Fidelity Account Hacked

[braumeister]

Slightly off topic, but I just saw this and I know we have many members who use Firefox:

The United States Cybersecurity and Infrastructure Agency (CISA), part of the Department of Homeland Security, this week urged customers who are using the Firefox browser to upgrade to version 72.0.1, as there is a major vulnerability in older versions of the Firefox browser.

 

[PatrickA5]

I have 2 managed accounts at Fidelity. And yes, I think it would be pretty hard for anyone can get at those. I have 4 other non-managed accounts with them. 3 of them are on "Lockdown". An optional feature available in their Security Center.

I also use the Lockdown feature at Fidelity for all of our Retirement accounts. Nobody (including myself) can withdraw money or transfer between accounts without Unlocking first. Of course, if the thief can log onto my account (using 2FA) then they can also unlock my accounts (again using 2FA), so I'm not really sure that it accomplishes much. Maybe it would prevent a general data breach or something?

 

[Cobra9777]

I also use the Lockdown feature at Fidelity for all of our Retirement accounts. Nobody (including myself) can withdraw money or transfer between accounts without Unlocking first. Of course, if the thief can log onto my account (using 2FA) then they can also unlock my accounts (again using 2FA), so I'm not really sure that it accomplishes much. Maybe it would prevent a general data breach or something?

I think the transfer lockdown is mainly intended to stop fraudulent wire transfers, etc that originate outside of Fidelity at less secure institutions. For example, if you had a bank account linked to a Fidelity brokerage or cash management account, and the bank login was compromised, the lockdown would prevent someone from transferring money from your Fidelity account to the bank, prior to emptying your bank account.

 

[gauss]

I think the transfer lockdown is mainly intended to stop fraudulent wire transfers, etc that originate outside of Fidelity at less secure institutions. For example, if you had a bank account linked to a Fidelity brokerage or cash management account, and the bank login was compromised, the lockdown would prevent someone from transferring money from your Fidelity account to the bank, prior to emptying your bank account.

Thank you for that example. I might want to enable lockdown if it does give a tangible security benefit of some sort.

I tend not to enable security features if I don't understand how it adds to security, so that I don't give myself a false sense of security. I have also held off providing "voice recognition". It seems like it could be more about lowering their costs and not having to verify you in the traditional fashion.

-gauss

 

[braumeister]

I have also held off providing "voice recognition". It seems like it could be more about lowering their costs and not having to verify you in the traditional fashion.

FWIW, here's my story. Last year I was in a remote part of northern Scotland when I ran into a problem with Schwab. When I found out about it, I was on a busy street far from my hotel, and I needed to get their help with something.

It would have been a royal pain to try going through the drill of finding login details, so I was very happy to be able to use their voice recognition feature.

"At Schwab, my voice is my password"

That's the phrase you have to say, and even in the noisy environment where I was standing it worked perfectly. So I can vouch for the usefulness of the feature.

 

[stephenson]

Lockdown at Fidelity means a bit more than protection against outside action ...

In my experience it means I can’t transfer out from Fidelity to another bank ... without turning it off, which is easy to do. Also easy to turn back on.

I like it!

 

[nwsteve]

Lockdown at Fidelity means a bit more than protection against outside action ...

In my experience it means I can’t transfer out from Fidelity to another bank ... without turning it off, which is easy to do. Also easy to turn back on.

I like it!

+1
I have been using for a few months and while it can be a pain, for the bad guys it will definitely slow them down. I have 5 of our 6 accounts locked. The unlocked one handles our bill pays, ATM, and auto pay. It is the smallest and when I set up, our rep was a bit uncertain how it would impact bill pays and auto pay.
I know that I cannot even do a transfer from one our taxable to another if one of them is locked down. I get a message on screen, something to the effect "Fidelity can not process your request at this time. Please contact a rep" I now know it alerts me I forgot to unlock the account.
We keep all IRA and Roths locked except when doing a RMA and then it only unlocked briefly to do transfer.

 

[jazz4cash]

Thank you for that example. I might want to enable lockdown if it does give a tangible security benefit of some sort.



I tend not to enable security features if I don't understand how it adds to security, so that I don't give myself a false sense of security. I have also held off providing "voice recognition". It seems like it could be more about lowering their costs and not having to verify you in the traditional fashion.



-gauss

I like it when my financial providers lower their costs. Seems like you should ask some questions about voice recognition and maybe try it out. I assume you could cancel if you wish. It was a relief to me when my Fido VISA was hacked and they used VR to verify my identity. I didn’t need to say any magic words.

 

[sengsational]

Voice recognition really is a true additional factor because it's "something you are", as opposed to "something you know". I do wonder, though, how well it works. My daughters both sound a lot like my wife on the phone...I should have my daughters try to "hack" my wife's voice recognition, hehe! I have a sneaking suspicion that the voice recognition is set a little bit on the "loose" side so they don't have upset customers. But it would presumably keep out most of the hackers I'm worried about, since most of those probably don't speak English as their primary language (easy to discriminate). But actually, thinking more about it, I'm not sure it works on language "cadence"...it might work on frequency analysis. Hmm.

 

[jazz4cash]

I’d like to know more about how VR works as well. At Fido it’s pretty seamless sometimes the rep will acknowledge I’ve been verified and other times they don’t say anything. Maybe it depends on the transaction but surely if you can’t voice verify they would have alternate procedure. I wonder how a bad phone connection would affect VR.

 

[JustCurious]

Lockdown at Fidelity means a bit more than protection against outside action ...

In my experience it means I can’t transfer out from Fidelity to another bank ... without turning it off, which is easy to do. Also easy to turn back on.

Yes, but if a thief or a hacker had "inside" access to your account, they would be able to turn it off themselves, so the lockdown feature is nice, but it's not very effective against inside jobs.

 

[Tracer]

The Lockdown option at Fidelity adds one more level of security. I would think a hacker, even an inside job, would take the path of least resistance and choose accounts that are the easiest to hack.. no Lockdown, no 2FA. Just like I think a house burglar would choose houses with no high fences and no security lighting, etc.

 

[jazz4cash]

I really like the Fidelity Voice Recognition system and Money Transfer Lockdown. The Fido website does a great job showing all my accounts grouped together but unfortunately workplace accounts don't really get equal status.

*Workplace accounts are not eligible for Money Transfer Lockdown which really makes the feature nearly worthless for me. 75% of my holdings at Fido are workplace savings.

*Workplace accounts are not included in the daily change calculation displayed prominently in the webpage header. I've complained to Fido about this. Might as well not show data at all rather than inaccurate data.

*Workplace accounts generally require a "specialist" to initiate transactions causing me to bounce back and forth between reps when I call in with issues for more than one account.

Oh well, I'm sure they'd be happy to roll it over to a Fido IRA

 

[MRG]

The Lockdown option at Fidelity adds one more level of security. I would think a hacker, even an inside job, would take the path of least resistance and choose accounts that are the easiest to hack.. no Lockdown, no 2FA. Just like I think a house burglar would choose houses with no high fences and no security lighting, etc.

I'd like to think a hacker who had breached security would have the common sense to go after accounts with more $$$$$ than mine.

 

[Onward]

Why would an intruder set up a new account for you, rather than trying to drain one of your existing accounts? This doesn't sound like a hack.

 

[COcheesehead]

Why would an intruder set up a new account for you, rather than trying to drain one of your existing accounts? This doesn't sound like a hack.

Thank you. I have been trying to figure out the “why” and everything points to a mistake rather than a hack.

 

[teejayevans]

Why would an intruder set up a new account for you, rather than trying to drain one of your existing accounts? This doesn't sound like a hack.

Sounds like what Wells Fargo was doing.

 

[RetireBy90]

The Lockdown option at Fidelity adds one more level of security. I would think a hacker, even an inside job, would take the path of least resistance and choose accounts that are the easiest to hack.. no Lockdown, no 2FA. Just like I think a house burglar would choose houses with no high fences and no security lighting, etc.

I did computers for 40 years and there is a great deal to be said for be more secure than your neighbor. Only got hacked one time and it was a zero day hack. That is first day the vulnerability was exploited so no fix was available. However, the bad guys today can just scan computers for a specific vulnerability or set of vulnerabilities so you can be secure against 99% of known issues but still fail with others that are less secure than you. If you can do defense in depth with 2FA, good passwords, lockdowns and VR you can make it harder for hacks to cost you.

 

[MRG]

Thank you. I have been trying to figure out the “why” and everything points to a mistake rather than a hack.

+1

See post #19. It's not looking like anything but a mistake. Most service providers stop looking for hacks when they realize you took a shot to your foot.

 

[John Galt III]

Here's a question I have. I'm starting up membership in a new Credit Union. I just want a CD there. Would I be safer NOT setting up an online banking account with them, than setting one up which could be hacked? A hacker would need to get into my email account in order to set up the banking account.

 

[MRG]

Here's a question I have. I'm starting up membership in a new Credit Union. I just want a CD there. Would I be safer NOT setting up an online banking account with them, than setting one up which could be hacked? A hacker would need to get into my email account in order to set up the banking account.

Why can't the hacker just use your data where its stored? If Vanguard allowed me to run one SQL statement I'd make everything on their systems mine(I really would not attempt it as you will be found out, prosecuted and sent to prison).

Point is yes you could do that. It may not help depending upon how the hack is implemented.

 

[Kwirk]

Here's a question I have. I'm starting up membership in a new Credit Union. I just want a CD there. Would I be safer NOT setting up an online banking account with them, than setting one up which could be hacked? A hacker would need to get into my email account in order to set up the banking account.

Why would the hacker need to get into your email account? Will there be no snail mail?

 

[ownyourfuture]

Warning: Profanity
I love my smart phone & everything it can do, but when it comes to business, whether it be Fidelity, American Express, Banking, etc.
I'll do that at home on my iMac.

 

[Archman]

Perhaps an account was set up my a secret benefactor. And now he/she will not be able to add to that account.

 

[Archman]

No money lost since I called within a few days of the Fidelity email.

Today, I saw on Fox Business News that Fidelity will cover your losses if you get hacked. I'm gonna have to check that out, since I have accounts with Fidelity.