Fidelity Customer Protection Guarantee

[countdown]

Article in WSJ today about computer hacking into brokerage accounts.
Apparently Fidelity has a 'Customer Protection Guarantee' reimbursing customers for losses from hackers where customer used due care.
Wondering if Vanguard has equivalent policy for their accounts?

[xenial]

Our commitment regarding online security is simple. If assets are taken from your account in an unauthorized online transaction on Vanguard.com®—and you've followed the steps described in the Your responsibilities section below—we will reimburse the assets taken from your account in the unauthorized transaction.

Vanguard's online fraud policy

[sscritic]

Never share your user name, password, or other account-related information with anyone.

So if you give any of this information to your spouse or children, you lose the protection.

[ResearchMed]

Never share your user name, password, or other account-related information with anyone.

So if you give any of this information to your spouse or children, you lose the protection.

Yup, Vanguard's "exclusions" also seem to apply to someone operating with an AUTHORIZATION such a their own Agent Authorization (or some other legal Power of Attorney, an entirely other can of worms at Vanguard).

And they exclude reps of the plan admin who are authorized to log in but then act inappropriately,

Lot's of "outs" for Vanguard.

And they exclude annuity and college/529 accounts, too.

RM

[Drain]

How would they find out that your spouse had your password unless you told them?

Plus, my uneducated guess is that if it went to court, they'd lose. Spouses get to know almost anything. But I emphasize again that this is an uneducated guess.

[ResearchMed]

How would they find out that your spouse had your password unless you told them?

Plus, my uneducated guess is that if it went to court, they'd lose. Spouses get to know almost anything. But I emphasize again that this is an uneducated guess.

It gets even more weird (as a few of us have discussed elsewhere about Vanguard's bizarre "power of attorney"/"agent authorization" threads).

"They" (Vanguard) "knew" because I had a trading authorization.

HOWEVER, They also knew that I was indeed using it, because I called to discuss several things (including outright cancelled mutual fund purchases, but that's another story...).

Later, DH gets a letter (yes, a really, paper letter) notifying him that "someone" was accessing his account inappropriately.
Given that no one else knows any of the passwords, not even our attorneys or accountant, etc., and nothing was ever "changed" - except by Vanguard! - we knew the "someone" was ... ME

But apparently I was - get this - VIOLATING the terms by not logging on as "me".

Vanguard has only recently acknowledged/confirmed that for those "agents" who have their OWN Vanguard accounts, THAT is what will show up, and there is no way around that!
Yes, we were able to get DH's IRA info to show up in "my" account, but not his 403b, which is where his "serious money" is held.
And that's where the new contributions go.
(So we opened a Fidelity account within the 403b, and switched the new contributions there, not an optimal plan.)

But even though Vanguard acknowledged that I can NOT access his 403b account from within my own account, where my own login will take me, they continue to insist that I am NOT accessing his account "appropriately".

Heaven help all of us (including Vanguard, given the emails AND assistance from Employer) if someone else unauthorized DOES somehow get in.

We have no idea if this is somehow specific to our large Employer's plan accounts or more generally.

Now... to explore the Fidelity "small print"...

RM

[Drain]

Later, DH gets a letter (yes, a really, paper letter) notifying him that "someone" was accessing his account inappropriately.
Given that no one else knows any of the passwords, not even our attorneys or accountant, etc., and nothing was ever "changed" - except by Vanguard! - we knew the "someone" was ... ME

How could they be certain your husband wasn't the only one accessing the account? Were you viewing it from a desktop computer at work?

[ResearchMed]

Later, DH gets a letter (yes, a really, paper letter) notifying him that "someone" was accessing his account inappropriately.
Given that no one else knows any of the passwords, not even our attorneys or accountant, etc., and nothing was ever "changed" - except by Vanguard! - we knew the "someone" was ... ME

How could they be certain your husband wasn't the only one accessing the account? Were you viewing it from a desktop computer at work?

Because I had a properly executed "Agent Authorization" (per Vanguard's own requirements), I was speaking with the Vanguard rep WHILE he was showing me how to do something.

Of course, at other similar times, DH was sitting right next to me, but usually not.

I'm also guessing they can tell something about which computer is used? (Experts help here, when both laptops are using the same home PW-protected WiFi?)
But they couldn't "prove" that it wasn't DH using "my" computer, of course, unless it was a time he was out of town, and they bothered to "prove" that, which seems more bizarre than anything that has happened yet.

I wasn't being at all reticent about the fact that it was "me" making transactions in DH's account. That was the ENTIRE point of DH going to the trouble of having the proper Agent Authorizations notarized/etc., after all.

Some of this stuff gets rather Kafka-esque, but nothing beats TIAA-CREF on that score.

We've decided to ignore their "concerned letter", as it is still the case that the vast majority of the 403b money is at Vanguard, and due to the amount of money in Vanguard funds, it makes no sense to move it all to Fidelity (our only choice).

RM

[Drain]

Later, DH gets a letter (yes, a really, paper letter) notifying him that "someone" was accessing his account inappropriately.
Given that no one else knows any of the passwords, not even our attorneys or accountant, etc., and nothing was ever "changed" - except by Vanguard! - we knew the "someone" was ... ME

How could they be certain your husband wasn't the only one accessing the account? Were you viewing it from a desktop computer at work?

Because I had a properly executed "Agent Authorization" (per Vanguard's own requirements), I was speaking with the Vanguard rep WHILE he was showing me how to do something.

Oh, right. Okay, besides that odd case...

I'm also guessing they can tell something about which computer is used?

Sure, and that's why I asked if you were accessing his account from work. But if you were using a computer your husband might possibly use as well, I don't see how Vanguard could prove it was you.

But they couldn't "prove" that it wasn't DH using "my" computer, of course, unless it was a time he was out of town, and they bothered to "prove" that, which seems more bizarre than anything that has happened yet.

Well, if you and Vanguard actually went to court, this wouldn't seem bizarre to me at all.

Until someone chimes in with a counter-argument, I'm thinking you can get around the loophole in Vangaurd's policy simply by always logging in to your husband's account from a family computer. Never log in from a machine at work.

[ResearchMed]

Later, DH gets a letter (yes, a really, paper letter) notifying him that "someone" was accessing his account inappropriately.
Given that no one else knows any of the passwords, not even our attorneys or accountant, etc., and nothing was ever "changed" - except by Vanguard! - we knew the "someone" was ... ME

How could they be certain your husband wasn't the only one accessing the account? Were you viewing it from a desktop computer at work?

Because I had a properly executed "Agent Authorization" (per Vanguard's own requirements), I was speaking with the Vanguard rep WHILE he was showing me how to do something.

Oh, right. Okay, besides that odd case...

I'm also guessing they can tell something about which computer is used?

Sure, and that's why I asked if you were accessing his account from work. But if you were using a computer your husband might possibly use as well, I don't see how Vanguard could prove it was you.

But they couldn't "prove" that it wasn't DH using "my" computer, of course, unless it was a time he was out of town, and they bothered to "prove" that, which seems more bizarre than anything that has happened yet.

Well, if you and Vanguard actually went to court, this wouldn't seem bizarre to me at all.

Until someone chimes in with a counter-argument, I'm thinking you can get around the loophole in Vangaurd's policy simply by always logging in to your husband's account from a family computer. Never log in from a machine at work.

I'm retired, and my small business activity is done entirely from home, no other office.
Except for the times that I help DH with his work, given there is considerable overlap with some projects, and I also attend some business meetings/trips (and as more than eye candy ).

We were really stunned to get that letter. They KNEW it was me, without any question.
(Well, "You don't have to be paranoid for them to be out to get you", or somethin' like that! We suspect, but could never prove, obviously, that at least some of the nonsense was because we've "raised questions" when there were questions to raise. And needed to get our Employer involved on our behalf on several occasions. This one, about the "authorized access that isn't" seems to be beyond repair, so we've chosen to ignore it, at least for now. But we are keeping all of the emails and logs of conversations, including with Employer, about this particular issue.)

RM

[postingname]

Vanguard always makes things so incredibly hard.

If you get full trading authorization at Fidelity, the other person's account shows up on your OWN portfolio page. Very handy! So you can trade the other person's account using your own log-in credentials.

[ResearchMed]

Vanguard always makes things so incredibly hard.

If you get full trading authorization at Fidelity, the other person's account shows up on your OWN portfolio page. Very handy! So you can trade the other person's account using your own log-in credentials.

Yup, as the Staples' ads say, "Ding, ding, that was easy!"

Don't forget that Vanguard does NOT ALLOW a REAL Power of Attorney, or any sort of springing PoA, at least nothing set up usually FAR IN ADVANCE, which is usually when one wants to set such things in place. And it's only good for a single transaction, and within 30 days, last we checked.
Therefore, I've asked DH very seriously to consider signing one, getting it notarized, etc., right BEFORE he has a bad accident or illness. Maybe he should do many of them, so I can do more than ONE THING in that event.
Absurd...

Maybe we should move much more to Fidelity...
Do they allow a *REAL* Power of Attorney?

RM

[postingname]

Maybe we should move much more to Fidelity...
Do they allow a *REAL* Power of Attorney?

RM

I'm not sure. I haven't looked into that yet.

But I am finding trusts and POAs are full of landmines these days.

I was going to sign up for POA at a bank where the account was supposedly in the family trust. The personal banker told me I could only set up a POA if the trust authorized it. THEN he said that since the bank had gotten bought out during the financial crisis, the trust paperwork had been lost! So I'm supposed to come in and DO OVER the whole putting-the-account-in-the-trust thing before we can even begin to do the POA thing.

I'm finding it's a good idea to have more than one bank account and I've started moving money from the abovementioned bank to another bank where a POA is in effect until things get settled out.

[ResearchMed]

Maybe we should move much more to Fidelity...
Do they allow a *REAL* Power of Attorney?

RM

I'm not sure. I haven't looked into that yet.

But I am finding trusts and POAs are full of landmines these days.

I was going to sign up for POA at a bank where the account was supposedly in the family trust. The personal banker told me I could only set up a POA if the trust authorized it. THEN he said that since the bank had gotten bought out during the financial crisis, the trust paperwork had been lost! So I'm supposed to come in and DO OVER the whole putting-the-account-in-the-trust thing before we can even begin to do the POA thing.

I'm finding it's a good idea to have more than one bank account and I've started moving money from the abovementioned bank to another bank where a POA is in effect until things get settled out.

So that bank is letting you move the money (that was supposed to be in a trust) "as though" it is NOT in a trust, because they've lost the paperwork - without asking you for copies of it? Having you file NEW trust docs could end up with something totally different from the original terms, no?
Yikes.

Yes, MORE than one bank, more than one retirement account custodian...
And duplicate *original* copies of all PoA type of documents.
And we now keep a bit more cash on hand (well, somewhat hidden, not clutched in our fists) than we used to, in case of some Sandy-like event.

Too bad there isn't any way to have retirement accounts jointly.

RM

[juliewongferra]

The fear of hacking is why I spread my assets between Vanguard, Fidelity, T. Rowe Price, and TIAA-CREF. Most of the funds have similar enough expense ratios, give or take 3 or 4 basis points, that it helps me sleep at night knowing that I have provider diversity. If Vanguard (like any business, as it gets bigger, it becomes a bigger target, IMO) gets hacked, I still have money with other companies. Not that I think Vanguard will let thieves take my money, but if there is a situation that takes days, weeks, or months to resolve, I want to have access to another pot of money with another company.

cheers!
jwf

[postingname]

So that bank is letting you move the money (that was supposed to be in a trust) "as though" it is NOT in a trust, because they've lost the paperwork - without asking you for copies of it? Having you file NEW trust docs could end up with something totally different from the original terms, no?
Yikes.

By "move money" I just mean by EFT -- the periodic moving of chunks of the money to the other bank. This is just a temporary measure and I do the transfers on the account owner's computer (just in case there's an IP check).

I've started a new thread on the merits of trust vs POD. At another bank, the account was set up with POD which seems to be simpler and it allowed me to set up POA without any trouble.

[ResearchMed]

So that bank is letting you move the money (that was supposed to be in a trust) "as though" it is NOT in a trust, because they've lost the paperwork - without asking you for copies of it? Having you file NEW trust docs could end up with something totally different from the original terms, no?
Yikes.

By "move money" I just mean by EFT -- the periodic moving of chunks of the money to the other bank. This is just a temporary measure and I do the transfers on the account owner's computer (just in case there's an IP check).

I've started a new thread on the merits of trust vs POD. At another bank, the account was set up with POD which seems to be simpler and it allowed me to set up POA without any trouble.

Yes, but if the bank has, er, misplaced the trust docs, how do they know WHO is authorized to remove money, for any reason, any method?
If to another financial institution, how would Bank A know that the terms of the account at Bank B are the right ones?
More to the point, how can a bank "misplace" trust docs so they know how, when, and to whom money could be disbursed?
Or did I misunderstand the situation?

RM

[bertie wooster]

Vanguard always makes things so incredibly hard.

If you get full trading authorization at Fidelity, the other person's account shows up on your OWN portfolio page. Very handy! So you can trade the other person's account using your own log-in credentials.

You can do this at Vanguard too.

[ResearchMed]

Vanguard always makes things so incredibly hard.

If you get full trading authorization at Fidelity, the other person's account shows up on your OWN portfolio page. Very handy! So you can trade the other person's account using your own log-in credentials.

You can do this at Vanguard too.

No can do, and Vanguard finally acknowledged this.

We can do it for his IRA, but NOT for the 403b, at least not in *our* Employer's 403b plan, which is what matters to us.

And it took years (yes, YEARS) for Vanguard to do whatever was needed to get the IRA show up.
They have acknowledged this is a "problem" for the 403b, yet still insist that I "must" access it, in this impossible-to-access way

The PoA situation has us much more worried, at this point.

RM

[runner9]

With arbitration clauses in so many agreements it's doubtful Vanguard would end up in court. It's in the Fine print of most every sign up form I've seen from Vanguard

[Call_Me_Op]

Article in WSJ today about computer hacking into brokerage accounts.
Apparently Fidelity has a 'Customer Protection Guarantee' reimbursing customers for losses from hackers where customer used due care.
Wondering if Vanguard has equivalent policy for their accounts?

"Due care" is the operative phrase. In my opinion, it is another way of saying "at our discretion."

[skepticalobserver]

My friend, when it hits the fan and large sums of money disappear the brokerage "guarantees" will be worth nothing. The insurance companies that underwrite these things will be tapped out and throw up their hands. Think Leahman Bros. Think Bear Stearns and AIG without massive Fed assistance. Think the Reserve Fund.The brokerages will make you whole only if losses are relatively minor.

Place your investments in multiple brokerages. Use short term t-bills, which are often commission free when bought at auction, instead of money market funds.

[postingname]

So that bank is letting you move the money (that was supposed to be in a trust) "as though" it is NOT in a trust, because they've lost the paperwork - without asking you for copies of it? Having you file NEW trust docs could end up with something totally different from the original terms, no?
Yikes.

By "move money" I just mean by EFT -- the periodic moving of chunks of the money to the other bank. This is just a temporary measure and I do the transfers on the account owner's computer (just in case there's an IP check).

I've started a new thread on the merits of trust vs POD. At another bank, the account was set up with POD which seems to be simpler and it allowed me to set up POA without any trouble.

Yes, but if the bank has, er, misplaced the trust docs, how do they know WHO is authorized to remove money, for any reason, any method?
If to another financial institution, how would Bank A know that the terms of the account at Bank B are the right ones?
More to the point, how can a bank "misplace" trust docs so they know how, when, and to whom money could be disbursed?
Or did I misunderstand the situation?

RM

Hi ResearchMed,

Sorry, I missed this earlier.

The missing trust paperwork doesn't really impact anything unless a change needs to be made -- like the POA authority I want to add, or when there's a new trustee. At that point, the trust papers would just be brought into the bank and they can see who's authorized to do what. In the meantime, the account is still "titled" as being in the trust and is accepted as being in a trust. The titling indicates who the trustees are and so those would be the people authorized to use the account. Bottom line, the fact that an account is in a trust matters little in terms of day-to-day operational detail, so the fact that the trust paperwork is missing doesn't affect the course of everyday transactions.

[countdown]

Thanks for the link Ken.
Looks like you are correct sscritic--
Just having the spousal authorization on our accounts would likely violate the security agreement.

From Vanguard:
"At a minimum, in order for this protection to apply, you must take the following steps:
..."Never share your user name, password, or other account-related information with anyone.

..."This protection does not apply to unauthorized activity caused in whole or in part by your fraudulent, intentional, or negligent acts or omissions, including activity by a person whom you have intentionally or negligently permitted to transact in your account, or to whom you have intentionally or negligently given access to security information relating to your account. This protection does not apply to unauthorized account activity or account access by an employer or plan sponsor representative who is authorized to access your account but is acting outside the scope of his or her authority."

Essentially there appears to be no protection from hackers if you have shared your access to your account with your spouse. Very disturbing, Vanguard.

[in_reality]

So if you give any of this information to your spouse or children, you lose the protection.

Schwab seems less strict on this.

To ensure your protection under this guarantee, it is your responsibility to:
Safeguard your account access information. If you share this information with anyone, we’ll consider their activities to have been authorized by you.

So if I share credentials with my wife, and she steals all the money, it's gone.
But if someone from Mars or Venus hacks in and steals everything, I think I'd still be protected even if they can for instance find access by my wife's iPhone and know I gave her credentials. Since I never gave the aliens authorization, it seems like I wouldn't be excluded just because I'd shared with my wife. IANAL so PLDL (please lawyers don't laugh)

And they exclude annuity and college/529 accounts, too.

Schwab is the same on this. It because they are held at a third party.

http://www.schwab.com/public/schwab/nn/ ... antee.html

[Call_Me_Op]

Place your investments in multiple brokerages. Use short term t-bills, which are often commission free when bought at auction, instead of money market funds.

Is this comment intended to apply to money-market funds invested in t-bills?

[ResearchMed]

So if you give any of this information to your spouse or children, you lose the protection.

Schwab seems less strict on this.

To ensure your protection under this guarantee, it is your responsibility to:
Safeguard your account access information. If you share this information with anyone, we’ll consider their activities to have been authorized by you.

So if I share credentials with my wife, and she steals all the money, it's gone.
But if someone from Mars or Venus hacks in and steals everything, I think I'd still be protected even if they can for instance find access by my wife's iPhone and know I gave her credentials. Since I never gave the aliens authorization, it seems like I wouldn't be excluded just because I'd shared with my wife. IANAL so PLDL (please lawyers don't laugh)

And they exclude annuity and college/529 accounts, too.

Schwab is the same on this. It because they are held at a third party.

http://www.schwab.com/public/schwab/nn/ ... antee.html

How do Vanguard's OWN "Agent Authorization" forms play into the liability issue?

Can Vanguard *really* provide it's clients with a form specifically to allow someone access/authorizations of varying types, and then ding them for that if some hacker wreaks havoc?

Wouldn't Vanguard have some responsibility and/or the client who executed such forms have some sort of protection?

Any attorneys want to weigh in on this?

RM