Is It Safe to Keep Vanguard/Banking Apps on iPhone

[gouldnm]

Is it safe to keep Vanguard or other banking apps on your iPhone? What happens if someone steals your phone? Wouldn't it be easy for them to be able to login and/or receive dual factor authentification?

Any advice about this or related matters would be very much appreciated.

[Claudia Whitten]

Is it safe to keep Vanguard or other banking apps on your iPhone? What happens if someone steals your phone? Wouldn't it be easy for them to be able to login and/or receive dual factor authentification?

Any advice about this or related matters would be very much appreciated.

The most dangerous thing you probably do every day is get into your car.

As to banking/investment apps on phones, there are multiple levels of security to prevent someone from getting into your account: phone-level protection (face ID, fingerprint) and then app-level protection (again face ID or password). Plus with iphone at least you can lock your device if it's stolen:

https://support.apple.com/en-us/101593

There's no way to remove all risk from life. You often get to choose which risks are worth taking, though.

[mptfan]

"Safe" is a relative concept, it depends on how much risk you are willing to accept. In my opinion, no, it's not safe, I do not have any financial apps on my phone... no banking, investment or credit card apps.

[jbowman]

Is it safe to keep Vanguard or other banking apps on your iPhone? What happens if someone steals your phone? Wouldn't it be easy for them to be able to login and/or receive dual factor authentification?

Any advice about this or related matters would be very much appreciated.

Just because they have your phone doesn't mean they can get into it. Do you have a good password on your phone? Do you have it set up to be remotely wipeable if you lose it?

Do you have separate and secure passwords for all of your accounts? A password manager can help here. That way even if they get into your phone they may not be able to log into the apps themselves.

There are a variety of things you can do to make your phone a reasonably secure place to have your financial details.

edit: and not to make you paranoid, but your financial accounts can still be vulnerable even if you don't have them on your phone because you can log into them online via any browser. 2 factor auth is helpful but not foolproof (particularly if it's just sending you a text).

[jebmke]

I am comfortable with them but only put on what I really need. I don’t need VG on the phone. I do “need” the bank app to unlock my ATM card if I have to use it unpredictably. Same for credit cards that I don’t use often (I don’t lock the main card).

I am not a day trader so having a brokers app on my phone has no use case.

I also set screen time to zero for these apps.

[oldcomputerguy]

My wife and I both have iPhones. In our particular case, we have no need of either investment apps nor banking apps on our phones, as all that is done from desktop Linux machines at home. Very occasionally, I'll install our bank's app on my phone if I want to do mobile deposit of a paper check, just to save a drive to a local bank branch, then remove the app after I'm done. But neither my wife nor I have the Fidelity or the Schwab apps on our phones, because we have no legitimate need to access our investment accounts while away from home.

Our phones are set up so that either phone can be used to erase the other back to factory new, in case one is stolen.

[NYCaviator]

I think the apps themselves are secure. Probably more so than going through your web browser on a computer that could be infected with malware.

The biggest threat on your phone is your passcode. Many people have short 4 digit passcodes, or simple ones like 0000. Someone looking over your shoulder in a crowd, on a plane, on a train, etc. could easily watch you type it in and then swipe your phone later and get access to everything, including your saved passwords for ALL of your websites.

If you have an iPhone (1) use a 6-8 digit passcode, and (2) turn on advanced data protection. The advanced data protection forces biometric security when you aren't in a known location. So if someone finds your phone and knows your passcode, they can't log into your apps.

[CharlesDickens]

IMO they are not secure, but not for the reasons mentioned above. In Chicago (where I work), armed thieves will put a gun to your head, demand your phone, demand your phone passcode, demand that you log into your banking app, and demand that you Zelle them your money. It has happened multiple times. Why can't they trace the funds and catch the robbers? I don't know.

I do have a couple of banking apps on my phone solely for the convenience of making mobile check deposits. However, this thread has prompted me to delete them, and reinstall them only when needed, as someone mentioned above. If you need a banking app for Zelle etc., experts recommend using that only for a low balance account.

[jebmke]

IMO they are not secure, but not for the reasons mentioned above. In Chicago (where I work), armed thieves will put a gun to your head, demand your phone, demand your phone passcode, demand that you log into your banking app, and demand that you Zelle them your money. It has happened multiple times. Why can't they trace the funds and catch the robbers? I don't know.

I do have a couple of banking apps on my phone solely for the convenience of making mobile check deposits. However, this thread has prompted me to delete them, and reinstall them only when needed, as someone mentioned above. If you need a banking app for Zelle etc., experts recommend using that only for a low balance account.

What do they do if you don't have the apps? Let you go? If you don't use Zelle, then what -- do they let you go?

I only use the bank app to lock/unlock my card; I do not use Zelle since I have no use case, personally. I can't recall the last time someone sent me a check -- and I think the bank will take a scan from home; certainly I can mail in the deposit.

[Doctor Rhythm]

I think it's at least as safe as using the web portal for the same number of log-ins and transactions. I think it's safer than logging in less frequently because one is afraid of accessing their accounts.

I have 9 financial apps on my phone (roughly half brokerage and half bank), some are used almost daily, others weekly to monthly.

I also distinguish violent crime and financial crimes. Fear of being held at gunpoint is its own thing (and probably something one needs to get help with to work out), and totally unrelated to banking apps. Armed robbery is less common now in most parts of the US, despite the fact most people carry $500-$1000 computers in their pockets and can access thousands of dollars with them.

[PersonalFinanceJam]

What do they do if you don't have the apps? Let you go? If you don't use Zelle, then what -- do they let you go?

Well if you believe some of these reports then they may resort to old fashioned thievery and take you to an ATM and force you to withdraw money. I think the apps are safe, but it looks like you don't want to be on the mean streets of Chicago late at night/very early morning.

My dad always said nothing good happened after midnight.

[CharlesDickens]

What do they do if you don't have the apps? Let you go? If you don't use Zelle, then what -- do they let you go?

Well if you believe some of these reports then they may resort to old fashioned thievery and take you to an ATM and force you to withdraw money. I think the apps are safe, but it looks like you don't want to be on the mean streets of Chicago late at night/very early morning.

My dad always said nothing good happened after midnight.

I don't have data points on what they do when they look at your phone and you don't have any banking apps. They might drag you to an ATM, as suggested, but they may not know where an ATM is. Some ATMs are inside stores and too risky. ATMs have cameras, etc. All I know is that I try to reduce my risks, and yes Chicago's streets are mean. I do what I can. I have deleted banking apps. I have multi-factor authentication on my accounts. I wear a Casio watch and have no bling. I don't drive downtown (carjacking risk). I stay aware of my surroundings. I have a black belt in Tae Kwon Do and have trained for 2.5 years in Krav Maga. I cannot eliminate risks; only mitigate them.

Back to banking apps, if I were not in a high crime area, I don't think that I would be as concerned, but I still would not have them on my phone for my main investment accounts. Small bank balances, ok.

[jebmke]

What do they do if you don't have the apps? Let you go? If you don't use Zelle, then what -- do they let you go?

Well if you believe some of these reports then they may resort to old fashioned thievery and take you to an ATM and force you to withdraw money. I think the apps are safe, but it looks like you don't want to be on the mean streets of Chicago late at night/very early morning.

My dad always said nothing good happened after midnight.

Maybe the right answer is to change the icon and name to something not obvious that only you know. I think if not now, iOS 18 will allow you to hide apps. I have screen time set to zero on any “risk” apps since I sometimes let someone else use my phone to make a call (not a stranger, but still).

[Gaston]

Is it safe to keep Vanguard or other banking apps on your iPhone?

I don't have financial apps on my phone, mostly because I haven't found a need to do so.

For a bit more security, later this autumn you can put your banking apps in what Apple calls a "hidden" folder (when iOS 18 is released). The folder isn't really hidden, but access to the folder requires your biometrics.

[ScubaHogg]

… just to save a drive to a local bank branch, then remove the app after I'm done.

I’m just blindly guessing that statistically the drive to the bank is an order of magnitude more dangerous than having the Vanguard app on your phone

[ScubaHogg]

For a bit more security, later this autumn you can put your banking apps in what Apple calls a "hidden" folder (when iOS 18 is released). The folder isn't really hidden, but access to the folder requires your biometrics.

These folks are worried about being kidnapped at gun point. In such a low probability situation a hidden folder won’t help you. Idk what will, but they are worried about some real edge cases

[Doctor Rhythm]

For a bit more security, later this autumn you can put your banking apps in what Apple calls a "hidden" folder (when iOS 18 is released). The folder isn't really hidden, but access to the folder requires your biometrics.

These folks are worried about being kidnapped at gun point. In such a low probability situation a hidden folder won’t help you. Idk what will, but they are worried about some real edge cases

It's the unhelpful fears you see repeated on phone security threads: worrying about what could happen rather than what does happen.

[PersonalFinanceJam]

For a bit more security, later this autumn you can put your banking apps in what Apple calls a "hidden" folder (when iOS 18 is released). The folder isn't really hidden, but access to the folder requires your biometrics.

These folks are worried about being kidnapped at gun point. In such a low probability situation a hidden folder won’t help you. Idk what will, but they are worried about some real edge cases

Agreed. Two of the victims in the article I linked to above were somewhat unique. One didn't even have his phone with him and the perpetrator made him go to his apartment and get it to commit the crime. Another had his phone and the perpetrator still had him go to an ATM (with cameras and everything) to get more cash.

[Lastrun]

Is it safe to keep Vanguard or other banking apps on your iPhone?

I don't have financial apps on my phone, mostly because I haven't found a need to do so.

For a bit more security, later this autumn you can put your banking apps in what Apple calls a "hidden" folder (when iOS 18 is released). The folder isn't really hidden, but access to the folder requires your biometrics.

I have something similar on my iphone now---I only keep 1 banking app on my phone, and no brokerage apps. The app times out after a minute under iOS. It will then give you another minute, and then it requires a pass code (which is different from my 9 digit alpha-numeric passcode for the phone) and with this feature it is usually timed out anyhow so typically will require the code at the start. So even if someone snatched an open phone from me, not much damage.

[retiredjg]

Life is not safe. Risk is only worthwhile when and where you are willing to take it.

I have little use for financial apps on my phone...so I have chosen not to have any financial apps on my phone. Occasionally, that will be inconvenient. But if I lose my phone, that is one thing I don't have to worry about.

If I had a recurring and compelling need to have phone apps on my phone, I guess I'd have to have a more secure phone system than I do now.

[evancox10]

Is it safe to keep Vanguard or other banking apps on your iPhone? What happens if someone steals your phone? Wouldn't it be easy for them to be able to login and/or receive dual factor authentification?

Any advice about this or related matters would be very much appreciated.

How is opening the Vanguard app any different from opening a browser and typing www.vanguard.com? In both cases they still need to log in. I’m not aware of any financial app (or website) that lets you stay logged in for long periods of time.

(This presupposes they are actually able to unlock your phone, in which case you likely have bigger problems. Definitely a good idea to set up a strong passcode for the phone.)

[dukeblue219]

An updated app on an updated OS on an encrypted phone with biometric login, and multi factor authentication setup with the bank, is the safest way to interact with your financial accounts that exists. Far safer than a phone call, an email, or even an in person visit to the bank. All of those features I mentioned are pretty standard.

In addition, this is how 99% of the population banks now. It's not some obscure means to be skeptical of.

If you lose your phone nobody can get to your apps or data unless you actively choose to setup your phone insecurely.

[oldcomputerguy]

… just to save a drive to a local bank branch, then remove the app after I'm done.

I’m just blindly guessing that statistically the drive to the bank is an order of magnitude more dangerous than having the Vanguard app on your phone

Could be, especially since I don't have any money at Vanguard.

[Gaston]

How is opening the Vanguard app any different from opening a browser and typing www.vanguard.com?

An app on a phone immediately suggests you have an account at that bank or brokerage.

Otherwise, a perpetrator would have to go thru your browsing history to find your bank / brokerage. And this would only work if a) you don’t use a private browser window, or b) never clear your browsing history.

Maybe there’s some situation where this would make a difference.

[ScubaHogg]

How is opening the Vanguard app any different from opening a browser and typing www.vanguard.com?

An app on a phone immediately suggests you have an account at that bank or brokerage.

Otherwise, a perpetrator would have to go thru your browsing history to find your bank / brokerage. And this would only work if a) you don’t use a private browser window, or b) never clear your browsing history.

Maybe there’s some situation where this would make a difference.

Or they could point the gun at your head and ask where you bank

Once you introduce kidnapping and life threatening confrontations all this other stuff goes out the window

[CatsAreCute]

Or they could point the gun at your head and ask where you bank

Once you introduce kidnapping and life threatening confrontations all this other stuff goes out the window

This! You can only reasonably protect your phone. It's more important to value your life!

You can manage some of the risk on the iPhone:

• Enable "Stolen Device Protection" in FaceID settings. That makes it tougher for someone to steal a phone and use only a PIN to control the apps or takeover your iCloud account. Just be sure to disable this feature if you need to trade in your phone, or get your phone serviced. Learn more here: https://support.apple.com/en-us/120340
• When iOS 18 comes out this fall, consider using the new Hidden Secure Apps feature. You could hide all of your financial apps. They won't be visible to someone scanning your phone. The new feature is discussed here: https://www.macrumors.com/2024/06/10/io ... lock-apps/

And most cellular carriers today have some form of "SIM Lock" feature. This prevents port outs of your number. They also require a Port PIN that you can set as well.

[hoops777]

IMO they are not secure, but not for the reasons mentioned above. In Chicago (where I work), armed thieves will put a gun to your head, demand your phone, demand your phone passcode, demand that you log into your banking app, and demand that you Zelle them your money. It has happened multiple times. Why can't they trace the funds and catch the robbers? I don't know.

I do have a couple of banking apps on my phone solely for the convenience of making mobile check deposits. However, this thread has prompted me to delete them, and reinstall them only when needed, as someone mentioned above. If you need a banking app for Zelle etc., experts recommend using that only for a low balance account.

They can also break into your home and demand whatever. They can do the same with the millions who travel or commute carrying laptops.
Should people no longer carry laptops to work?

[hoops777]

My question is how safe is it to log in to Schwab while traveling using an IPHONE in terms of safety of cellular networks.
I refuse to use my IPad over hotel WiFi for that but believe cellular to be ok.

[Doctor Rhythm]

As an unimportant person, I'm apathetic (and usually agnostic) as to whether I'm logging into financial apps/websites with a cellular, WPA protected WiFi, or public WiFi connection.

[PersonalFinanceJam]

My question is how safe is it to log in to Schwab while traveling using an IPHONE in terms of safety of cellular networks.
I refuse to use my IPad over hotel WiFi for that but believe cellular to be ok.

It's safe just like your home wifi is safe and honestly so is the hotel wifi. Especially with 2FA enabled. They are all vulnerable in different ways. Fake cell sites are a thing but pretty rare unless you are important and being targeted.

[lstone19]

Anyone can install a financial app on their phone. But they still need your login credentials. There is nothing that ties the phone an app is installed on to particular user. If I have your credentials, then I can install an app on my phone and login. It's not having the app on your phone that's the risk, it's having the credentials.

[hoops777]

My question is how safe is it to log in to Schwab while traveling using an IPHONE in terms of safety of cellular networks.
I refuse to use my IPad over hotel WiFi for that but believe cellular to be ok.

It's safe just like your home wifi is safe and honestly so is the hotel wifi. Especially with 2FA enabled. They are all vulnerable in different ways. Fake cell sites are a thing but pretty rare unless you are important and being targeted.

You are the first person I have seen that says hotel wi fi is safe.

[Doctor Rhythm]

FTC sort of says it's safe as well:

https://consumer.ftc.gov/articles/are-p ... crypted%3F

Your security doesn't come from a connection between your device and the server being inpenetrable to eavesdropping. It's from the fact you are sending and receiving encrypted data.

[gavinsiu]

Is it safe to keep Vanguard or other banking apps on your iPhone? What happens if someone steals your phone? Wouldn't it be easy for them to be able to login and/or receive dual factor authentification?

Any advice about this or related matters would be very much appreciated.

You need to implement good protection on your phone. For example, use a strong pin that includes non-numbers. Make sure biometric is entabled. Set you notification to not display th message unless the phone is unlocked. Keep your OS update up to date to prevent exploits. Remotely erase your phone if it is stolen. When the person get your phone, they won't be able to get into your phone and they won't be able to see sms message (if you make sure sms message isn't displayed).

Mobile OS are more secure than their desktiop counterparts.

[exodusNH]

My question is how safe is it to log in to Schwab while traveling using an IPHONE in terms of safety of cellular networks.
I refuse to use my IPad over hotel WiFi for that but believe cellular to be ok.

It's safe just like your home wifi is safe and honestly so is the hotel wifi. Especially with 2FA enabled. They are all vulnerable in different ways. Fake cell sites are a thing but pretty rare unless you are important and being targeted.

You are the first person I have seen that says hotel wi fi is safe.

Now that almost all website traffic is encrypted, it's safe.

The real risk is someone setting up a hotspot with the same name as hotel wifi and then using fake DNS servers to send you to spoofed sites. You can avoid that by using Google's or Cloudflare's public DNS.

[PersonalFinanceJam]

My question is how safe is it to log in to Schwab while traveling using an IPHONE in terms of safety of cellular networks.
I refuse to use my IPad over hotel WiFi for that but believe cellular to be ok.

It's safe just like your home wifi is safe and honestly so is the hotel wifi. Especially with 2FA enabled. They are all vulnerable in different ways. Fake cell sites are a thing but pretty rare unless you are important and being targeted.

You are the first person I have seen that says hotel wi fi is safe.

I'm just not overly paranoid about it. Your connection to the financial site (and most general web/mobile sites these days) is encrypted. Any WIFI is somewhat of a risk. However, this is Bogleheads where some will say it's not safe unless you are doing online banking from an unlit windowless room with a dedicated computer with it's own internet connection used only for financial institutions.

Now, if I were at the black hat hacker convention then, yes I would stay off any wifi. I also wouldn't use my cell phone or anything which uses wired or wireless signals.

[hoops777]

FTC sort of says it's safe as well:

https://consumer.ftc.gov/articles/are-p ... crypted%3F

Your security doesn't come from a connection between your device and the server being inpenetrable to eavesdropping. It's from the fact you are sending and receiving encrypted data.

Ok. That makes more sense now.
In the past there was no encryption and now there is in most cases. The security has changed and the old warnings are still what a lot of people like me remember.
With that being said, I am still not doing banking on public WiFi
I feel very good about using my phone thru cellular if I need to do something financial now.

[exodusNH]

FTC sort of says it's safe as well:

https://consumer.ftc.gov/articles/are-p ... crypted%3F

Your security doesn't come from a connection between your device and the server being inpenetrable to eavesdropping. It's from the fact you are sending and receiving encrypted data.

Ok. That makes more sense now.
In the past there was no encryption and now there is in most cases. The security has changed and the old warnings are still what a lot of people like me remember.
With that being said, I am still not doing banking on public WiFi
I feel very good about using my phone thru cellular if I need to do something financial now.

Honestly, cellular is probably less secure since there are legal spoofing devices (Stingray) that authorities use to intercept and track people. You have very little control over what your phone accepts as valid.

In that sense, wifi would be safer.

[stan1]

FTC sort of says it's safe as well:

https://consumer.ftc.gov/articles/are-p ... crypted%3F

Your security doesn't come from a connection between your device and the server being inpenetrable to eavesdropping. It's from the fact you are sending and receiving encrypted data.

Ok. That makes more sense now.
In the past there was no encryption and now there is in most cases. The security has changed and the old warnings are still what a lot of people like me remember.
With that being said, I am still not doing banking on public WiFi😊
I feel very good about using my phone thru cellular if I need to do something financial now.

Another yes on encryption. Everything is SSL now even Bogleheads.
You have much more risk if you are high profile and being targeted by law enforcement, criminals or foreign intelligence.
For that reason there are certain countries where I would view the mobile phone carrier with high suspicion.

[MathWizard]

I do not access any my investments or my bank account
on my phone.

I've seen too many people compromise security for
a little convenience.

Do you not have a device in your home with which to access
your financial accounts?

[beardsicles]

I do not access any my investments or my bank account
on my phone.

I've seen too many people compromise security for
a little convenience.

Do you not have a device in your home with which to access
your financial accounts?

Your iPhone is the most hardened piece of consumer electronics you can buy.

[PersonalFinanceJam]

I do not access any my investments or my bank account
on my phone.

I've seen too many people compromise security for
a little convenience.

Do you not have a device in your home with which to access
your financial accounts?

Your iPhone is the most hardened piece of consumer electronics you can buy.

+1
Additionally, there are legitimate reasons for using banking apps when not at home.

[investuntilimrich]

An important question is what would happen if the theives got through every layer of security and cleaned your account out. That's a question for your financial institutions. It's not an excuse to violate security best practices, but I would not put a single penny into any institution until I was able to read their fraud protection policy. In my mind, that's step one. Step two is making sure you have layers of security (ie MFA turned on the apps, unqiue secure passwords set, the device properly protected, screen lock set to 5 minutes or less, etc) so that if a bad actor obtains the phone, they would be unlikely to be able to use it.Last would be physical security, make sure you don't set the phone down, have it where it can fall out of your pocket, type a password or hold the phone so that others can see your keystrokes in a public place.

Now having said all that, in real world scenarios that's not how I see people losing money. It's because their email or a person known to them has their email account hacked (or a phishing email claiming to be someone or some entity) and they wire money and/or they click on a link that takes them to a bogus website and they enter their real credentials there. I don't use links from emails. I don't wire money based on emails. I keep all my information updated at each financial institution I use. I use a unique password for each website/app I use.

[FrugalInvestor]

We (my wife and I) have no need for any banking or other financial apps on our phones. Our lives works just fine without them. Having these apps on our phones would add a only a slight bit of convenience for us so until that changes for some reason we've decided to forego the added point(s) of vulnerability.

[jebmke]

Keeping my bank app on my iPhone actually improves my account safety. It allows me to keep my ATM card and the credit card locked and unusable unless I need it. The bank issued CC is not regularly used but needed when my AMEX isn't accepted. The ATM card is not used often so it remains locked on the banking app until needed.

[NewRain]

Phones are probably more vulnerable to $5 wrench attacks than most other computers.

https://xkcd.com/538/

[jebmke]

Phones are probably more vulnerable to $5 wrench attacks than most other computers.

https://xkcd.com/538/

and based on anecdotal accounts (not mine), they are also more vulnerable to being dropped in a toilet than most computers.

Perhaps some are confused by the term "flush the cache." Never understood why phones were accompanied there to begin with.

[JoeNJ28]

Phones are probably more vulnerable to $5 wrench attacks than most other computers.

https://xkcd.com/538/

and based on anecdotal accounts (not mine), they are also more vulnerable to being dropped in a toilet than most computers.

Perhaps some are confused by the term "flush the cache." Never understood why phones were accompanied there to begin with.

How else am I to pass the time at work in the bathroom without a phone.

[hoops777]

Ok.
So I am on vacation in say NYC. I have a Schwab app on my IPhone.
I need to do a transaction on Schwab that I initiate, have my Face ID and they text me my login code when I start logging in.
Some of you are saying this is not safe. Some are saying it is as secure as it gets.
This is why people get confused.
I honestly have not seen any stories of people doing this and having a financial disaster.

[Tycoon]

Phones are for talking.