So I'm the "Tom" in this article. Adam Grossman is our advisor, and I passed this story on to him. To clarify, and therefore hopefully answer a few of the good questions in the comments below... My wife and routinely review transactions on our accounts, so we caught it quickly. My wife gets the credit for realizing we had stopped contributing (very recently) to our kids 529s. The amount was very similar to what we typically contributed. ACH transactions were reversed by the bank, as one commenter points out that they can, so we lost no money. The fraudsters had set up a 529 account with Colorado's plan, College Invest. We live in North Carolina, and use Virginia's 529 plans. We've never had an account in Colorado. The account was not set up in my name or my wife's name--it was set up in the fraudster's name, either real or fabricated. They used a "UGift" link--a link you would send to friends and family so that they can set up an ACH transfer to your kids 529 accounts on a one time basis--to initiate the transfer. So whoever did it obviously had our routing and account number. That could have come from a billion places. We rarely write checks, but we do on occasion. Every bank and financial institution we use, and both our workplaces (direct deposit info), and our CPAs office, and our former advisors office, and on and on and on, ALL of them have this info, or had it at one point. My brother-in-law has a 25 year career with Fidelity in their compliance office. He told me that at Fidelity alone, which employs roughly 80,000 people, several thousand have this info for every client. Multiply that by the several brokerage houses and several banks we do business with. All it takes is one compromised human. I'd love to do business with fewer banks, but with two workplaces that use two different brokerage houses, and two intertwined financial lives, sometimes you can only consolidate up to a certain point. Of note, College Invest had frozen the account, as they had noticed an uptick in this type of fraud using their accounts, and had flagged this one as suspicious. They assured us that the only transfer allowed out of this account would have been back to its source--but they never contacted us--we contacted them to get that info. One other interesting point...the fraudsters ran a test on the routing and account numbers first, by donating a small amount via ACH to Givewell, a charity we have used in the past. That was either a startling coincidence, or they knew our transaction history going back over a period of years, which is scary. I contacted everyone with our legacy info to let them know, but no one really did anything except to say that their digital protocols and safeguards were secure. Anyway, we closed that bank account, and now monitor everything else even more closely than before. Per other comments: ACATS fraud terrifies me. We locked all our accounts. Very easy to do on most platforms. Even if they don't offer an option online (e.g. Fidelity workplace retirement accounts), call them. They can lock it. For the person who doesn't want to gift to a kids 529 via ACH, or write a check, or give bank info over the phone, I'm with you. I just give them cash when I see them. Kids love getting a wad of cash anyway. I'm sure there were other points to address, but I'm tired of typing. Bottom line, you don't need to be writing checks--or even own a checkbook-- to be at risk for ACH fraud. Fraud should get top billing in personal finance these days. Ignore at your own risk. ps. My real name is Ty
Comments
So I'm the "Tom" in this article. Adam Grossman is our advisor, and I passed this story on to him. To clarify, and therefore hopefully answer a few of the good questions in the comments below... My wife and routinely review transactions on our accounts, so we caught it quickly. My wife gets the credit for realizing we had stopped contributing (very recently) to our kids 529s. The amount was very similar to what we typically contributed. ACH transactions were reversed by the bank, as one commenter points out that they can, so we lost no money. The fraudsters had set up a 529 account with Colorado's plan, College Invest. We live in North Carolina, and use Virginia's 529 plans. We've never had an account in Colorado. The account was not set up in my name or my wife's name--it was set up in the fraudster's name, either real or fabricated. They used a "UGift" link--a link you would send to friends and family so that they can set up an ACH transfer to your kids 529 accounts on a one time basis--to initiate the transfer. So whoever did it obviously had our routing and account number. That could have come from a billion places. We rarely write checks, but we do on occasion. Every bank and financial institution we use, and both our workplaces (direct deposit info), and our CPAs office, and our former advisors office, and on and on and on, ALL of them have this info, or had it at one point. My brother-in-law has a 25 year career with Fidelity in their compliance office. He told me that at Fidelity alone, which employs roughly 80,000 people, several thousand have this info for every client. Multiply that by the several brokerage houses and several banks we do business with. All it takes is one compromised human. I'd love to do business with fewer banks, but with two workplaces that use two different brokerage houses, and two intertwined financial lives, sometimes you can only consolidate up to a certain point. Of note, College Invest had frozen the account, as they had noticed an uptick in this type of fraud using their accounts, and had flagged this one as suspicious. They assured us that the only transfer allowed out of this account would have been back to its source--but they never contacted us--we contacted them to get that info. One other interesting point...the fraudsters ran a test on the routing and account numbers first, by donating a small amount via ACH to Givewell, a charity we have used in the past. That was either a startling coincidence, or they knew our transaction history going back over a period of years, which is scary. I contacted everyone with our legacy info to let them know, but no one really did anything except to say that their digital protocols and safeguards were secure. Anyway, we closed that bank account, and now monitor everything else even more closely than before. Per other comments: ACATS fraud terrifies me. We locked all our accounts. Very easy to do on most platforms. Even if they don't offer an option online (e.g. Fidelity workplace retirement accounts), call them. They can lock it. For the person who doesn't want to gift to a kids 529 via ACH, or write a check, or give bank info over the phone, I'm with you. I just give them cash when I see them. Kids love getting a wad of cash anyway. I'm sure there were other points to address, but I'm tired of typing. Bottom line, you don't need to be writing checks--or even own a checkbook-- to be at risk for ACH fraud. Fraud should get top billing in personal finance these days. Ignore at your own risk. ps. My real name is Ty
Post: Financial Fraud
Link to comment from September 11, 2026