoc and wipe out a name and SSN as if a different person had always owned the account. What do you think that would do to the taxpayers involved and the IRS?

"Dear Sir/Madam,
According to our records, you did not report the $XX,XXX income on account YYY-YYY that you have owned for ZZ years. Please amend your taxes and pay the appropriate tax before . . . "

jebmke
Posts: 7005
Joined: Thu Apr 05, 2007 2:44 pm

Re: 2 factor authentication - What if something happens to you?

Post by jebmke » Thu Oct 12, 2017 9:03 pm

2015 wrote:
Thu Oct 12, 2017 8:16 pm
jebmke wrote:
Thu Oct 12, 2017 8:12 pm
2015 wrote:
Thu Oct 12, 2017 8:04 pm
VG confirmed this today. Account is frozen once executor advises VG of a non-jointly held account holder's death. Executor then works with VG's Estate Planning department to provide appropriate documentation to gain access the account, which VG has retitled in the name of the estate.
This was our experience in 2010 with my BIL's estate. In addition, VG hooked the account to my spouse's VG log-in so she could manage it without having to have a second log-in ID.
Thanks much to all of your for your contributions!
Good to hear that VG confirmed that they still do this. I should have added, both my wife and the other surviving spouse have VG accounts and when it came time to distribute the assets in kind, it was seamless. The fund shares transferred from the estate account to their respective individual accounts overnight once the instructions were given to VG.
When you discover that you are riding a dead horse, the best strategy is to dismount.

User avatar
JaneyLH
Posts: 322
Joined: Wed Oct 16, 2013 7:16 pm

Re: 2 factor authentication - What if something happens to you?

Post by JaneyLH » Thu Oct 12, 2017 9:19 pm

jalbert wrote:
Thu Oct 12, 2017 1:05 pm
JaneyLH wrote:
Thu Oct 12, 2017 11:42 am
My question is, if you disclose your login information to your spouse how would Vanguard know? It seems someone would have to tell Vanguard they had done this. If I had a theft of my Vanguard funds and were asked by Vanguard if I had shared my password with anyone, surely my answer would be “no”. Am I missing something here?
You may be missing that you will be giving that answer in a signed affidavit wherein you also agree to the consequences of misrepresenting any information, and also that logs of system access and logins on Vanguard systems will be analyzed after an online malfeasance.
I still don't understand the risk of sharing my password with my spouse. What would the Vanguard logs of system access show? That my login and password were used some number of times by someone? How would Vanguard assert thast some times it was me and some times it was my spouse accessing the account?

boglesmind
Posts: 113
Joined: Sun Jan 05, 2014 1:07 pm

Re: 2 factor authentication - What if something happens to you?

Post by boglesmind » Thu Oct 12, 2017 9:53 pm

celia wrote:
Thu Oct 12, 2017 8:54 pm
Cheyenne wrote:
Wed Oct 11, 2017 2:55 pm
DW and I each have separate IRAs at Vanguard in our individual names. If I were to log-in to my account and change the title to both of our names would that change legal ownership to both of us? I already have her listed as the beneficiary.
Customers don't have the ability to "edit" the title of the account. Only the custodian can do that. Actually, I don't think they can do it either, other than to fix a typo or correct something when the the account is set up wrong. They have to create a new account (with a new account number) according to the documents that are sent in, then transfer the assets to the new account. The history of each account has to be maintained and dividends and gains are credited to whoever is the account owner at the time they are distributed. If the accounts are owned by different people (different SSNs), the 1099s, -INT, -DIV statements have to be sent to the correct person who owned the asset at that time. They can't just create havoc and wipe out a name and SSN as if a different person had always owned the account. What do you think that would do to the taxpayers involved and the IRS?

"Dear Sir/Madam,
According to our records, you did not report the $XX,XXX income on account YYY-YYY that you have owned for ZZ years. Please amend your taxes and pay the appropriate tax before . . . "
AN IRA is an Individual Retirement Account and like other retirement saving vehicles (401-K) it must be held in individual names. It can't be held in joint names AFAIK. If you ask Vanguard (or whoever is the custodian) to re-title the IRA account from your name to you+spouse names, a good custodian will let you know a) it can't / shouldn't be done and b) that re-titling an IRA from individual to any other joint ownership (with spouse or in the name of a trust etc) will be treated as legal transfer & distribution of the IRA and will result in 1099-R in Jan of next year. Think of the unpleasant and unintended tax consequences.

Just listing your spouse's name as primary beneficiary and a trust or some other person as contingent beneficiary should suffice.

Boglesmind

2015
Posts: 976
Joined: Mon Feb 10, 2014 2:32 pm

Re: 2 factor authentication - What if something happens to you?

Post by 2015 » Fri Oct 13, 2017 12:32 am

JaneyLH wrote:
Thu Oct 12, 2017 9:19 pm
jalbert wrote:
Thu Oct 12, 2017 1:05 pm
JaneyLH wrote:
Thu Oct 12, 2017 11:42 am
My question is, if you disclose your login information to your spouse how would Vanguard know? It seems someone would have to tell Vanguard they had done this. If I had a theft of my Vanguard funds and were asked by Vanguard if I had shared my password with anyone, surely my answer would be “no”. Am I missing something here?
You may be missing that you will be giving that answer in a signed affidavit wherein you also agree to the consequences of misrepresenting any information, and also that logs of system access and logins on Vanguard systems will be analyzed after an online malfeasance.
I still don't understand the risk of sharing my password with my spouse. What would the Vanguard logs of system access show? That my login and password were used some number of times by someone? How would Vanguard assert thast some times it was me and some times it was my spouse accessing the account?
See Firechief's example above:

viewtopic.php?f=2&t=229442&newpost=3570588#p3567789

jalbert
Posts: 2288
Joined: Fri Apr 10, 2015 12:29 am

Re: 2 factor authentication - What if something happens to you?

Post by jalbert » Fri Oct 13, 2017 1:53 am

I still don't understand the risk of sharing my password with my spouse. What would the Vanguard logs of system access show?
The IP addresses of the devices used to connect would likely also show up in the logs, not just the login name used for the connection. That and other forensic evidence might make it look like a password was shared, which would make it very uncomfortable to be signing a sworn affidavit to the contrary. What is in it for you to avoid following their policy that makes it worth the downside risk?
Last edited by jalbert on Fri Oct 13, 2017 3:42 pm, edited 1 time in total.
Risk is not a guarantor of return.

Post Reply