Suing Brokerage Firms for Stolen Funds Through Hacking and Phishing

In an article by Susan Antilla entitled “Here’s Why You Should Carefully Read Your Brokerage Statements in Down Markets” in the “The Street,” she advises investors to look closely at the fine print in investment firms’ clauses that “guarantee” investors’ money back if their accounts get hacked. Charles Schwab’s “Security Guarantee,” TD Ameritrade’s “Asset Protection Guarantee,” and Ameriprise Financial and Scottrade’s “Online Security Guarantee” are all examples of the promises brokerage firms make to an investor in the event his account gets hacked. Antilla warns that these “guarantees” really only solidify reimbursement if the investor himself has been vigilant regarding his own security. Some examples are:

Did you share your password with someone who wound up stealing your money? Your broker will consider that a transaction that you authorized — a reasonable policy considering that you gave away the keys to your account.

Do you regularly check your account for unauthorized transactions? Fidelity, Scottrade, TD Ameritrade, Ameriprise and Merrill Lynch expect you to review all the information they send in the mail or check your online account frequently for activity that doesn’t look familiar. (In the recent market volatility, some advisers and journalists were urging investors not to look at their statements. Ignore that dangerous advice).

Are you savvy about spotting phony “phishing” emails that try to dupe you into thinking you’re dealing with your broker or fund company? Ameriprise says you can’t respond to, open an attachment in, or click on a link within an email “if you suspect the message is fraudulent.” Other firms have a similar requirement that you not fall for phishers, so take time to learn how to spot and avoid these scams if you’re counting on reimbursement protection.

Another caveat that firms require is the creation of “safe” and hard-to-guess passwords that the investor does not use for any other account. “Safe” and “hard-to-guess” are arbitrary terms, and most firms provide no guidance as to how the terms are defined. One firm, Vanguard, also requires a password to be different from those on other websites, changed on a regular basis, be complex in nature and at least eight characters long.

Cybersecurity

Cybersecurity threats remain one of the most significant risks many firms face, and  in 2017, FINRA will continue to assess firms’ programs to mitigate those risks.¹ FINRA recognizes there is no one-size-fits-all approach to cybersecurity, and we will tailor our assessment of cybersecurity programs to each firm based on a variety of factors, including its business model, size and risk profile. Among the areas FINRA may review are firms’ methods for preventing data loss, including understanding their data (e.g., its degree of sensitivity and the locations where it is stored), and its flow through the firm, and possibly to vendors. FINRA may assess controls firms use to monitor and protect this data, for example, through data loss prevention tools. In some instances, we will review how firms manage their vendor relationships, including the controls to manage those relationships. The controls should be informed by a number of factors, including a clear understanding of any customer or employee personally identifiable information or sensitive firm information to which vendors have access. We may also examine firms’ controls to protect sensitive information from insider threats. The nature of the insider threat itself is rapidly changing as the workforce evolves to include more employees who are mobile, trusted external partnerships and vendors, internal and external contractors, as well as offshore resources.

We also draw firms’ attention to two areas in which we have observed repeated shortcomings in controls. First, cybersecurity controls at branch offices, particularly independent contractor branch offices, tend to be weaker than those at firms’ home offices. We have observed poor controls related to the use of passwords, encryption of data, use of portable storage devices, implementation of patches and virus protection, and the physical security of assets and data. Second, in multiple instances, firms have failed to fulfill one or more of their obligations under Securities Exchange Act (SEA) Rule 17a-4(f) that requires firms to, among other things, preserve certain records in a non-rewriteable, non-erasable format, commonly known as write once read many (WORM) format. This includes situations where vendor-provided email review and retention services did not fulfill SEA Rule 17a-4(f) requirements. FINRA recently announced enforcement actions against 12 firms for, among other things, failure to preserve broker-dealer and customer records in WORM format.²

If you lost money because of hacking or phishing, you may be able to sue your brokerage firm in the Financial Industry Regulatory Authority (FINRA) arbitration forum. They may be liable for your investment losses because of hacking or phishing, so please call our securities law office in Chicago, Illinois for a free consultation with an attorney. We take cases on a contingency fee basis only and there is no obligation. Our number is 312-332-4200.