Fidelity Account Hacked

[Rianne]

Quote:

Originally Posted by MRG Most hacks are internal.

I always wondered where those few thousand went after a run up in the market. Somebody's getting a new car.

[littleb]

Quote:

Originally Posted by Dalmore Definitely interested in the full story here. I am wondering if maybe it was an agent that made a mistake. DW had a $2,000 gift to her IRA last year. I caught the error and gave it back.

I had an agent involved in moving money from an IRA to my ROTH the middle of December. I asked three reps at Fidelity if the agent opened this new IRA account. All three said "no." The money transfer was from December 13 and the new IRA was set up the end of December.....It is a possibility to me.

[jazz4cash]

Quote:

Originally Posted by Jerry1 Nothing was lost. A new account was set up. Probably on the way to a loss, but stopped in progress thankfully. Still very upsetting I’m sure.

This is what I am thinking also. Very upsetting but it sounds like the security measures in place worked. Please continue to report the details which is can help the rest of us.

[GravitySucks]

Finally got me off my a$$ to setup the 2FA too.
Best of luck OP!

Quote:

Originally Posted by CRLLS OMG! I can't imagine how that might feel. I hope they can make you whole soon. Thank you for posting. It has made me enable 2FA on my account.

[John Galt III]

LittleB, what's the skinny? Did you get 'Wells Fargoed' by Fidelity (they set up an account you didn't ask for) or was there outsider fraud? Curious minds want to know.

[catii]

Yes, many curious minds! With password manager, 2FA, & decent anti-virus software, doesn't sound like the glitch is at your end.

[RobbieB]

Another reason I like my managed accounts. I can't get my own money so I don't think the hackers will either.

I have to talk to a real person and they do the sales and transfers.

[Potstickers]

Re: 2 factor authentication -- I see text messages right on my computer, so I'm not sure that it adds any security at all.

[braumeister]

Quote:

Originally Posted by Potstickers Re: 2 factor authentication -- I see text messages right on my computer, so I'm not sure that it adds any security at all.

Text messages are probably the least secure method of 2FA.
I use the Symantec VIP Access app on my phone to log in to my Fidelity and Schwab accounts (and a couple of others). It's good enough, I think.

[COcheesehead]

So I am trying to figure out the end game here. They fund the IRA from one of your other accounts and then make a withdrawal? Seems like a lot of steps and waiting if they already have access to your account.

I have transfers blocked on all my accounts. So nothing leaves unless I remove the block.

[Katsmeow]

Quote:

Originally Posted by stephenson I’m not yet convinced this was hacking - or at least that it was done from outside. Fidelity should be able to scratch down through the entire event ... including whether a 2FA code was sent, when it was sent, if it was used, etc ...

Yes, I wonder if it was simply an error. Basically someone setting up an account for another user and put in your group of accounts by mistake.

[teejayevans]

Quote:

Originally Posted by Potstickers Re: 2 factor authentication -- I see text messages right on my computer, so I'm not sure that it adds any security at all.

I have them sent to my phone, so...
Hackers need my VG password and my phone that’s password protected, and I get emails and text confirmation for every transaction before it happens. For those of us that don’t use ETFs, that means waiting till the end if the day.

[teejayevans]

Quote:

Originally Posted by COcheesehead So I am trying to figure out the end game here. They fund the IRA from one of your other accounts and then make a withdrawal? Seems like a lot of steps and waiting if they already have access to your account. I have transfers blocked on all my accounts. So nothing leaves unless I remove the block.

Assuming I have some basic information like last 4 digits off your SS number and mothers maiden name...
Hi, this is Mr Cheesehead, I like to remove the block and make a withdrawal ...
My last 4 digits....my mother’s name is Chedder, my dogs name is Swiss.... I like to transfer my $11 million IRA to an IRA I have with Cayman bank....

[COcheesehead]

Quote:

Originally Posted by teejayevans Assuming I have some basic information like last 4 digits off your SS number and mothers maiden name... Hi, this is Mr Cheesehead, I like to remove the block and make a withdrawal ... My last 4 digits....my mother’s name is Chedder, my dogs name is Swiss.... I like to transfer my $11 million IRA to an IRA I have with Cayman bank....

It doesn’t work that way.

[CaptTom]

Quote:

Originally Posted by teejayevans I have them sent to my phone, so... Hackers need my VG password and my phone that’s password protected, and I get emails and text confirmation for every transaction before it happens.

My cell phone decided it wanted to go for a swim last summer while I was away for a week or so. I wasn't near anyplace to get a new one for a while.

I realized that I would be screwed if I'd needed two-factor authentication for anything. Many people nowadays also use their phones for e-mail, particularly when away from home.

Also, if the credit card company detects an unusual purchase, they may block the card until you call them from the number on file, or may call that number and block the card if you don't answer. Either way, now you've got no phone AND no credit card. (Well, most of us carry more than one card, but you get the point.)

It's downright frightening how much we depend on those things always being with us and always working!

[RobbieB]

I leave my smart phone at home unless I'm going out of town.

[CaliKid]

Quote:

Originally Posted by RobbieB Another reason I like my managed accounts. I can't get my own money so I don't think the hackers will either. I have to talk to a real person and they do the sales and transfers.

This is true. It's a good point for sure.

[tdv2]

Quote:

Originally Posted by CaptTom My cell phone decided it wanted to go for a swim last summer while I was away for a week or so. I wasn't near anyplace to get a new one for a while. I realized that I would be screwed if I'd needed two-factor authentication for anything. Many people nowadays also use their phones for e-mail, particularly when away from home. Also, if the credit card company detects an unusual purchase, they may block the card until you call them from the number on file, or may call that number and block the card if you don't answer. Either way, now you've got no phone AND no credit card. (Well, most of us carry more than one card, but you get the point.) It's downright frightening how much we depend on those things always being with us and always working!

If you own an Iphone and an Ipad you will never have that problem unless you lose both of them. I always take both with me when I travel.

[littleb]

Have not heard a word yet from Fidelity. In the meantime, I have been running virus scans and downloaded Malwarebytes and scanned both pc's. Results came back with spyware on one computer.

I downloaded my credit reports and nothing looks strange. Already had credit freezes on all three credit bureaus but on their site it states only a "credit lock" keeps someone from setting up a new account. There was a soft inquiry from Fidelity in February when I set up an IRA and ROTH at Fidelity. There was also a soft inquiry when the new account was set up the end of December. The one Fidelity is investigating. This is interesting to me because I thought a credit freeze kept ANYONE from setting up a new account in your name. The credit "lock" costs 25.00 monthly per credit bureau. Is this a new way for the credit bureaus to make money? I have always had to unfreeze my credit report when getting credit in my name.

[REWahoo]

Quote:

Originally Posted by littleb This is interesting to me because I thought a credit freeze kept ANYONE from setting up a new account in your name. The credit "lock" costs 25.00 monthly per credit bureau. Is this a new way for the credit bureaus to make money? I have always had to unfreeze my credit report when getting credit in my name.

From the Clarke Howard website: