Financial Fraud

RECENTLY, A FELLOW—let’s call him Tom—contacted me with a distressing story of financial fraud. I’ll describe what happened then review steps you might take to prevent this same sort of thing.

Tom first noticed there might be a problem when he spotted a larger-than-average withdrawal from his checking account. The payee was a 529 college savings plan. But because Tom and his wife—let’s call her Jane—have 529 accounts for their children, the transaction almost went unnoticed. Tom assumed it was a transfer into his own family’s account. But when he mentioned it to Jane, she noted that they had stopped contributing to their 529. That prompted them to investigate further.

What they found was that scammers had set up a new 529 account in Tom’s name. They then initiated an electronic funds transfer to move more than $2,000 from Tom and Jane’s checking account into the new 529 set up by the thieves. The intention presumably was to then withdraw the funds from the 529, at which point the theft would become unrecoverable.

How were the thieves able to initiate the transfer from Tom and Jane’s bank? This is the part that’s distressing: They took advantage of the widely-used Automated Clearing House (ACH) system. Unfortunately, this system has key weaknesses that make it susceptible to fraud like this. First, it allows funds to be “pulled” out of an account. That’s in contrast to a wire transfer, which can only be “pushed” out by someone with access to the account. So a thief would only need your name, account number and bank routing number to siphon funds from that account. And unfortunately, that information is printed on the front of every check, making it accessible to someone looking to perpetrate this type of scheme.

Once the thief had the new 529 account set up in Tom’s name, it was just one simple step to initiate a transfer from Tom and Jane’s bank since the accountholder’s name was the same on both accounts. It was so seamless that if Tom hadn’t been reviewing the transactions in his account, he might never have noticed the theft.

According to the FBI, losses due to cybercrime have increased from $1 billion per year to $21 billion over the past 10 years, and ACH theft is a tactic thieves are using more frequently, so it’s worth looking at strategies to help keep your accounts secure. Here are six recommendations.

1. Secure the login to your bank account by setting up two-factor authentication. And if your bank supports it, use an authenticator app, rather than text messages, for the authentication codes. Ideally, if your bank supports it, switch to a passkey. This is a newer technology that represents a significant advance over traditional passwords. Most importantly, they aren’t vulnerable to phishing attacks. They’re also easier to use, providing one-click logins, and you can store passkeys in a password manager. For those reasons, more websites are beginning to support passkeys. I’d make the switch as soon as your bank makes them available.
2. Set up alerts through your bank to monitor activity in your checking account. Every bank is different, but most allow you to set up email- or text-based alerts to let you know when transactions above a specified threshold are processed, or when other types of activity occur.
3. Monitor your transactions. These days, it can be hard to keep an eye on every account. Households often have one or more bank accounts plus credit cards and electronic payment services like Venmo or Zelle. Most people realistically don’t have the time to review every account in real time. That’s why I recommend a service like Monarch or YNAB, which are web-based versions of traditional budgeting tools like Quicken. These services can pull in transactions from all your accounts and present them in a consolidated list, making review much easier. If you kept Monarch or YNAB open in a browser window on your home computer, you could scroll through recent transactions whenever you have a spare minute.
4. To narrow the circle of people who have access to your account information, try limiting the number of paper checks you write. Especially with Zelle and Venmo as alternatives for making payments, this is getting easier. If you do write paper checks, be sure to use a gel pen and to avoid freestanding mailboxes. Those steps can help prevent a related type of fraud, as Jonathan Clements explained a few years back.
5. Pay attention to notifications of data breaches. Unfortunately, breach announcements seem to occur so frequently that we’ve become immune to them. It’s worth paying attention, though, to understand which particular pieces of information have been stolen. If it looks like your banking information is included in a breach, it might be worth opening a new account, inconvenient as that would be.
6. Have your guard up against unsolicited phone calls, emails or text messages. If someone is contacting you about an “account security issue,” or claims to be calling from your bank or from the IRS, be especially wary. Those are common tactics for creating a sense of urgency that can cause people to let their guard down.

What if, like Tom and Jane, you spot a fraudulent transaction in your account? Then it’s important to report it as quickly as possible. Regulation E can limit your liability, but the faster you report a suspicious transaction, the more protection it provides. Liability is limited to just $50 if a theft is reported within two business days, but that exposure increases to $500 if it’s reported later. And after 60 days, there are no guarantees.

Thieves, unfortunately, don’t seem to sleep, which means that we need to be more vigilant than in the past, and need to be continuously vigilant. As personal finance author Mike Piper wrote recently, “Cybersecurity should be considered another core area of personal finance—no different from insurance planning, for instance.”

Adam M. Grossman is the founder of Mayport, a fixed-fee wealth management firm. Sign up for Adam’s Daily Ideas email, follow him on X @AdamMGrossman and check out his earlier articles.