ACAT Fraud: How Thieves Use the Brokerage Transfer System to Steal Investor Assets, and Who May Be Liable

• September 25, 2026
• Uncategorized

Most investors assume that if no one has their password, their brokerage account is safe. ACAT fraud proves otherwise. A thief never has to log into your account. Using your stolen personal information, the thief opens a new account in your name at a different brokerage firm and asks that firm to “pull” your assets over. Within days, your securities can be gone.

Wolper Law Firm, P.A. has brought claims on behalf of investors against tastytrade, Inc. (BrokerCheck, CRD# 277027) and Futu Clearing Inc. (BrokerCheck, CRD# 298769). The claims allege that these firms’ account-opening, identity-verification, and anti-money laundering controls allowed bad actors to open fraudulent accounts and carry out ACAT fraud. We continue to investigate claims on behalf of investors whose assets were stolen through fraudulent ACATS transfers.

What Is ACATS?

The Automated Customer Account Transfer Service (ACATS) is the system brokerage firms use to move customer accounts from one firm to another. It is administered by the National Securities Clearing Corporation and governed by FINRA Rule 11870. ACATS was designed to stop firms from stalling when customers tried to leave. It sets strict deadlines: the firm holding the account has one business day to validate or reject a transfer request, then three business days to complete the transfer.

That speed protects investors from foot-dragging. It also gives criminals a narrow window in which to act before the victim notices.

How ACAT Fraud Works

ACATS is a “pull” system. The transfer begins at the receiving firm, not at the firm holding the assets. FINRA described the typical scheme in Regulatory Notice 22-21:

1. The fake account. Using a victim’s stolen name, Social Security number, address, and account information, the thief opens an account online or through a mobile app at a second brokerage firm. The thief often supplies a false email address or phone number so the victim never receives alerts.
2. The transfer. Within days or weeks, the thief submits a transfer request asking the new firm to pull the victim’s assets from the legitimate firm.
3. The getaway. Once the assets arrive, the thief moves quickly. The thief transfers the securities elsewhere, sells them and wires out the proceeds, or buys other securities and transfers those out.

The victim often learns of the theft only after the assets are gone.

A Growing Problem

FINRA first alerted the industry in October 2022. By March 2023, in Regulatory Notice 23-06, it reported that its examinations, investigations, and review of customer complaints had identified increased instances of ACATS fraud.

In October 2025, the New York Times reported the case of a California couple. A criminal had opened two new accounts in the wife’s name and initiated a transfer of roughly $120,000 from her Roth IRA. The couple caught the theft before the money was withdrawn.

In August 2026, U.S. Senators Ron Wyden and Elizabeth Warren wrote to FINRA urging it to act. They noted that FINRA recommends, but does not require, that brokerages notify customers before transferring their assets to another firm. Their review found wide inconsistency across the industry: some firms let customers block outgoing transfers themselves, while others offer no way to protect an account from fraudulent ACATS transfers.

Red Flags FINRA Says Firms Should Catch

In Regulatory Notice 23-06, FINRA identified warning signs of ACATS fraud:

• Repeated rejected transfer requests for the same customer because of an incorrect account type or other basic information. This suggests someone is guessing.
• Rapid outbound transfers requested soon after assets arrive in a newly opened account.
• Changes in communication patterns. Examples include a longtime phone customer suddenly insisting on email only, or emails written in a style that doesn’t match prior correspondence.

FINRA also described practices firms have adopted to stop the fraud:

• principal review when multiple accounts are opened quickly under one name;
• “likeness checks” that compare a live photo or video to identity documents;
• third-party identity verification;
• screening applications for repeated phone numbers, emails, or bank accounts across different customer names;
• detecting automated or scripted account applications;
• notifying customers when a transfer request is received;
• escalating suspicious transfers to the firm’s anti-money laundering (AML) program.

Claims Against tastytrade and Futu Clearing

Wolper Law Firm has brought claims against tastytrade and Futu Clearing on behalf of investors whose assets were allegedly moved through fraudulent ACATS transfers into accounts that impostors opened in their names. The claims allege that these firms failed to reasonably verify the identities of the people opening those accounts, failed to detect the red flags FINRA has identified, and failed to stop the stolen assets from being moved out.

tastytrade is an online introducing broker-dealer that offers self-directed brokerage services to retail investors. Futu Clearing provides execution, clearing, and custody services for its affiliate Moomoo Financial Inc. (BrokerCheck, CRD# 283078), an app-based brokerage platform. Futu Clearing and Moomoo are both indirect subsidiaries of Futu Holdings Limited.

These claims are pending, and the allegations have not been proven. If you believe your assets were transferred without your authorization into an account at tastytrade, Moomoo, or another online brokerage platform, contact our office.

Applicable FINRA Rules and Legal Standards

Brokerage firms cannot treat ACAT fraud as a risk borne entirely by the investor. FINRA has reminded firms that existing obligations apply.

Customer Identification and Anti-Money Laundering: FINRA Rule 3310 and 31 C.F.R. § 1023.220. Every broker-dealer must maintain a risk-based customer identification program that lets it form a reasonable belief it knows each customer’s true identity. Firms must also monitor for and report suspicious transactions. A receiving firm that opens an account for an impostor, then processes a large inbound transfer and an immediate outbound withdrawal, must answer for whether its program was reasonably designed.

Know Your Customer: FINRA Rule 2090. Firms must use reasonable diligence, when opening and maintaining every account, to know the essential facts about each customer.

Customer Account Information: FINRA Rule 4512. Firms must collect and maintain specified information for each account.

Identity Theft Red Flags Rule: Regulation S-ID. Firms must maintain a written program to detect, prevent, and respond to red flags of identity theft, including at account opening.

Customer Account Transfers: FINRA Rule 11870. This rule governs how transfers must be processed, including the grounds on which the firm holding the assets may reject a transfer request.

Supervision: FINRA Rule 3110. Firms must maintain supervisory systems reasonably designed to achieve compliance with securities laws and FINRA rules.

FINRA stated that Notice 23-06 does not create new requirements. Even so, it describes controls that member firms themselves consider effective, which makes it strong evidence of what a reasonable firm should have in place.

Investors harmed by ACAT fraud may have claims against the receiving firm, the carrying firm, or both. Depending on the facts, those claims include negligence, negligent supervision, and breach of contract. Many are resolved through FINRA arbitration.

What to Do If You Are a Victim

1. Act immediately. Contact both the firm that held your assets and the firm that received them, and demand that the assets be frozen.
2. Report the theft. File reports with FINRA through its Regulatory Tip Form, with the SEC, and with law enforcement, including the FBI’s Internet Crime Complaint Center.
3. Preserve everything. Keep account statements, emails, text messages, and any notices you received.
4. Get legal advice first. Consult a securities attorney before signing any release or accepting a partial reimbursement.

How to Protect Yourself

• Check your accounts regularly.
• Enable transfer locks and transfer alerts wherever your firm offers them.
• Use the strongest login authentication your firm offers.
• Guard your account numbers and statements. A thief needs your account number to request a transfer.
• Be suspicious of mail or emails from a brokerage firm you don’t use. They may mean someone has opened an account in your name.

Contact Wolper Law Firm

The Wolper Law Firm, P.A. represents investors nationwide in securities litigation and arbitration on a contingency fee basis. Matt Wolper, the Managing Principal, is a trial lawyer who has handledmore than 1,000 securities cases. Contact us at 855.289.7868 or mwolper@wolperlawfirm.com.