ACATS Brokerage Fraud Is Draining Investor Accounts. Congress Wants FINRA to Act.

Senators Ron Wyden and Elizabeth Warren sent a letter to FINRA on August 20, 2026, demanding the regulator strengthen cybersecurity standards for the Automated Customer Account Transfer Service (ACATS) to prevent a growing wave of ACATS brokerage fraud.

The letter calls attention to a security gap in the transfer system that allows criminals to move customer assets between brokerage firms without directly notifying or authenticating the actual account holder. For investors, the stakes are significant: fraudsters who obtain stolen personal information can drain a brokerage account in a matter of days, often before anyone detects the problem.

ACATS fraud falls into the broader category of unauthorized trading claims, where assets are moved or liquidated without the account holder’s knowledge or consent. Investors who discover unauthorized transfers may have legal options against the brokerage firm that processed the transfer, particularly if the firm failed to follow reasonable security protocols or verify the legitimacy of the request.

What Happened: The Wyden-Warren Letter to FINRA

The August 20, 2026 letter from Senators Wyden and Warren directly addressed what they described as a systemic vulnerability in the ACATS transfer process. The senators urged FINRA to take immediate regulatory action to close that vulnerability and require more robust safeguards.

The letter raises several pointed concerns:

• Under current ACATS timelines, a receiving brokerage can initiate a transfer request, and the outgoing firm has only one business day to validate or object. The full transfer can be completed within three business days.
• Criminals exploit these tight timelines by using stolen personal information to open fraudulent accounts, then submitting ACATS requests that pull assets out of a victim’s legitimate account before the victim or firm can intervene.
• The current process does not always require the actual account holder to receive direct notification or perform any authentication step before assets are moved.

The senators called on FINRA to close this gap and implement mandatory cybersecurity standards that would require customer authentication and timely notification whenever an ACATS transfer is initiated.

How ACATS Brokerage Fraud Works

ACATS is an automated system administered by the National Securities Clearing Corporation. Its original purpose was to prevent brokerage firms from slow-walking legitimate customer transfers when an investor wanted to move an account to a new firm. The system was designed for speed and efficiency.

That speed has become a vulnerability. According to FINRA’s guidance on ACATS fraud, the typical scheme unfolds in a series of steps:

First, a bad actor obtains stolen personal information belonging to a legitimate brokerage customer. This may include the customer’s name, Social Security number, date of birth, and account details. The criminal then uses that information to open a new brokerage account in the victim’s name at a different firm. Once the fraudulent account is open, the criminal submits an ACATS transfer request to move assets from the victim’s real account to the newly created fraudulent account.

Because the outgoing firm has only one business day to validate or reject the request, and three business days to complete the transfer, the assets can be moved quickly. In many cases, the criminal liquidates or withdraws the transferred assets before the legitimate account holder even realizes anything has changed.

FINRA’s Regulatory Notice 22-21 alerting firms to a rising trend in fraudulent ACATS transfers described this pattern in detail and warned member firms about the growing threat.

What FINRA Has Done So Far

FINRA has issued two regulatory notices addressing ACATS fraud risks. Regulatory Notice 22-21 first alerted member firms to the rising trend in fraudulent account transfers through ACATS. It described how ACATS fraud occurs, outlined firms’ regulatory obligations, and identified reporting channels for suspected fraud.

FINRA followed up with Regulatory Notice 23-06 on effective practices to address ACATS fraud risks, which shared specific steps firms can take to reduce exposure. Those practices include:

• Enhancing customer identity verification procedures for online account openings
• Monitoring for patterns in transfer requests that may indicate fraud, such as requests made shortly after large deposits into a new account or repeated rejections due to incorrect information
• Promptly notifying customers when transfer instructions are received on their accounts

FINRA also encourages firms to report suspected ACATS fraud through FINRA’s Regulatory Tip Form, the SEC’s tips and complaints system, the FBI, and the Internet Crime Complaint Center (IC3), in addition to filing required Suspicious Activity Reports.

However, as the Wyden-Warren letter points out, FINRA’s guidance to date has been voluntary rather than mandatory. The senators are pressing for binding rules that would require customer authentication and direct notification as part of every ACATS transfer, rather than leaving those safeguards to individual firm discretion.

What This Means for Investors

The Wyden-Warren letter signals that lawmakers view ACATS brokerage fraud as a systemic problem, not an isolated risk. Until FINRA adopts mandatory standards, investors remain exposed to unauthorized transfers that may drain accounts before anyone intervenes.

If you suspect fraud, contact your brokerage firm immediately and report the incident to FINRA, the SEC, the FBI, or the IC3. When a firm fails to implement adequate identity verification, transfer monitoring, or customer notification procedures, investors may have grounds to pursue claims involving unauthorized trading and account transfers. Investors who suffer losses through unauthorized ACATS transfers may also pursue recovery through the FINRA arbitration process.

How Meyer Wilson Werning Can Help

Losing an entire brokerage account to a fraud scheme that exploits a system designed to protect you is a particular kind of harm. ACATS was built for investor convenience, and criminals have turned that convenience into a weapon. Senators Wyden and Warren have put FINRA on notice, but until mandatory standards are in place, the firms holding your assets remain the last real line of defense. When those firms fall short, investors should not be left without recourse.

With more than $350 million recovered for investors nationwide, Meyer Wilson Werning has spent over 25 years holding brokerage firms accountable for failing to protect their customers’ assets. When a firm processes an unauthorized transfer without adequate identity verification or customer notification, investors should not be left absorbing those losses alone. If your account was transferred or drained without your authorization, contact us today for a free and confidential consultation. You pay nothing unless we recover for you.

Frequently Asked Questions

What is ACATS brokerage fraud?

ACATS brokerage fraud occurs when criminals use stolen personal information to open fraudulent brokerage accounts and initiate transfers through the Automated Customer Account Transfer Service, pulling assets out of a legitimate investor’s account. Because ACATS transfers can be processed within days and may not require direct authentication from the real account holder, victims may not discover the fraud until their accounts have been drained.

What did Senators Wyden and Warren ask FINRA to do about ACATS cybersecurity?

In their August 20, 2026 letter, the senators urged FINRA to adopt mandatory cybersecurity standards for ACATS that would require direct notification to and authentication by the account holder before any transfer is processed. They described the current voluntary guidance as insufficient to protect consumers from the growing threat of fraudulent transfers.

What warning signs might indicate ACATS fraud on my account?

Red flags include transfer confirmations you did not authorize, unexpected changes to your contact information on file, and any communication from a brokerage firm you do not have a relationship with. FINRA’s guidance also identifies repeated transfer requests with incorrect information and sudden changes in how a customer communicates with their firm as potential indicators of fraud.