Sage Advice

[mrfeh]

Fidelity's Money Transfer Lockdown is special-purpose. You know how, if you want to open a brokerage account at (say) Schwab using assets transferred from Fidelity, you only have to contact Schwab and then Schwab takes care of everything? Apparently there are crooks who can fool Schwab (or any brokerage firm) that they are you, then once the new account has the assets they withdraw the funds. So the lockdown communicates that you did not authorize any other brokerages to take assets from your Fidelity account.

It's called an ACATS (Automated Customer Account Transfer Service) transfer, and that does seem to be the primary reason it was developed.

There are other types of transfers that are also blocked.

 

[jazz4cash]

Yes, but if the hacker got into your email, they can intercept that 2FA (if dome by email).

I think that the only direct debits allowed are ones that existed prior to you setting the lock. So a @engineernerd says above, it could stop a 'pull' like another brokerage does under your direction, if a hacker was able to impersonate you.

I was only responding to some specific concerns you expressed. Yeah, you have to actually setup 2FA and be responsible for securing your email or whatever device used. I like using my laptop to initiate the transaction but getting OTP on my phone even though SMS is considered inferior. I’m not saying anything is foolproof. It’s layers of deterrence. As for direct debits Fidelity says they are excluded from MTL and that is a major flaw IMO. You can disable MTL, schedule a push transfer, and re-enable MTL immediately to retain protection. There is plenty of confusion wrt what MTL does and does not do.

In OP’s scenario, a hacker having login credentials could get the account and routing #’s to setup a direct debit to another account without even bothering to create an account in the victim’s name (as far as I can tell).

 

[mrfeh]

I was only responding to some specific concerns you expressed. Yeah, you have to actually setup 2FA and be responsible for securing your email or whatever device used. I like using my laptop to initiate the transaction but getting OTP on my phone even though SMS is considered inferior. I’m not saying anything is foolproof. It’s layers of deterrence. As for direct debits Fidelity says they are excluded from MTL and that is a major flaw IMO. You can disable MTL, schedule a push transfer, and re-enable MTL immediately to retain protection. There is plenty of confusion wrt what MTL does and does not do.

In OP’s scenario, a hacker having login credentials could get the account and routing #’s to setup a direct debit to another account without even bothering to create an account in the victim’s name (as far as I can tell).

Direct debits occur with MTL on.

I use a CMA at Fido as our primary spending/checking account. MTL is always on, but debits for paying bills, etc still execute.

 

[GoBirds]

Social media is also another way to get that company’s attention.

Is there reason to believe that apps are safer than websites in this scenario?