Whenever you want to move brokerage accounts, you typically use ACATS to do it.

ACATS stands for Automated Customer Account Transfer Service and it allows you to transfer assets from one brokerage to another. By doing it through ACATS, sometimes called ACAT, you can make the transfer without any tax implications. You’re moving shares from one brokerage to another.

Thieves, armed with all of your information, are able to exploit this system to transfer your assets.

Here’s how they do it and how you can stop it.

Anatomy of an ACATS Scam

Thieves have collected a ton of information with all the data breaches we hear about.

If they have your Social Security number, are able to answer those brokerage challenge questions based on your credit report, and have enough other personal information to open an account… they have enough to pull off this theft.

This is how it goes:

1. The thief will open a new brokerage account with your name and information. They don’t have to put any money in this account since it will be the recipient of an ACATS transfer. Opening a brokerage account doesn’t require a credit check so it’ll never appear on your credit report.
2. They will then initiate an ACATS transfer from your main brokerage, where you have a load of money, to their new account that they control. They will need your account number to do this. They will not transfer it all but a little at a time so you might not even notice it (and where the brokerage’s security may not catch it).
3. The ACATS transfer takes 3-7 business days but can settle in as little as 4-5 business days. Once the transfer completes, brokerages say that it cannot be reversed.
4. The thief will then sell the assets and liquidate the account.

This can all happen in a matter of a couple of weeks. I only check my brokerage accounts once a month so a thief could get in on the 3rd and be gone with my money before mid-month!

How can you stop it?

This Rare Scam Does Happen

This type of scam is not common. It requires a lot of information and a bit of bad luck, but it does happen.

Here’s a story from Bogleheads.org from February 2025 about how someone temporarily lost $100,000 in their Vanguard account to this scam:

I discovered that our taxable account at Vanguard had been slowly pilfered of approximately $100,000.00 in stocks transferred by ACATS to 2 different brokerage accounts that were not mine over a period of time.

These stock transfers were taken out of our account each time we received a dividend beginning in May 2024. We hold a substantial amount of Vanguard Tax-managed Balance Fund. In October I compared our account balance to that of the end of the year and was surprised to find that our Vanguard Tax managed Balance fund was way down in value.

It actually took a lot of digging on my part to finally figure out what was going on in that account. Every few months 750 shares of that fund were transferred to either Fidelity or Interactive Brokers. Transfers were made 3 times before I realized it was happening. I contacted Vanguard as soon as I discovered it and they immediately locked down my account.

Each share of the Vanguard Tax-Managed Balanced Fund (VTMFX) is around $40 so 750 shares is “only” around $30,000.

We had no emails or text messages letting us know this was happening. My husband and I both get text and emails regarding any activity normally, but we got nothing about these transfers. We have had 2 factor identification active on our accounts for at least a couple of years. None of that mattered. I was told by Vanguard that ACATS would not trigger any of that as the withdraw came from another broker that verified to them that it was me doing the withdrawl.

This is the scary part – there was no notification whatsoever. No way to know unless you noticed it.

We got the October transfer returned to us in November. I was told we might not get the May and July transfers back because they were done over 60 days before I discovered them. My account was kept locked up for several months by the fraud team. We finally did get the other 1500 shares returned in January.

So, we ultimately did not lose money on this, however, had this gone on another quarter or two, I am not sure we would have been made whole.

In this case, they were lucky that it was reversed. I don’t know what would’ve happened if the thief liquidated the shares and was able to make out with the money. Losing $100,000, if even for a few days, is scary.

The thread goes deeper into the details but as you can see, this is a real risk and one that could happen to anyone.

How to Set Up an ACATS Lock

Brokerages know this scam is possible and so you are able to set up an ACATS lock so the transfer cannot take place unless you unlock it. (while you’re at it, turn on two-factor authentication too)

Most brokerages do not have a way to do an ACATS lock online, Fidelity seems to be the exception to this. In most cases, call up or initiate an online chat with customer support, get to the security department, and request a lockdown. You could also send them a letter but it’s 2026, who does that?

Charles Schwab

Charles Schwab has no online method of turning on an ACATS lock but you can call 888-3-SCHWAB (888-372-4922) to turn on a lock. You will have to call to turn it off too.

E*Trade

E*trade also does not offer an ACATS lock and you have to call 800-387-2331 to turn on (and off) restrictions.

Fidelity

It’s called a Money transfer lock and you can turn it on by going to the linked page. It prevents outbound money transfers, transfers between Fidelity accounts, transfer of shares and assets to another institution, and individual withdrawals.

You can still deposit or transfer money into your account, write checks and use direct debit, trade, schedule RMDs, and use BillPay.

TastyTrade

TastyTrade does not offer an online way to initiate a lock, you will have to contact them through customer service to request a lock.

Vanguard

Vanguard has no online method of turning on an ACATS lock but you can call them at 877-223-6977 to set it up. Request the security department and request that they put a restriction on your account. To turn it off, you have to call in again. The Bogleheads forum explains the process.