Account takeover fraud in customer portals: how should broker-dealers respond?

What is account takeover fraud in a customer portal?

Account takeover fraud is when someone uses a customer's stolen login credentials to get into that customer's online brokerage account. FINRA's 2026 Annual Regulatory Oversight Report describes it as "threat actors using compromised customer login credentials to gain unauthorized access to online accounts." The usual goal is money: once inside, the attacker changes contact details or bank instructions and moves funds out.

It is different from new account fraud, where a criminal opens an account in someone else's name (our piece on synthetic identity fraud detection covers that side). With a takeover, the account is real, the customer is real and the history looks clean, which is why the first sign is often a single odd request rather than a pattern. For a broker-dealer or dual-registered firm, the exposure is client assets, a possible Regulation S-P notice, and an exam question about why the controls did not catch it.

Which rules apply when a customer's login is compromised?

Three sets of rules do most of the work: Regulation S-ID, Regulation S-P and FINRA's supervision rule. Regulation S-ID, 17 CFR 248.201, requires a firm with covered accounts to "develop and implement a written Identity Theft Prevention Program" that identifies relevant red flags, detects them, responds to them and is updated periodically. A brokerage account that allows transfers to third parties is the kind of covered account the rule has in mind.

Regulation S-P, 17 CFR 248.30, requires written safeguards for customer information and, since the 2024 amendments, an incident response program to detect, respond to and recover from unauthorized access. Larger entities had to comply by December 3, 2025 and smaller entities by June 3, 2026, according to the SEC's small entity compliance guide. Both dates have passed, so every covered broker-dealer and adviser is now subject to it.

FINRA's Regulatory Notice 21-18, which summarizes how 20 firms handle online account takeover, also points to Rule 3110 for determining the authenticity of transmittal instructions, along with Rule 2090 (know your customer), the customer identification program rules and Rule 3310. The Notice says plainly that it does not create new requirements. It is still the clearest statement of what FINRA has seen work.

What are the red flags of account takeover fraud in a portal?

The red flags of account takeover fraud are signs that someone other than the customer is logging in or moving money, and your program should list the ones that match how your customers use the portal. In a December 2022 risk alert, SEC examiners reported firms that "experienced ongoing account takeovers over several years and did not consider any red flags related to account takeovers," firms that never identified online accounts as covered, and firms that did not update their red flags after adding online portals.

Regulation S-ID's own examples in Supplement A to Appendix A include a request for new or replacement means of accessing an account shortly after a change of address, and account use "not consistent with established patterns of activity." Regulatory Notice 21-18 and the 2026 oversight report add portal-specific signals:

• A spike in failed logins on one account, or the same failed credentials tried across many accounts.
• A login from an unrecognized browser, device or location, or an "impossible travel" pair of logins.
• An email address, phone number or bank instruction change followed soon by a withdrawal or third-party wire.
• A withdrawal to a newly added or previously unused bank account.
• A dormant account that suddenly becomes active.
• A customer reporting a transaction or alert they do not recognize.

A list copied from Appendix A without this tailoring is the deficiency examiners have already written up.

How do you prevent account takeover fraud under FINRA guidance?

Multifactor authentication is the center of FINRA's published practices for preventing account takeover. Regulatory Notice 21-18 reports that "most participants believe MFA is currently one of the best ways to protect customers' accounts from ATOs," and the 2026 oversight report lists MFA for login access, including for customers, as an effective practice. No FINRA rule text names MFA, but it is the first control an examiner is likely to ask about.

The other practices FINRA describes fall into four groups:

• Stronger authentication: adaptive authentication that weighs the risk of the login and the requested activity, and authenticator apps or biometrics rather than email as a factor. Many participating firms said they had moved away from email addresses as an authentication factor.
• Safer account recovery: two-factor verification for password resets and call center verification that uses less publicly available information.
• Funds transfer checks: a confirmation call to the customer at an established phone number when a withdrawal goes to a newly added bank account. Our piece on wire transfer verification covers how voice cloning changes that callback.
• Automated detection: web application firewalls, isolating suspicious IP addresses, impossible travel checks and geographic restrictions.

The 2026 report also recommends that cyber and IT staff coordinate with AML staff on suspicious activity. A takeover usually shows up in both places at once, as a strange login and a strange transfer.

How should a firm respond to a confirmed account takeover?

Contain the account first, then decide what the rules require you to do next. Appendix A to Regulation S-ID lists appropriate responses that include monitoring the account, contacting the customer, changing passwords and security codes, reopening the account under a new number, closing it and notifying law enforcement. Firms in Regulatory Notice 21-18 also considered reviewing all of the affected customer's accounts at the firm, including accounts the attacker never touched.

Regulation S-P then asks a separate question. The amended rule requires notice to affected individuals "as soon as practicable, but not later than 30 days" after becoming aware that unauthorized access to sensitive customer information has occurred or is reasonably likely to have occurred. The SEC's guide gives as an example of sensitive customer information a user name or account number combined with information that could be used to gain access to the account. A firm that concludes after a reasonable investigation that harm is not reasonably likely can skip the notice, but it has to document that. Our article on documenting a no-notice decision covers that record.

Regulatory Notice 21-18 also asks firms to consider filing a suspicious activity report, consider their reporting obligations under Rule 4530, and report fraud to FINRA, the SEC, the FBI and state regulators. Which of those apply to a particular incident is a question for your compliance team and counsel.

Who watches the portal when a clearing firm or vendor runs it?

Often the clearing firm or a technology vendor, which makes service provider oversight part of the answer. Regulation S-ID requires firms to "exercise appropriate and effective oversight of service provider arrangements." Amended Regulation S-P requires written policies to oversee service providers, including that they notify the firm as soon as possible, and no later than 72 hours, after becoming aware of a breach that results in unauthorized access to a customer information system they maintain. Our piece on the 72-hour service provider notice covers the contract language.

In practice, ask each portal provider what it monitors, which alerts it sends to you, how fast, and who at your firm receives them. If the provider detects a takeover and tells only the customer, your program has a gap.

What should you do this quarter?

Five steps close the most common gaps:

• Confirm that accounts customers reach online or by mobile app are listed as covered accounts in your Regulation S-ID program, with red flags that match how customers log in and move money.
• Check that MFA is on for every customer login path, including mobile apps and password resets, and that email is not the only recovery factor.
• Write down the callback rule for withdrawals to new bank accounts and test whether staff follow it.
• Ask your clearing firm and portal vendors for their alerting and breach notice terms in writing.
• Run a tabletop on a portal takeover that walks from detection to the 30-day Regulation S-P decision. Our tabletop guide gives a format.

How can s90 help?

s90 runs the identity, device and monitoring layer around the systems your staff use to service accounts, and documents those controls for your Regulation S-P and S-ID files. Our agreements commit to 72-hour breach notification and 24-hour evidence production, so your incident clock starts on time and your exam binder has what an examiner asks for. If you want a second look at your takeover controls, we are happy to talk.