FREE NEWSLETTER
RECENTLY, A FELLOW—let’s call him Tom—contacted me with a distressing story of financial fraud. I’ll describe what happened then review steps you might take to prevent this same sort of thing.
Tom first noticed there might be a problem when he spotted a larger-than-average withdrawal from his checking account. The payee was a 529 college savings plan. But because Tom and his wife—let’s call her Jane—have 529 accounts for their children, the transaction almost went unnoticed. Tom assumed it was a transfer into his own family’s account. But when he mentioned it to Jane, she noted that they had stopped contributing to their 529. That prompted them to investigate further.
What they found was that scammers had set up a new 529 account in Tom’s name. They then initiated an electronic funds transfer to move more than $2,000 from Tom and Jane’s checking account into the new 529 set up by the thieves. The intention presumably was to then withdraw the funds from the 529, at which point the theft would become unrecoverable.
How were the thieves able to initiate the transfer from Tom and Jane’s bank? This is the part that’s distressing: They took advantage of the widely-used Automated Clearing House (ACH) system. Unfortunately, this system has key weaknesses that make it susceptible to fraud like this. First, it allows funds to be “pulled” out of an account. That’s in contrast to a wire transfer, which can only be “pushed” out by someone with access to the account. So a thief would only need your name, account number and bank routing number to siphon funds from that account. And unfortunately, that information is printed on the front of every check, making it accessible to someone looking to perpetrate this type of scheme.
Once the thief had the new 529 account set up in Tom’s name, it was just one simple step to initiate a transfer from Tom and Jane’s bank since the accountholder’s name was the same on both accounts. It was so seamless that if Tom hadn’t been reviewing the transactions in his account, he might never have noticed the theft.
According to the FBI, losses due to cybercrime have increased from $1 billion per year to $21 billion over the past 10 years, and ACH theft is a tactic thieves are using more frequently, so it’s worth looking at strategies to help keep your accounts secure. Here are six recommendations.
What if, like Tom and Jane, you spot a fraudulent transaction in your account? Then it’s important to report it as quickly as possible. Regulation E can limit your liability, but the faster you report a suspicious transaction, the more protection it provides. Liability is limited to just $50 if a theft is reported within two business days, but that exposure increases to $500 if it’s reported later. And after 60 days, there are no guarantees.
Thieves, unfortunately, don’t seem to sleep, which means that we need to be more vigilant than in the past, and need to be continuously vigilant. As personal finance author Mike Piper wrote recently, “Cybersecurity should be considered another core area of personal finance—no different from insurance planning, for instance.”
Adam M. Grossman is the founder of Mayport, a fixed-fee wealth management firm. Sign up for Adam’s Daily Ideas email, follow him on X @AdamMGrossman and check out his earlier articles.
So I’m the “Tom” in this article. Adam Grossman is our advisor, and I passed this story on to him. To clarify, and therefore hopefully answer a few of the good questions in the comments below…
My wife and routinely review transactions on our accounts, so we caught it quickly. My wife gets the credit for realizing we had stopped contributing (very recently) to our kids 529s. The amount was very similar to what we typically contributed. ACH transactions were reversed by the bank, as one commenter points out that they can, so we lost no money.
The fraudsters had set up a 529 account with Colorado’s plan, College Invest. We live in North Carolina, and use Virginia’s 529 plans. We’ve never had an account in Colorado. The account was not set up in my name or my wife’s name–it was set up in the fraudster’s name, either real or fabricated. They used a “UGift” link–a link you would send to friends and family so that they can set up an ACH transfer to your kids 529 accounts on a one time basis–to initiate the transfer. So whoever did it obviously had our routing and account number. That could have come from a billion places. We rarely write checks, but we do on occasion. Every bank and financial institution we use, and both our workplaces (direct deposit info), and our CPAs office, and our former advisors office, and on and on and on, ALL of them have this info, or had it at one point. My brother-in-law has a 25 year career with Fidelity in their compliance office. He told me that at Fidelity alone, which employs roughly 80,000 people, several thousand have this info for every client. Multiply that by the several brokerage houses and several banks we do business with. All it takes is one compromised human. I’d love to do business with fewer banks, but with two workplaces that use two different brokerage houses, and two intertwined financial lives, sometimes you can only consolidate up to a certain point. Of note, College Invest had frozen the account, as they had noticed an uptick in this type of fraud using their accounts, and had flagged this one as suspicious. They assured us that the only transfer allowed out of this account would have been back to its source–but they never contacted us–we contacted them to get that info.
One other interesting point…the fraudsters ran a test on the routing and account numbers first, by donating a small amount via ACH to Givewell, a charity we have used in the past. That was either a startling coincidence, or they knew our transaction history going back over a period of years, which is scary. I contacted everyone with our legacy info to let them know, but no one really did anything except to say that their digital protocols and safeguards were secure.
Anyway, we closed that bank account, and now monitor everything else even more closely than before. Per other comments:
ACATS fraud terrifies me. We locked all our accounts. Very easy to do on most platforms. Even if they don’t offer an option online (e.g. Fidelity workplace retirement accounts), call them. They can lock it.
For the person who doesn’t want to gift to a kids 529 via ACH, or write a check, or give bank info over the phone, I’m with you. I just give them cash when I see them. Kids love getting a wad of cash anyway.
I’m sure there were other points to address, but I’m tired of typing. Bottom line, you don’t need to be writing checks–or even own a checkbook– to be at risk for ACH fraud. Fraud should get top billing in personal finance these days. Ignore at your own risk.
ps. My real name is Ty