Last updated October 29, 2026
As Criminal Networks Steal Americans’ Life Savings, Financial Firms Have Insulated Themselves From Liability
OverviewLost money from an investment or retirement account to a scammer? You probably won’t get it back. Federal law doesn’t require financial services to reimburse you—even when the theft wasn’t your fault. Our investigation found that the companies managing our savings have carefully insulated themselves from liability for theft. Our report found:
|
Con artists working for sophisticated organized-crime networks and adversarial foreign governments are draining tens of billions of dollars a year from Americans’ investment and retirement accounts. Unlike with credit card fraud, investment services don’t have to cover such losses, and the industry has fought proposals to change that. Lose money from your 401(k), IRA, or brokerage account to a scammer and you probably won’t get it back. Financial institutions have inserted language into their terms and conditions insulating them from any responsibility.
Although losses continue to pile up, many financial firms, social media companies, and other tech outfits aren’t doing enough to stop it. Michael Bixby, an attorney who represents financial fraud victims, said, “We are drowning in a sea of fraud.”
These problems will only get worse. Criminals are employing increasingly sophisticated, AI-enabled tricks to identify victims and hone attacks. Because stolen funds usually get swapped for cryptocurrency, transfers quickly become untraceable.
For this report, Consumers’ Checkbook interviewed victims, attorneys representing investors who lost money to scams, and consumer advocates. We also conducted an informal survey of financial advisors. And we reviewed the terms and conditions of major financial firms, policies of major trade associations tasked with overseeing investment companies, congressional testimony and reports, government audits, and sifted through two decades of arbitration records.
We found a system that offers scant protection for consumers, diminishing oversight, and policies that shelter from liability the companies managing more than $70 trillion in individual investment and retirement accounts.
Financial Scams Are Now a ‘National Crisis’
“It is incumbent upon the financial firms to adapt to this landscape. They should be doing that voluntarily.”
— Corey Frayer, Consumer Federation of America
How much money do Americans lose each year to fraud and scams? No one knows for sure. The Federal Trade Commission (FTC) estimates that just two percent of victims who lose less than $1,000 to fraud report the crime, and only seven percent report larger losses. But the estimates are staggering: For 2024, the FTC estimated that U.S. consumers lost as much as $195 billion. For older adults alone, losses are as high as $81.5 billion annually. The problem grows worse each year.
“I think we should just keep repeating that number. Because that’s the level of a national security threat,” said Brady Finta, a former FBI agent who now runs the National Elder Fraud Coordination Center, a nonprofit that is pushing financial services, social media, and fintech firms to aggregate data to prevent scams and assist law enforcement agencies.
Many scammers work for organized crime rings; others are funded by adversarial foreign governments. “You’ve got all these scam compounds operating throughout Southeast Asia, but they’re expanding into Africa and the Middle East,” said Clark Flynt-Barr, AARP’s government affairs director for financial security. “The Mexican cartels have gotten in on this.”
Joe Wojciechowski, president-elect of the Public Investors Advocate Bar Association (PIABA), a collection of attorneys who focus on representing investors with securities litigation, said that his clients’ livelihoods “have been destroyed by coordinated attacks. There are national security implications here. These aren’t bank robbers; these are sophisticated, highly trained people who know how to manipulate.”
For example, in 2025, $1.5 billion was stolen from accounts at Bybit, a cryptocurrency exchange platform. “We know for a fact that $400 million of that went to North Korea’s nuclear missile program,” said Corey Frayer, director of investor protection for the Consumer Federation of America. “This is a clear and present national security danger.”
A U.S. House Committee on Financial Services report found that as many as 150 industrial-scale scam centers operate around the world, staffed in sweatshops by some 300,000 trafficked workers. “A lot of the people who are working in these compounds responded to what they thought was a job offer; they thought they were going to go work in a call center,” AARP’s Flynt-Barr said. “[They] didn’t realize ‘I’m going to go scam people for a living and my passport’s going to be taken away.’ And they get punished if they’re not good at it. You can see why the scams have gotten really good.”
Criminals usually quickly swap stolen money for cryptocurrency, letting them move funds virtually anonymously. The transactions are instantaneous and banks can’t reverse them. Laundering tens of billions of dollars in hard currency used to take months or years. “With crypto, it’s insanely fast,” Frayer said.
Artificial intelligence is also supercharging scams. Finta describes the adversary as “highly sophisticated companies that reinvest in continuous improvement.” A bipartisan Senate Aging Committee staff report found that over 82 percent of phishing emails are now AI-assisted. Scammers can even subscribe to inexpensive crime software.
“It is incumbent upon the financial firms to adapt to this landscape. They should be doing that voluntarily,” said Frayer.
They’re not. Most firms managing our investment and retirement accounts have each spent millions to shore up their own defenses against hacks, but they’ve also quietly and carefully protected themselves from responsibility for client losses. When thefts occur, victims often report getting little help. And because financial service companies sell so much sensitive customer data to third-party marketers and data brokers, they’re making it easier for criminals to target us.
Many Scams Now Start as Sophisticated ‘Social Engineering’ Attacks
“This can happen to anybody.”
— Michael Bixby, attorney representing financial fraud victims
John Breyault, director of Fraud.org, a project of the National Consumers League, warned that, “As the banks and the other providers have increased their efforts to secure their systems against external attacks, the scammers have shifted towards social engineering attacks.”
Breaking into a brokerage’s network and taking over numerous accounts has become, at least for now, difficult. So, criminals fool accountholders into giving up their money. The institutions know this is a massive threat but often don’t provide any friction when victims are being conned.
In 2022, Lori Flowers lost $675,000 to a scammer she met after replying to an innocuous message on LinkedIn. The con artist then slowly groomed her via texts and phone calls; after four months she thought they were close friends. He eventually asked Flowers to lend him $400,000 to cover a short-term business cash crunch. The thief showed Flowers detailed account statements from his “bank” and even spoofed a call from it.
“I surely thought I was too smart to fall for something, that the red flags would be red. And I’m savvy, I’m educated, I’m not naïve,” Flowers told Checkbook. “I developed a friendship with this person…Turns out he was a full-on script.”
Wanting to help a friend in need, Flowers withdrew $400,000 from her 401(k) account. “Basically, I was taking the money out for 90 days and he was going to pay me back,” she said. “He sent me a half a ream of documentation” that showed he could repay it.
Even though her withdrawal was unusual, the company rep for Flowers’ 401(k) only asked why she was requesting the transfer. “A business investment,” she replied. He warned her that if she didn’t repay the money within 90 days, she’d owe taxes and an early-withdrawal penalty. Then he processed the request.
To wire the funds to the scammer, Flowers had to obtain a paper check from her 401(k) firm, which she brought to her Bank of America branch. A manager there asked only whether she knew the recipient of the funds—then sent the wire.
Over the next few weeks, the criminal convinced her to send additional payments—$100,000 from Wells Fargo and $90,000 from SoFi—that she obtained via personal loans that were approved online with no human interactions.
There was no repayment because there was no business venture and no friend. Flowers, then 54 with a nearly perfect credit score, was forced to file for Chapter 13 bankruptcy protection. Years later, she’s still paying $5,690 a month to cover debt from the personal loans and tax penalties.
Flowers’ story is shockingly common. She shared it as part of AARP’s “Fraud Wars” series, which reported how she and other victims lost money to con artists on dating apps or who pose as police, federal agents, or the IRS. The criminals often spent months slowly building trust.
Federal data indicate these crimes aren’t affecting just older adults: FTC figures show scammers succeed against 20-somethings at roughly twice the rate they do seniors. But older adults are prime targets because they usually have more money.
“This can happen to anybody. People think, oh, that person shouldn’t have fallen for this,” Bixby said. “But if you understand the psychology behind it…I’ve talked to people who are certified fraud examiners who’ve been victimized.”
Checkbook conducted informal, anonymous interviews with a dozen financial advisors and planners, most affiliated with major investment firms like Merrill and Schwab. Nearly all recounted multiple harrowing instances of clients who were conned into sending, or nearly sending, criminals their savings.
One financial planner with about 250 clients told Checkbook: “I can off the top of my head give you eight to 10 examples of my clients nearly being swindled.” In one case, he had to contact an overseas bank and persuade it to reverse a $350,000 transfer before criminals could grab the funds. The scammers had fooled his client by posing as an IT help desk, convincing him to install a phone app that allowed them to drain his investment account within minutes.
Another wealth manager said he frequently gets calls from criminals posing as clients. “They have their social security numbers, dates of birth, addresses, and previous addresses. But we know most of our customers by voice, so we just hang up and call the customer directly to make sure.”
Victims, attorneys who try to reclaim lost money, and consumer advocates all said that many investment and retirement firms offer little friction when their customers request transfers that should raise obvious red flags.
“I’ve heard stories where the advisor manages to intervene soon enough to stop the money from getting into the hands of the scammers. But those instances are anecdotal and incredibly rare compared to the number of people who lose money,” Breyault said.
Financial Services Aren’t Doing Enough to Spot or Prevent Theft
“Where was the friction? Put up a speed bump. Do something to slow this down.”
— Joe Wojciechowski, Public Investors Advocate Bar Association
“I’m not sure what my banker could have said, or my financial planner could have said, that would have stopped me, but we’ll never know because they didn’t do it,” Flowers said. She thinks moving $400,000 from a retirement account to a savings account to someone else’s overseas account “should trigger a whole bunch of questions. Like, my average transaction was $65 at Harris Teeter.”
“Where was the friction? Put up a speed bump. Do something to slow this down,” said Wojciechowski, whose clients’ financial institutions often didn’t notice obvious red flags about scams and likely money laundering. “You dig into one of these cases…and you’ll see access to the account from IP addresses that are VPN-masked or coming from overseas that have never contacted the account before,” he said.
Wojciechowski said his mantra is: “One call destroys it all. I’ve spoken to hundreds and hundreds of victims of these kinds of scams. Some of them do get on the phone with the brokerage firm or the bank or whoever it is. A phone call will stop 85 percent of these thefts.” But Wojciechowski said that rarely happens.
One problem? Financial institutions are required to process legitimate transfer requests quickly—within a few business days. Often, they’re automated and occur within hours. This speed enables criminals to capture funds and swap them for crypto.
There’s evidence that timely intervention works. In 2024, the FBI launched Operation Level Up, which mines fraud complaints and financial data to identify scam victims, then tries to contact them mid-scheme. As of late 2026, agents had reached more than 10,000 victims—77 percent had no idea they were being defrauded—and prevented an estimated $660 million in losses, according to the FBI.
Financial services have even better data than the FBI, but many aren’t proactive enough in spotting and halting scams.
In 2023, the Financial Industry Regulatory Authority (FINRA), the self-regulatory association for broker-dealers, issued a notice explicitly identifying customer notification—via email, phone call, or mobile push notification—as an “effective practice” to mitigate the risks of fraudulent transfers. But it only recommended this practice; it’s not required. And too few companies do it.
In August 2026, Sens. Ron Wyden (D-Oregon) and Elizabeth Warren (D-Massachusetts) wrote to FINRA that firms rely on “wildly inconsistent” transfer protocols and some companies’ systems “created a massive security vulnerability that fraudsters are exploiting” because they “require zero notification to or authentication from the actual accountholder.” The senators also cited a “widespread failure” by many firms “to reliably notify consumers that a transfer is underway.” They noted that some firms, including Citibank and Wells Fargo, “offer absolutely no notice or warning to their customers, stripping them of the vital three-day window to intervene and halt a fraudulent transfer before their assets are stolen.”
The letter urged FINRA to, at a minimum, require financial institutions to send alerts to accountholders when transfer requests are received and give them several days to respond. It also requested that FINRA require transfer locks, which allow customers to prevent any transfers without explicit approval. Many companies don’t offer transfer locks.
Frayer thinks financial services are also enabling criminals by sharing too much customer info with third-party marketers and data brokers. When customers agree to many firms’ terms and conditions, “Institutions have given themselves permission to share or sell customer data to whomever and in whatever way they please,” he said. “Sharing PII [personally identifiable information] is exactly what allows scammers to identify these people and take advantage of them. So, they are also creating the problem that they are supposedly trying to defend their customers from.”
During congressional testimony, leaders of financial services often cite increased law enforcement resources and consumer education as possible solutions to rampant theft. They also say tech companies, cellphone networks, and social media outfits should do more to halt fraud at its source.
“When you talk to the financial institutions, they’ll point to social media and telecommunications companies and say, ‘that’s where we should all be focusing,’” Flynt-Barr said. “‘They’re all spoofing our bank numbers. That’s where people are meeting their scammers. We don’t have enough context to stop those scams.’ But there is certainly a lot more that they could be doing.”
Investor Protection Laws Are Scarce
“There’s nothing requiring the institution to return the money—or even flag the suspicious transaction.”
— John Breyault, director of Fraud.org
No institution that touched Flowers’ money broke any law by failing to warn her that she was being scammed—or by transferring the funds in a way that made it impossible to recover them. No laws require firms managing investment and retirement accounts to protect you. These companies are mostly self-governed, and many financial firms don’t even follow best practices set up by their associations.
As we often advise readers, credit cards are the safest payment method because the federal Fair Credit Billing Act and the Truth in Lending Act provide enormous consumer protections. Even if you accidentally send money to scammers, so long as you report the problem, your credit card company must reverse fraudulent charges.
Similar laws exist for debit card transactions and transfers from checking and savings accounts: Banks must reverse—and eat—unauthorized electronic transfers. (If a criminal manipulates you into sending the money, the bank isn’t required to issue a refund.)
But there are no laws requiring firms managing investment or retirement accounts to recover or return funds lost to scams or theft, and we found that they rarely do so.
What does exist are permissions, mostly set up by the industry’s own self-regulating organizations. So, under FINRA Rule 2165, brokerages may pause suspicious disbursements from accounts held by older adults for up to 25 business days (extendable to 55 days if the firm reports the matter to authorities). But that simply permits firms to stop fraud—it’s not a duty.
The laws and rules governing retirement accounts are somehow even weaker. The firms holding $35 trillion of our retirement savings in IRAs and 401(k)s are governed by the Employee Retirement Income Security Act (ERISA), a law enforced by the U.S. Department of Labor (DOL). It assigns “fiduciary responsibilities,” meaning companies must remain loyal to customers and act in their best interests. Yet somehow these companies don’t believe they’re obligated to protect their clients from fraud. No hold authority. No requirements to verify transfer requests or warn victims of even obvious scams. No bans on selling or sharing data. We could find no DOL enforcement actions against companies for failure to protect their clients from scams. Courts have even split on whether a customer whose 401(k) is drained can sue to get it back.
Brady Finta, the former FBI agent, said the financial services industry points to the lack of laws and rules repeatedly: “A lot of companies say, ‘maybe we could [take steps to prevent scams], but since we don’t have to, we’re not going to.’”
“Even if everybody agrees that the reason Mr. Jones sent the money was because he was being targeted by a sophisticated overseas scammer...there’s nothing requiring the institution to return the money—or even flag the suspicious transaction,” Breyault said.
Similarly, as a “best practice,” since 2018 FINRA has called on its members to set up systems to spot fraud and requires them to “make a reasonable effort” to collect a “trusted contact person” for each account. But according to FINRA’s January 2025 exam report, many firms haven’t done that. Often, the trusted contact is the accountholder. The consequence, according to three securities attorneys who searched FINRA’s disciplinary database for a Wake Forest University law journal analysis: Not one enforcement action for failing to respond to red flags of financial exploitation or for failing to collect and use trusted contacts.
“Trusted contacts that remain on the shelf are nothing more than window dressing,” PIABA wrote to FINRA this spring in a letter that, five months later, had drawn no response.
Worse, scam victims often have little recourse. Virtually every brokerage requires customers to agree to terms and conditions stating that all disputes will be resolved via private arbitration, usually before FINRA—the industry’s own self-regulator. The results, per congressional testimony by PIABA executive director Jennifer Shaw: investors win fewer than 30 percent of decided arbitration cases.
“Arbitration is always rigged and extremely harmful to the consumer,” CFA’s Frayer said.
Even when companies lose in arbitration, the reasons are rarely made public. FINRA publishes its decisions online, but those summaries almost never include details or explanations for its rulings; under FINRA’s rules, an “explained decision” requires consent from both sides. Because financial institutions opt to suppress details, reporters, researchers, and prospective customers can’t measure how often scam victims try to recover funds via forced arbitration. Checkbook’s own search of 20 years of published FINRA arbitration award rulings turned up few cases involving fraud. We couldn’t even find scam cases we knew about, such as when Morgan Stanley was ordered to repay $843,000 to a client in her seventies who got conned into buying gold bars for fake U.S. Treasury agents.
Every consumer advocate we spoke with said that the U.S. needs stronger consumer protection laws—and noted that the financial industry has lobbied hard against them.
For example, when Congress considered the Protecting Consumers from Payment Scams Act—which would treat fraud-induced transfers like unauthorized ones, requiring companies to refund lost money—the American Bankers Association and other trade groups formally opposed it in a 2024 joint letter. The industry’s argument, stated approvingly by Republicans in a House Financial Services Committee staff report, was that shared liability would create a “moral hazard,” dulling customers’ caution and inviting “first-party fraud where bank customers themselves coordinate with criminals to defraud their financial institution and split the profits.”
Attorneys who represent victims told Checkbook that the lack of laws and rules makes their cases tough, but they often succeed due to other legal norms. “Brokerage firms have for generations now had their own independent know-your-customer rule,” Wojciechowski said. “And it’s just not taken seriously enough. The rules and obligations exist…unfortunately, the regulators do nothing about it and have taken no steps to enforce it.”
The Industry Carefully Protected Itself. You? Well, Read the Fine Print.
Consumers’ Checkbook reviewed the terms and conditions for major financial institutions and found that nearly all have fine print absolving them from responsibility for most fraud.
The criminals who stole $120,000 from Brian Wiest, a Boise, Idaho, wealth manager, didn’t need to persuade him to transfer his money because they never contacted him. Wiest told Checkbook that in 2020, hackers broke into his Fidelity IRA and changed the contact information. Over a few weeks, they cashed out the account and directed the money to a Citibank account they had created using Wiest’s name and stolen social security number. Then they immediately transferred the stolen funds to untraceable overseas accounts.
Because Wiest set up his Fidelity account as a retirement fund that he didn’t plan to tap for decades (and rarely looked at), he didn’t discover the crime for more than a year. After that, the FBI examined his devices and verified he’d clicked nothing and shared nothing; his money, part of a larger $10 million multi-victim scheme, was simply gone.
Wiest said he followed every instruction Fidelity’s and Citibank’s investigators sent. “Finally, after 18 months or so, they said, ‘Okay, we’ve concluded our investigation and we’ve verified or proven that through no fault of your own, they accessed your accounts.’ And I felt relieved.” But Wiest didn’t get back a dime because, according to Fidelity’s policies, he failed to notice and report the theft within 30 days. It didn’t matter that the criminals forwarded account alerts elsewhere. And it didn’t matter that Fidelity and Citibank failed to notice obviously suspicious transactions following numerous changes to his contact info.
We reviewed the “security guarantees” published by several major investment firms; we summarize them at the end of this article. On the surface, many seem to provide blanket guarantees against fraud. Fidelity’s website, for example, reassures with: “Fidelity will reimburse you for losses from unauthorized activity in your Covered Accounts occurring through no fault of your own.” But to qualify for reimbursement, Fidelity also lists numerous expectations, including “frequently” checking account information and “actively monitor your accounts” (every day?), reporting to Fidelity any lost device used to contact it, and changing your password and notifying it “immediately if you become aware that you are the victim of identity theft.”
Other firms similarly note—often buried in their terms and conditions or footnotes—that they’ll return money lost to fraud only if it occurred due to “unauthorized activity” occurring “through no fault of your own.” That means most consumers who sent money to scammers employing social engineering tricks won’t qualify.
But even victims who didn’t push any button can lose on the fine print. Wiest said he never received the statements showing his IRA draining because Fidelity itself had accepted the thieves’ changes to his contact information. Yet the firm’s guarantee required prompt reporting, and its position, he told us, was that the clock also runs from when account alerts and statements should have arrived: the burden was on him to notice the hack. In 2025—five years after the theft—Citibank sent Wiest a letter confirming the account was “opened without your knowledge and consent.” It enclosed no money.
Nearly all of the terms and conditions for financial institutions we checked have fine print absolving them from responsibility for most fraud. But few customers know about these requirements, which sometimes include doing things like keeping all device software up to date. Robinhood even requires its customers to contact it “immediately” if they lose a device with account access and warns: “Don’t search for or call us with Robinhood phone numbers found through an internet browser because they are potentially scams.”
Several companies disqualify victims from reimbursement if they connect their accounts to third-party banks or websites that provide wealth overview dashboards.
Other companies don’t bother providing any security promises. J.P. Morgan’s website warns only: “You have the power to prevent fraud. Staying secure is largely up to you…Implementing controls and remaining vigilant to potential unauthorized activity can protect you from becoming a fraud statistic.”
Even when customers spot fraud promptly and take steps to qualify for reimbursement, the firms often still drag their feet. Wojciechowski described major firms refusing to claw back transfers until victims sign lengthy indemnification agreements protecting the firm. “The client’s like, ‘I’m not a lawyer.’ And time is wasting and then the money’s gone.”
What Needs to Change?
“It’s being looked at as individual crimes, and that’s never gonna work. This has to be a collective effort.”
— Brady Finta, National Elder Fraud Coordination Center and former FBI agent
There’s no single fix to this problem. Numerous changes are urgently needed.
The big problem: “It’s being looked at as individual crimes, and that’s never gonna work,” Finta said. “This has to be a collective effort.” Finta’s nonprofit pushes financial services, law enforcement agencies, fintech, telecom businesses, and social media companies to work together.
“The banks point at the social media companies, where a lot of these scams start. They point to law enforcement saying, ‘you guys need to do more on this,’” Breyault said. “The solution is everybody has to take responsibility.”
Many scams start on social media. All the anti-fraud experts we spoke with said Facebook, Instagram, LinkedIn, et al., aren’t working hard enough to detect scammers and shut down their accounts.
In September 2026, the FTC announced it is considering updating its rules to “prevent online platforms from engaging in ad-optimization practices that may be furthering impersonation scams.” In a press release, the commission warned: “Today’s impersonation scams are no longer the work of isolated con artists; they are sophisticated, highly engineered operations powered by the same advertising and targeting tools that platforms sell to legitimate businesses” and that the FTC was considering a requirement for “platforms to take concrete steps to prevent impersonation ads from ever reaching consumers.”
Requiring financial services to eat losses from fraud and scams would also incentivize them to protect their customers.
“If you look at credit card companies, they’re really good at detecting what looks like suspicious transactions. Clearly, this technology is there,” said AARP’s Flynt-Barr. “I tried to buy a gift card for my sister at Christmas. I got like three emails, two phone calls, all these text messages…So this technology exists, but the credit card companies are on the hook for that money, whereas banks and other financial institutions are not.”
Beginning in October 2024, new laws in the United Kingdom required banks to reimburse most victims of authorized push payment scams, with losses split 50/50 between sending and receiving institutions. Industry lobbying cut the per-case cap from £415,000 to £85,000 before launch, and the rules don’t cover investment accounts, but “the UK rules have sharpened a lot of minds in the United States,” Breyault said.
“What can we do? We can make sure that people like me are not re-victimized by our own government,” Flowers said.
Congress eliminated the personal theft-loss tax deduction in 2017. That means that because $400,000 of the money Flowers lost to scammers came out of a retirement account, she owed penalties and taxes. The tax code billed her for being robbed.
In September 2026, a bipartisan fix was approved by the U.S. House of Representatives. But even if it passes the Senate and is signed by President Trump, as drafted, it applies only to losses in tax years starting after December 31, 2025.
“Consumers have a million things going on, they’re such ripe targets, and the financial institutions are the gatekeepers,” Wojciechowski said. “They’re the ones holding the damn keys and have the safe. They must do better.”
Protect Yourself and Your Family—Because No One Else Will
Since stolen money often moves quickly to untraceable funds, it’s not unreasonable to check your accounts daily. Setting up passkeys will help you do this safely in seconds.
Because investment and retirement firms have insulated themselves from responsibility for reclaiming money lost to fraud and scams, it’s crucial to safeguard your savings—and those of vulnerable family members.
Stay alert and skeptical. Scammers are targeting us in myriad ways, but especially via social media, dating apps, online ads, texts, emails, and calls. Con artists make their scams look and sound legitimate, using phony claims, bogus testimonials, and forged seals of approval.
Don’t click on links. Criminals still “phish” for login credentials by sending messages that look as if they come from financial institutions, credit cards, package-delivery services, or other trusted businesses. Click on one and you’ll land on a bogus website that looks legit, where you will be asked to log in to your account or provide payment info. Obey and you’ve let the thieves in.
Use passkeys. They’re a far more secure way to log in to accounts, requiring your fingerprint, face scan, or screen lock PIN, instead of a password that can be hacked. Because passkeys are tied to specific websites or apps, your device won’t log you in to fake domains, and the company won’t let unknown devices log on without verifying your face, fingerprint, etc.
Turn on every alert option, and pay attention to them. Get a text and/or email for every transaction, log-in, address change, trade, transfer request, etc.
Don’t give out authentication codes. Your financial institution will never text or email you a code and then call to ask for it. This has become a common ploy of scammers.
Check your balances often. Since stolen money often moves quickly to untraceable funds, it’s not unreasonable to check your accounts daily. Setting up passkeys will help you do this safely in seconds. We are very worried that AI tools will help criminals hack into accounts and steal funds before customers notice.
Be wary of online-only friends. Know that scammers often invest months building trust before making their move.
Open and read your postal mail. Financial institutions and government agencies will send important notices via the U.S. Postal Service.
Government agencies never demand payment via phone, text, or email. If there’s a problem with your account, Medicare, the IRS, Social Security, or other government agencies will mail you a letter. And only scammers threaten consequences if you don’t pay immediately via irreversible methods like gift cards, wire transfer, a payment app, or cryptocurrency.
Being rushed or confronted with a crisis? It’s a big red flag. Fraudsters know which buttons to push to get you off balance, exploit your emotions, and scare you into responding quickly without thinking. Often, they do so by introducing a crisis—pretending to be law enforcement officials and warning about an impending crime or investigation, claiming they’re from Microsoft and need to fix a looming vulnerability in your device’s security, or posing as loved ones who have been arrested.
Lock accounts against outgoing transfers. Many firms now offer this protection, but they don’t turn it on by default. Some companies still don’t offer it at all.
Name a trusted contact for each of your accounts. It’s just a phone number your financial institution may call when something looks wrong—not a power of attorney or access to your money. When used, it works: The outside voice often breaks a scammer’s spell.
Create a family code word. The FBI now recommends one to defeat AI voice-clone “emergency” calls. Pick something obscure that everyone will remember.
If you notice unusual account activity, act right away. Demand an immediate wire recall from your financial institution.
Not sure it’s a scam? Ask an expert. Get advice from the AARP Fraud Watch Network Helpline at 877-908-3360 (you don’t have to be an AARP member to use it).
If you’ve lost money to a scammer, don’t pay anyone who promises to recover your money for an upfront fee. Scammers are now going after previous victims by setting up fake law firms. Consider consulting an attorney specializing in fraud to help recover funds; visit PIABA.org for members in your area.
Report crime. File complaints with the FBI’s Internet Crime Complaint Center and Fraud.org.
How Financial Services Have Carefully Insulated Themselves from Liability for Fraud and Scams
Most fraud victims won’t qualify for reimbursement under their financial services’ security guarantees. Consumers’ Checkbook reviewed the terms and conditions of major investment and retirement firms and found most have inserted important caveats that protect themselves, not their customers. Below is what we found on company websites in October 2026. Several firms included additional requirements to qualify for any reimbursement program.
Empower
General promise: “We will restore losses to your account that occur as a result of unauthorized transactions through no fault of your own.”
Important caveats:
- “Register your account online, then keep your contact info current.”
- “Register your account online, then keep your contact info current.”
- “Protect your personal and financial information. Never share your passwords, personal account information or device authentication with anyone, including your family members or friends. Anyone with whom you share (or direct us to share) your account access is deemed authorized by you to conduct transactions on your account, including third party financial planning and budgeting applications.”
- Review your accounts “regularly” and “promptly review security alerts” and contact customer service “immediately if you suspect unauthorized activity.”
- “Notify Empower immediately of any unauthorized account activity, if you have not received an account statement or if you have experienced any kind of identity theft.”
- “Keep your devices, operating systems, web browsers and applications current. Maintain up-to-date antivirus, antimalware and firewall software on your computer.”
- “Look out for suspicious emails, texts and phone calls. Do not reply to suspicious requests for your personal or financial information.”
- “Notify us in a timely manner when you have other financial accounts compromised or if you fail to follow basic security practices for your account.”
- Notify firm within 90 days after suspicious activity occurs.
- “Check this page periodically for updated information, as we proactively monitor evolving cybersecurity threats.”
Fidelity
General promise: “Fidelity will reimburse you for losses from unauthorized activity in your Covered Accounts occurring through no fault of your own.”
Important caveats:
- “You must frequently check your account information and promptly review correspondence, account statements, confirmations, and alerts as they are made available to you, but no later than 30 days after that information is posted to your account or delivered to you.”
- “You must immediately contact and report to Fidelity...if you suspect any unauthorized account activity, errors, or discrepancies, if you lose the device you normally use to contact us, or if you have not received your account statements.”
- “You must also maintain up-to-date contact information with us so that you can receive timely account communications and to ensure that we can contact you in case of suspected unauthorized activity.”
- “Use a unique username and password when setting up online credentials. Change your password and notify us immediately if you become aware that you are the victim of identity theft.”
- “Actively monitor your accounts and never share your account access information, including username, password, and answers to security questions, with anyone, or grant someone else access to your account.” This includes “third party financial planning and budgeting applications.”
- “You should also never grant remote access to your computer or readback a one-time security password unless you have initiated the service call to a phone number that you have verified to be valid.”
J. P. Morgan
General promise: None. “You have the power to prevent fraud. Staying secure is largely up to you. Understanding emerging trends, implementing controls and remaining vigilant to potential unauthorized activity can protect you from becoming a fraud statistic.”
Merrill
General promise: “We will reimburse you for quantifiable monetary losses that occur in any of your Merrill accounts due to unauthorized, third-party activity.”
Important caveats:
- “If you detect any errors or discrepancies or suspect unauthorized activity in any account, you must contact us as soon as possible, but not later than 60 days from the suspected unauthorized activity.”
- “Safeguard your account access information, including Login ID, passwords and all other access codes.”
Morgan Stanley (also owns E*Trade)
General promise: “We will reimburse you for losses in your Morgan Stanley account due to unauthorized online access to a Morgan Stanley system that occurs through no fault of your own.”
Important caveats:
- “Safeguard your user name and password, and do not share your account access information with anyone.”
- “Review your confirmations, statements, account activity and other communications from Morgan Stanley diligently. Enlist in electronic delivery of communications for timely notifications of transactions and/or account alerts sent to your email address on file.”
- “Report any errors, discrepancies or suspected unauthorized activity in any of your accounts promptly.”
- “Inform our Client Service Center or your Financial Advisor when mailing addresses, email addresses or phone numbers change.”
- “Secure your computer with anti-virus, anti-spyware, and similar protective software and firewalls, and do not access your Morgan Stanley account from public computers (e.g., hotel business centers, airport kiosks, or similar locations).”
- “This policy does not cover situations in which you authorized the account activity or the fraud was committed by a person to whom you have granted account access. If you share your account access information with anyone, we will consider that you authorized that person’s activities.”
- For E*Trade accounts, sharing log-in info with third-party wealth and budgeting websites and apps “will be considered authorized activity in your account(s) and thus may not be covered by the Customer Protection Guarantee.”
Robinhood
General promise: “As a safety first company, we are committed to keeping your Robinhood accounts protected… If eligible, we’ll reimburse direct losses due to unauthorized activity.”
Important caveats:
- “You’re solely responsible for monitoring and safeguarding your account.”
- “Don’t share account details. Keep account details and login credentials private and up-to-date.”
- “If you give someone else your account login credentials, fail to keep them secure, or give someone the authority to execute transactions on your account, any resulting activity on your account may be considered authorized by you.”
- “Monitor your devices for any unusual activity, enable your devices’ passcode, PIN, and biometric login (if available), and keep them safe and private at all times.”
- “Don’t allow or give anyone remote access to your device (mobile device or computer) or your Robinhood account.”
- “Contact Robinhood Support immediately via the app or website if you lose a device with account access, or if you notice any unusual logins or activity you don’t recognize.”
- “If you don’t have access to your account, email us for help.”
- “Don’t search for or call us with Robinhood phone numbers found through an internet browser because they are potentially scams.”
- “Don’t open suspicious links. If you receive any communications about your Robinhood account, check in the Robinhood app to confirm its authenticity.”
- “Be careful who you send money or crypto to. Any transactions or activity initiated by you will be considered authorized.”
Schwab
General promise: “We offer you this simple guarantee: Schwab will cover losses in any of your Schwab accounts due to unauthorized activity.”
Important caveats:
- “Safeguard your account access information. Please do not share your account access information, including but not limited to your login ID, password, PIN and transaction codes, with anyone. If you share this information with anyone, we will consider their activities to have been authorized by you.”
- “Report any unauthorized transactions to us as quickly as possible.”
- “You are responsible for timely reviewing your account statements to ensure that no unauthorized activity has taken place in your account.”
- “If you share your Schwab account access information with anyone or authorize account access through a third party app (except one that Schwab has partnered with on our platforms) and that sharing or access leads to any loss in your account, the guarantee does not apply.”
- Activity undertaken by a person granted remote access to a device “is not covered under the Guarantee.”
T. Rowe Price
General promise: “T. Rowe Price is proud to share our Account Protection Program. This program provides you with assurances that your T. Rowe Price account is protected in the event it is compromised due to fraud.”
Important caveats:
- “Establish a T. Rowe Price online account and multifactor authentication.”
- “Maintain an up-to-date mailing address, email address and phone number(s) on your T. Rowe Price account.”
- “Review T. Rowe Price account statements, confirmations, and correspondence promptly (recommend within 30 days) after that information is posted to your online account or delivered to you by mail.”
- “Contact T. Rowe Price as soon as possible if you suspect any unauthorized account activity, notice errors or discrepancies in your account, or if you are not receiving your T. Rowe Price account statements.”
- Guarantee does not apply to “activity by any person with whom the account holder has shared his or her login credentials or account number” or “Malware or a breach of security that affects the systems of the account holder, the account holder’s employer, financial intermediary, or other authorized third party.”
TIAA
General promise: “Our practice is to reinstate a client’s TIAA account in full if there is a loss that is determined to be the result of unauthorized activity through no fault of the client.”
Important caveats:
- “Safeguard all of your account access information. Avoid sharing user IDs and passwords with anyone (including family members).”
- “Promptly review all transaction notices and account statements for accuracy.”
- “Use good security practices for technology—whether you use a computer, tablet, smart phone or other digital device—to ensure you have up-to-date security protections.”
- “Contact us as promptly as possible if any unauthorized transactions are suspected, or if you suspect your personal information has been compromised.”
Vanguard
General promise: “If money is taken from your covered account through unauthorized activity, Vanguard will reimburse every dollar taken as outlined below.”
Important caveats:
- “Protect your devices, username, password, security codes, and other authentication information.”
- “Review your account activity and Vanguard communications regularly.”
- “Contact Vanguard as soon as possible if you suspect fraudulent or unauthorized activity or believe you’ve been targeted by a scam or financial exploitation.”
- “Because the following activities involve sharing access to your account or account information, they may be considered authorized activity and may affect coverage under our promise: Giving another person authority to transact on your behalf. Sharing your Vanguard username, password, security codes, or other authentication information with another person or organization. Allowing another person or company to remotely access a device you use to access your Vanguard account. Transactions you perform at the request or direction of a third party. For example, if someone tricks or persuades you to transfer money or assets from your Vanguard account, that transaction may be considered authorized because you completed it yourself.”
Voya
General promise: “If you experience fraud and are not at fault, we will restore your Voya account balance—giving you confidence that your savings are secure.”
Important caveats:
- “‘Not at fault’ means you did not cause or contribute to the fraud. For example, you did not share login information or fail to restrict access to your account.”
- Guarantee does not apply “in situations where you do not maintain the confidentiality of your account, password, or other credential including, but not limited to, one-time passcodes and PINs delivered to you by U.S. Mail, email, or text message); or instances involving customer negligence, e.g., when you do not restrict access to your computing device.”