Security at Vanguard

Keeping your accounts secure is our priority. Partnership is the key.

How we protect you

Investors come first in everything we do, including our security features. Learn how we protect you and what you can do to keep your accounts safe. 

Know the signs of financial exploitation

Website security

Our website employs various security features—visible and invisible—to help keep you safe.

We also have a redundant data center in case one data center becomes unavailable, and test attack models within Vanguard's network.

Note: A security alert could indicate that either the date on your computer is incorrect or you're using an outdated version of your web browser.

In addition to these safeguards, Vanguard will never:

  • Send an unsolicited email asking you to respond with your personal account information (e.g., username, password, or Social Security number).
  • Ask for your web password in an email or request your personal information over the phone or by U.S.mail. We may ask for personal information if you've contacted us to report you're having trouble logging on to your Vanguard account(s).

Video transcript

When you call Vanguard

We'll take steps to ensure we've verified your identity before discussing personal and financial information with you over the phone. We'll ask you to verify personal information, which may include the security questions you selected as part of the web registration process. For extra verification, you can also request to use a PIN or password of your choice every time you call.

We'll never call you and ask for your password or logon credentials, your Social Security number, or a security code you've received via text or automated call. You should never disclose this information to anyone over the phone. If you suspect someone has gained access to this information, contact our fraud team immediately.

Text messages from Vanguard

Clients can opt in to receive service alerts via text message. You might get a service alert to remind you about an upcoming appointment or if we ever need more information to complete a request you submitted. In addition, you can opt to receive account activity alerts, a security feature that will notify you when certain changes or transactions are made on your account.

Review the terms and conditions to familiarize yourself with Vanguard's policy on service-related text messaging. Always use good judgment before tapping on links in text messages. If you're not expecting a text message from us, we do not recommend tapping on the link.

Notice about Section 311 of the USA PATRIOT Act

U.S. AML Certification (PDF)

Online security tips

In addition to taking advantage of Vanguard's security features, here are some general tips and best practices for keeping your personal and financial information safe online.


Secure your computer and mobile devices

  • Keep your operating systems up to date, and be sure to install security software.
  • Set up the screen lock feature on any mobile devices to prevent unauthorized access.
  • Always log off the site and close your internet browser or mobile app when you finish viewing your account information online.

More about securing your devices

Public wi-fi networks

Avoid using public wi-fi networks or unfamiliar hotspots. These networks are much more vulnerable than secure networks to malicious software that can install malware on your device to capture your username, password, and other security credentials when you go online.

Beware of unsolicited "popup" requests

If you didn't ask for it, you should decline the offer and close the window. Before installing any software on your device, always take a few minutes to research it.

Social media

Use common sense and caution when sharing personal information on social media, and make sure you know exactly how to control the privacy settings for every site you use.

FBI's common scams

The FBI website contains helpful information on how to protect your computer, along with an updated list of common scams and internet crimes.

Scams and Safety on the Internet 

Financial exploitation

Are you at risk?

Financial exploitation is a real concern, particularly for seniors and other vulnerable investors. Elder fraud claims billions of dollars a year in damages, but the truth is that anyone at any age can become a victim. The financial and emotional toll it takes on individuals and families can be devastating.

Take these important steps to protect yourself:

  • Review and update your security settings to ensure you've taken all the steps available to you to safeguard your accounts. Here's how: Once logged on to your account, from My Accounts, go to Profile & Account Settings and Security.
  • Prepare estate planning documents while you're in good health. Work with an attorney to determine if a durable or springing power of attorney is most appropriate for you; either of these would remain in effect if you were to become incapacitated.
  • Beware of "robocalls" from unknown numbers.
  • Don't share personal information (i.e., Social Security number, driver’s license or passport information, passwords, or logon credentials) with anyone if you haven't initiated the original contact.
  • To reduce unwanted calls, register your home or mobile phone number on the FTC's National Do Not Call Registry.
  • Beware of "phishing" emails and clicking or tapping on links in any unsolicited email message.
  • Be wary of pop-up notifications that indicate your computer has been infected with a virus and direct you to click on a link or call a phone number, instead consult a local computer repair specialist for guidance. 
  • Never wire or send money to someone you haven't met in person.

Financial exploitation and seniors

Scammers target seniors in part because they're more likely to have accumulated significant wealth and assets, although seniors at all income levels are vulnerable. A list of common scams can be found on the FBI and FTC resources provided on this page.

In some cases, seniors are financially exploited by a close contact, family member, or caretaker, making the situation even more sensitive and complex.

Fraudulent "phishing" emails

Scams designed to lure you into sharing your personal or financial credentials are becoming increasingly popular throughout the global financial industry. Cyber criminals attempt to get users to click a fraudulent link through a phone text message, email, or voicemail. 

Beware of Smishing, Phishing, Vishing and POP-UPS

These types of cyber-attacks can happen to anyone. All the criminals need are random emails or phone numbers to steal personal data. Cyber criminals are sophisticated and go to great lengths to get you to believe they are from legitimate companies or organizations.

More about phishing emails

More smishing, phishing, vishing and pop-ups

Create strong passwords

Your Vanguard account password should be reasonably complex and preferably at least 8 characters long. You should also update your password regularly and ensure it's different from the passwords you use to log on to other websites.

More tips on passwords and credentials

Monitor your account for fraudulent activity

Vanguard sends confirmation letters or emails when changes occur on your account. You can also sign up to receive account activity alerts via text for more immediate notification. If you see a change or transaction you didn't authorize, or you suspect fraud for any reason, contact us immediately at 877-223-6977 or via email at fraud@vanguard.com.

And if you've been a victim of identity theft within the past 12 months, please let us know.

Vanguard will never call you and ask you for:

  • Your password/logon credentials.
  • A security code you received via text or automated call.
  • Your social security number.

You should never disclose this information to anyone over the phone. If you suspect someone has gained access to this information, contact our fraud team immediately. We won’t send emails with logon links or attachments unless you’re expecting such an email from us based on a conversation with one of our crew members.

Naming a trusted contact can help prevent financial exploitation. A trusted contact is someone Vanguard could reach out to if we ever have concerns that you might be a victim of financial exploitation or are experiencing cognitive decline. This person is strictly an emergency contact and wouldn't have any access to your account.

Name a trusted contact

Help keep your loved ones safe

You can help protect family members, loved ones, and even yourself by having regular conversations about financial planning and physical well-being. Understanding your loved one's overall financial situation, including plans for retirement income and transfer of assets, and making sure their estate planning documents have been prepared, are important steps. Pay attention to any concerns that may arise, especially the warning signs of exploitation, which may include sudden or unexplained withdrawals or charges on their accounts, increased anxiety about their finances, new relationships with people you don't know, and sudden mood or behavioral changes.

Additional resources:

Protect your accounts

As a client, you have an important role to play in account security. These are some of the security features you can adopt to help protect your Vanguard accounts.

Security codes

Security codes are a form of two-factor authentication required for most accounts. You verify your identity with a temporary 6-digit code that we send to your phone after entering your username and password. You may choose to receive your code via text message (mobile only) or phone call (U.S. numbers only).

More about security codes
 

Set up security codes

Security keys

A security key is a form of two-factor authentication that uses a physical token to verify your identity. The security key plugs into your computer’s USB port. Some keys also have Bluetooth or near-field communication (NFC) capabilities.

More about security keys
 

Register a security key

Account activity alerts

Receive an immediate text message or email if we discover certain transactions and profile changes made to your account.

More about account activity alerts
 

Set up account activity alerts

Voice verification

Get safe, fast access to your accounts via phone using the sound of your voice to confirm your identity.

Watch our video to see how it works

More about voice verification

Enroll

Trusted contact

Naming a trusted contact can be an important way to help keep your assets safe and sound. This is a person Vanguard could reach out to if we ever had concerns that you may be a victim of financial exploitation or are experiencing cognitive decline.

More about trusted contacts
 

Name a trusted contact

Mobile app verification

Use the Vanguard app to verify your identity when logging in on our website. This process uses push notifications and your device’s existing biometrics authentication to ensure a fast and safe verification experience.

More about mobile app verification
 

Biometrics

Biometric authentication allows you to use your fingerprint or facial features stored on your phone to log in to the Vanguard mobile app. It’s convenient, safe, and uniquely you!

More about biometrics

Security codes are required for personal investor clients and participants in an employee-sponsored plan. Voice verification and trusted contact are only available for personal investor clients.

Suspect fraud?

Call us at 877-223-6977 or email  us immediately to report unauthorized activity on your accounts, or if you suspect fraud.

Under Vanguard’s Customer Protection Guarantee, Vanguard will reimburse you for unauthorized distributions from your account(s) that occur through no fault of your own, subject to eligibility requirements. See Our Promise for more information.

Step-by-step guide to reporting fraud

We need to know immediately if you've been a victim of fraud. Please take the following steps:

  1. Contact Vanguard immediately at 877-223-6977 or send an email to fraud@vanguard.com.
  2. Conduct a full virus scan on all your computers and mobile devices. You need to make sure you've removed any malicious code from your computers and devices before completing the next steps.
  3. Change your credentials on all websites you log on to. This includes your username, password, and security questions. Also remember to change your email and social media accounts.
  4. Alert the 3 major credit bureaus. These companies monitor your credit activity and can block people from opening accounts using your information. Contact each credit bureau below:

Equifax: 888-766-0008

Experian: 888-397-3742

TransUnion: 800-916-8800

Protect your computer/devices

  • Make sure that any computer or device you use to access your accounts has up-to-date antivirus and antispyware software and is protected by a firewall.
  • Don't use a public computer unless you know it has up-to-date security and you can log off completely.

Protect your vanguard.com username, password, and other account-related information

  • Make sure your username, password, and answers to your security questions are unique and strong and keep them secure.
  • Be careful about responding to, opening attachments in, or clicking or tapping links in emails that ask you for personal or financial information, because you may expose account-related information. Vanguard will never send you an email asking for your Social Security number, account numbers, passwords, or security questions and answers.
  • Don't store your password or answers to security questions on the computer or device you use to access your Vanguard accounts.

If you've been a victim of identity theft in the last 12 months and you're a Vanguard client, let us know.

You can send an email to fraud@vanguard.com and include your name, the circumstances of the criminal activity, and a phone number where we can reach you. Or you can call us at 877-223-6977 so we can collect the details and begin to investigate.

Tips for keeping your account information safe (PDF)

For more information on identity theft, visit the Federal Trade Commission (FTC) website. You'll get more information about this crime, see some helpful tips about how to protect yourself, and read about the latest scams.

Visit the FTC website

Monitor the activity in your account, and alert us immediately of any activity you didn't authorize

  • Review the account-related information we send or make available to you as soon as you receive it, such as account statements, confirmations, changes to your mail preferences (such as an address change), bank information (such as the addition or deletion of a bank), and other services.
  • Let us know immediately if you discover unauthorized activity, whether that activity is a transaction, a change to your account, or the addition, removal, or change of an account option or service. If you see something that you don't understand or that looks unusual, contact us for an explanation.

Our promise to you

We appreciate the trust you’ve placed in Vanguard and promise to protect your money as if it were our own.

Where you have taken the steps to protect your account as detailed below, Vanguard will reimburse every dollar that leaves your account by way of an unauthorized distribution.

What can I do to stay safe?

The security of your account is a team effort between you and Vanguard. To help protect your account and qualify for this guarantee you must do the following:

  • Guard your logon info. Never share your username, password, or security question answers with anyone. Vanguard will never email or text you to ask for this information.
  • Protect your devices. Keep the software on your computer and mobile devices up to date, especially the security features.
  • Monitor your account. Log on regularly, review all correspondence and account alerts and, if you notice suspicious transactions or other activity, let us know right away at 877-223-6977 or fraud@vanguard.com.
  • Once you notify Vanguard of potential unauthorized activity in your account, cooperate with Vanguard’s investigation of that claim.

For more information, please review the sections on online security tips and what to do if you suspect fraud.

What happens if I make a claim?

Vanguard may ask for your assistance investigating suspected unauthorized activity. That may involve steps like filing a police report, providing us with a statement of facts, and/or allowing us access to your computer. It’s important to clearly establish that the activity was unauthorized. Vanguard may investigate each claim and will determine your eligibility for this coverage based on your case.

Are claims ever denied?

If you take the steps noted above to protect your account and cooperate with Vanguard’s investigation, claims to recover funds lost by way of an unauthorized distribution from your account will generally be approved. Remember, if you give someone authority to transact on your behalf or share your Vanguard account credentials or information with any person or entity, their activity will be considered authorized, and you will not be eligible for this guarantee.

What accounts are covered?

Our reimbursement commitment covers accounts that you hold directly with Vanguard mutual funds and accounts with Vanguard Brokerage Services®, a division of Vanguard Marketing Corporation. If you participate in a retirement plan for which Vanguard provides record keeping and administrative services, your participant account is covered too (unless the activity is performed by an employer or plan sponsor representative who is authorized to access your account, in which case your employer or the plan sponsor may provide reimbursement for the unauthorized activity).

What accounts aren’t covered?

Our reimbursement commitment doesn't apply to unauthorized activity in annuities or 529 savings plan accounts.

How we protect you

Investors come first in everything we do, including our security features. Learn how we protect you and what you can do to keep your accounts safe. 

Know the signs of financial exploitation

Website security

Our website employs various security features—visible and invisible—to help keep you safe.

We also have a redundant data center in case one data center becomes unavailable, and test attack models within Vanguard's network.

Note: A security alert could indicate that either the date on your computer is incorrect or you're using an outdated version of your web browser.

In addition to these safeguards, Vanguard will never:

  • Send an unsolicited email asking you to respond with your personal account information (e.g., username, password, or Social Security number).
  • Ask for your web password in an email or request your personal information over the phone or by U.S.mail. We may ask for personal information if you've contacted us to report you're having trouble logging on to your Vanguard account(s).

Video transcript

When you call Vanguard

We'll take steps to ensure we've verified your identity before discussing personal and financial information with you over the phone. We'll ask you to verify personal information, which may include the security questions you selected as part of the web registration process. For extra verification, you can also request to use a PIN or password of your choice every time you call.

We'll never call you and ask for your password or logon credentials, your Social Security number, or a security code you've received via text or automated call. You should never disclose this information to anyone over the phone. If you suspect someone has gained access to this information, contact our fraud team immediately.

Text messages from Vanguard

Clients can opt in to receive service alerts via text message. You might get a service alert to remind you about an upcoming appointment or if we ever need more information to complete a request you submitted. In addition, you can opt to receive account activity alerts, a security feature that will notify you when certain changes or transactions are made on your account.

Review the terms and conditions to familiarize yourself with Vanguard's policy on service-related text messaging. Always use good judgment before tapping on links in text messages. If you're not expecting a text message from us, we do not recommend tapping on the link.

Notice about Section 311 of the USA PATRIOT Act

U.S. AML Certification (PDF)

Online security tips

In addition to taking advantage of Vanguard's security features, here are some general tips and best practices for keeping your personal and financial information safe online.


Secure your computer and mobile devices

  • Keep your operating systems up to date, and be sure to install security software.
  • Set up the screen lock feature on any mobile devices to prevent unauthorized access.
  • Always log off the site and close your internet browser or mobile app when you finish viewing your account information online.

More about securing your devices

Public wi-fi networks

Avoid using public wi-fi networks or unfamiliar hotspots. These networks are much more vulnerable than secure networks to malicious software that can install malware on your device to capture your username, password, and other security credentials when you go online.

Beware of unsolicited "popup" requests

If you didn't ask for it, you should decline the offer and close the window. Before installing any software on your device, always take a few minutes to research it.

Social media

Use common sense and caution when sharing personal information on social media, and make sure you know exactly how to control the privacy settings for every site you use.

FBI's common scams

The FBI website contains helpful information on how to protect your computer, along with an updated list of common scams and internet crimes.

Scams and Safety on the Internet 

Financial exploitation

Are you at risk?

Financial exploitation is a real concern, particularly for seniors and other vulnerable investors. Elder fraud claims billions of dollars a year in damages, but the truth is that anyone at any age can become a victim. The financial and emotional toll it takes on individuals and families can be devastating.

Take these important steps to protect yourself:

  • Review and update your security settings to ensure you've taken all the steps available to you to safeguard your accounts. Here's how: Once logged on to your account, from My Accounts, go to Profile & Account Settings and Security.
  • Prepare estate planning documents while you're in good health. Work with an attorney to determine if a durable or springing power of attorney is most appropriate for you; either of these would remain in effect if you were to become incapacitated.
  • Beware of "robocalls" from unknown numbers.
  • Don't share personal information (i.e., Social Security number, driver’s license or passport information, passwords, or logon credentials) with anyone if you haven't initiated the original contact.
  • To reduce unwanted calls, register your home or mobile phone number on the FTC's National Do Not Call Registry.
  • Beware of "phishing" emails and clicking or tapping on links in any unsolicited email message.
  • Be wary of pop-up notifications that indicate your computer has been infected with a virus and direct you to click on a link or call a phone number, instead consult a local computer repair specialist for guidance. 
  • Never wire or send money to someone you haven't met in person.

Financial exploitation and seniors

Scammers target seniors in part because they're more likely to have accumulated significant wealth and assets, although seniors at all income levels are vulnerable. A list of common scams can be found on the FBI and FTC resources provided on this page.

In some cases, seniors are financially exploited by a close contact, family member, or caretaker, making the situation even more sensitive and complex.

Fraudulent "phishing" emails

Scams designed to lure you into sharing your personal or financial credentials are becoming increasingly popular throughout the global financial industry. Cyber criminals attempt to get users to click a fraudulent link through a phone text message, email, or voicemail. 

Beware of Smishing, Phishing, Vishing and POP-UPS

These types of cyber-attacks can happen to anyone. All the criminals need are random emails or phone numbers to steal personal data. Cyber criminals are sophisticated and go to great lengths to get you to believe they are from legitimate companies or organizations.

More about phishing emails

More smishing, phishing, vishing and pop-ups

Create strong passwords

Your Vanguard account password should be reasonably complex and preferably at least 8 characters long. You should also update your password regularly and ensure it's different from the passwords you use to log on to other websites.

More tips on passwords and credentials

Monitor your account for fraudulent activity

Vanguard sends confirmation letters or emails when changes occur on your account. You can also sign up to receive account activity alerts via text for more immediate notification. If you see a change or transaction you didn't authorize, or you suspect fraud for any reason, contact us immediately at 877-223-6977 or via email at fraud@vanguard.com.

And if you've been a victim of identity theft within the past 12 months, please let us know.

Vanguard will never call you and ask you for:

  • Your password/logon credentials.
  • A security code you received via text or automated call.
  • Your social security number.

You should never disclose this information to anyone over the phone. If you suspect someone has gained access to this information, contact our fraud team immediately. We won’t send emails with logon links or attachments unless you’re expecting such an email from us based on a conversation with one of our crew members.

Naming a trusted contact can help prevent financial exploitation. A trusted contact is someone Vanguard could reach out to if we ever have concerns that you might be a victim of financial exploitation or are experiencing cognitive decline. This person is strictly an emergency contact and wouldn't have any access to your account.

Name a trusted contact

Help keep your loved ones safe

You can help protect family members, loved ones, and even yourself by having regular conversations about financial planning and physical well-being. Understanding your loved one's overall financial situation, including plans for retirement income and transfer of assets, and making sure their estate planning documents have been prepared, are important steps. Pay attention to any concerns that may arise, especially the warning signs of exploitation, which may include sudden or unexplained withdrawals or charges on their accounts, increased anxiety about their finances, new relationships with people you don't know, and sudden mood or behavioral changes.

Additional resources:

Protect your accounts

As a client, you have an important role to play in account security. These are some of the security features you can adopt to help protect your Vanguard accounts.

Security codes

Security codes are a form of two-factor authentication required for most accounts. You verify your identity with a temporary 6-digit code that we send to your phone after entering your username and password. You may choose to receive your code via text message (mobile only) or phone call (U.S. numbers only).

More about security codes
 

Set up security codes

Security keys

A security key is a form of two-factor authentication that uses a physical token to verify your identity. The security key plugs into your computer’s USB port. Some keys also have Bluetooth or near-field communication (NFC) capabilities.

More about security keys
 

Register a security key

Account activity alerts

Receive an immediate text message or email if we discover certain transactions and profile changes made to your account.

More about account activity alerts
 

Set up account activity alerts

Voice verification

Get safe, fast access to your accounts via phone using the sound of your voice to confirm your identity.

Watch our video to see how it works

More about voice verification

Enroll

Trusted contact

Naming a trusted contact can be an important way to help keep your assets safe and sound. This is a person Vanguard could reach out to if we ever had concerns that you may be a victim of financial exploitation or are experiencing cognitive decline.

More about trusted contacts
 

Name a trusted contact

Mobile app verification

Use the Vanguard app to verify your identity when logging in on our website. This process uses push notifications and your device’s existing biometrics authentication to ensure a fast and safe verification experience.

More about mobile app verification
 

Biometrics

Biometric authentication allows you to use your fingerprint or facial features stored on your phone to log in to the Vanguard mobile app. It’s convenient, safe, and uniquely you!

More about biometrics

Security codes are required for personal investor clients and participants in an employee-sponsored plan. Voice verification and trusted contact are only available for personal investor clients.

Suspect fraud?

Call us at 877-223-6977 or email  us immediately to report unauthorized activity on your accounts, or if you suspect fraud.

Under Vanguard’s Customer Protection Guarantee, Vanguard will reimburse you for unauthorized distributions from your account(s) that occur through no fault of your own, subject to eligibility requirements. See Our Promise for more information.

Step-by-step guide to reporting fraud

We need to know immediately if you've been a victim of fraud. Please take the following steps:

  1. Contact Vanguard immediately at 877-223-6977 or send an email to fraud@vanguard.com.
  2. Conduct a full virus scan on all your computers and mobile devices. You need to make sure you've removed any malicious code from your computers and devices before completing the next steps.
  3. Change your credentials on all websites you log on to. This includes your username, password, and security questions. Also remember to change your email and social media accounts.
  4. Alert the 3 major credit bureaus. These companies monitor your credit activity and can block people from opening accounts using your information. Contact each credit bureau below:

Equifax: 888-766-0008

Experian: 888-397-3742

TransUnion: 800-916-8800

Protect your computer/devices

  • Make sure that any computer or device you use to access your accounts has up-to-date antivirus and antispyware software and is protected by a firewall.
  • Don't use a public computer unless you know it has up-to-date security and you can log off completely.

Protect your vanguard.com username, password, and other account-related information

  • Make sure your username, password, and answers to your security questions are unique and strong and keep them secure.
  • Be careful about responding to, opening attachments in, or clicking or tapping links in emails that ask you for personal or financial information, because you may expose account-related information. Vanguard will never send you an email asking for your Social Security number, account numbers, passwords, or security questions and answers.
  • Don't store your password or answers to security questions on the computer or device you use to access your Vanguard accounts.

If you've been a victim of identity theft in the last 12 months and you're a Vanguard client, let us know.

You can send an email to fraud@vanguard.com and include your name, the circumstances of the criminal activity, and a phone number where we can reach you. Or you can call us at 877-223-6977 so we can collect the details and begin to investigate.

Tips for keeping your account information safe (PDF)

For more information on identity theft, visit the Federal Trade Commission (FTC) website. You'll get more information about this crime, see some helpful tips about how to protect yourself, and read about the latest scams.

Visit the FTC website

Monitor the activity in your account, and alert us immediately of any activity you didn't authorize

  • Review the account-related information we send or make available to you as soon as you receive it, such as account statements, confirmations, changes to your mail preferences (such as an address change), bank information (such as the addition or deletion of a bank), and other services.
  • Let us know immediately if you discover unauthorized activity, whether that activity is a transaction, a change to your account, or the addition, removal, or change of an account option or service. If you see something that you don't understand or that looks unusual, contact us for an explanation.

Our promise to you

We appreciate the trust you’ve placed in Vanguard and promise to protect your money as if it were our own.

Where you have taken the steps to protect your account as detailed below, Vanguard will reimburse every dollar that leaves your account by way of an unauthorized distribution.

What can I do to stay safe?

The security of your account is a team effort between you and Vanguard. To help protect your account and qualify for this guarantee you must do the following:

  • Guard your logon info. Never share your username, password, or security question answers with anyone. Vanguard will never email or text you to ask for this information.
  • Protect your devices. Keep the software on your computer and mobile devices up to date, especially the security features.
  • Monitor your account. Log on regularly, review all correspondence and account alerts and, if you notice suspicious transactions or other activity, let us know right away at 877-223-6977 or fraud@vanguard.com.
  • Once you notify Vanguard of potential unauthorized activity in your account, cooperate with Vanguard’s investigation of that claim.

For more information, please review the sections on online security tips and what to do if you suspect fraud.

What happens if I make a claim?

Vanguard may ask for your assistance investigating suspected unauthorized activity. That may involve steps like filing a police report, providing us with a statement of facts, and/or allowing us access to your computer. It’s important to clearly establish that the activity was unauthorized. Vanguard may investigate each claim and will determine your eligibility for this coverage based on your case.

Are claims ever denied?

If you take the steps noted above to protect your account and cooperate with Vanguard’s investigation, claims to recover funds lost by way of an unauthorized distribution from your account will generally be approved. Remember, if you give someone authority to transact on your behalf or share your Vanguard account credentials or information with any person or entity, their activity will be considered authorized, and you will not be eligible for this guarantee.

What accounts are covered?

Our reimbursement commitment covers accounts that you hold directly with Vanguard mutual funds and accounts with Vanguard Brokerage Services®, a division of Vanguard Marketing Corporation. If you participate in a retirement plan for which Vanguard provides record keeping and administrative services, your participant account is covered too (unless the activity is performed by an employer or plan sponsor representative who is authorized to access your account, in which case your employer or the plan sponsor may provide reimbursement for the unauthorized activity).

What accounts aren’t covered?

Our reimbursement commitment doesn't apply to unauthorized activity in annuities or 529 savings plan accounts.

Security codes

Protecting your account is one of our top priorities- that’s why we require that you set up security codes as your initial method of two-factor authentication before you log into your account for the first time.

With security codes, you choose to receive a text or call you with a temporary 6-digit code. You enter that code on our site, verifying your identity not only with something you know (your password), but also with something you have (your phone).

You can opt to authenticate with security codes each time you log in, or only when we don’t recognize you.

We will never phone you and ask you to disclose a security code.

To sign up for security codes, log in and navigate to the Security Profile section of your Profile & Account Settings.

If you're an institutional investor or a financial professional, security codes may not be part of the logon process.

Please log on to your account and review your security options under Account Maintenance, or call us at 888-353-0547.

What does it mean for Vanguard to “remember” me?

When you log on to your Vanguard account, you'll be asked whether you want us to "remember" you. Choosing “yes” allows us to bypass the security code step in the future. There are a multitude of factors that contribute to your recognition, including but not limited to device, browser, and location. If you're using a public or shared computer or you don't want to bypass this step, choose "no" and you will be prompted with security codes each time you log in.

Is there a cost?

Vanguard doesn't charge a fee for text messages, but carrier fees may apply.

Does a security code replace my password?

No, a security code is an added layer of protection. Enter your username and password first, then the security code.

Can I still get security codes on my phone if I don't receive text messages?

If you have a U.S. phone number, you can choose to get automated phone calls that read the security code to you instead of receiving the code in a text message.

Why can't I get a security code via email?

Email phishing scams can place your personal information at serious risk. Text messages and phone calls provide greater security, and your email providers may be subject to cyberattacks that can compromise personal data on a large scale.

Do security codes work with financial aggregation services?

Yes. If you're using an aggregation service to help manage your financial accounts, you shouldn't have a problem using security codes. If you have questions about your specific aggregation service, call us at 888-353-0547. For TTY/TDD, call 800-749-7273. We're available Monday through Friday, 8 a.m. to 8 p.m., Eastern Time.

Do security codes work with international phone numbers?

Yes, our codes will work with international phone numbers. Just be sure to leave the leading "0" off when you enter your number into our system. Note that if you're enrolled and travel outside the U.S., the mobile carrier may or may not deliver the security code to you, depending on your roaming restrictions and the carrier's ability to detect your location.

Do security codes expire?

Yes, security codes expire after 10 minutes. However, you can always request a new one when you're ready.

Why aren't I receiving my security code text messages?

There are several possible explanations—one of the most common is that your phone blocks calls or texts from unknown numbers. In this case, change your phone settings and then choose to resend a code. We'll send you another security code via text or phone call.

Although unusual, it's also possible that your carrier won't deliver a code because of a network issue. If this happens, call us at 888-353-0547.

How do I update my phone number and security code settings?

If you change your phone number, you must update your Vanguard security code settings in the Security Code section of the Account Maintenance area, or the My Profile section if you're accessing the retirement plans area of the site. We'll send a validation code to your new phone number using the contact method you select. Then you'll need to enter that validation code to update the service.

If you change carriers but keep your phone number, you don't have to make any changes to your security code service. Your security codes will automatically reroute to your existing phone number through your new carrier.

What's the difference between a security code and a security key?

A security code is a unique number we'll send to your phone, while a security key is a physical USB device that connects to your computer. Both security codes and security keys help protect your account. When you obtain a security key, you'll also sign up for security codes so you can access your account if you don't have your key with you.

Security keys

Security keys can be purchased from various online and trusted technology retailers. Be sure to choose a key that is FIDO2 certified. Android users can also use their phone as a security key through Google Chrome or Microsoft Edge.

The first time you use your security key at vanguard.com, you’ll need to register the key so we recognize it (and you) in the future. Once it’s registered, log on to your account with your username and password as you normally do. Your browser will prompt you to complete login with your security key.

It is required to register for security codes even when enrolled in security key as a backup if you lose, misplace or forget your key. 

For more information on security keys, visit our FAQ page.

Account activity alerts

How do these alerts work?

You can elect to be immediately notified by text message or email every time there's activity on your account, including:

  • Changes to your account information.
  • Account transactions—purchases, sales, or exchanges.
  • Transfers into or out of your account.

To choose your alert type and delivery method settings, simply log on to your account and go to the account activity alerts section.

Am I eligible for account activity alerts?

If you're a Vanguard client with an individual account or you have a Vanguard employer-sponsored retirement plan account, you can enroll in this service. If you'd like to receive alerts by text message rather than email, you'll need to use a domestic mobile number.

If there's activity on your account you don't recognize, call us immediately at 877-223-6977 or send an email to fraud@vanguard.com.

Voice verification

Voice verification enables us to quickly authenticate who you are and allows you to perform many transactions by phone. Our system uses sophisticated biometric technology to identify the unique patterns of your voice. It saves you time by letting you bypass security questions and speak directly with one of our investment professionals.

Enrolling in Vanguard Voice Verification™ is free and only takes a few moments.

When you sign up, you'll be asked to repeat a series of phrases. The system captures your vocal characteristics and makes a "voice verification print" that's as unique as your fingerprints. The next time you call us, you'll be prompted to identify yourself and repeat your voice passphrase instead of answering security questions.

Sign up now (logon required)

How voice verification works

Your voice is unique…just like your fingerprint. In fact, your voice is so unique, you can use it as your password when you call us.

When you sign up for Vanguard Voice Verification, you'll be able to verify your identity and let us know who you are. Just with the sound of your voice.

The privacy and security of your assets and account information are always important to us. That's why we're offering this service as another layer of protection…and extra peace of mind for you.

It's easy to sign up. When you enroll, our system will ask you to repeat a phrase. As it learns your voice, it creates your “voiceprint.”

We safeguard your voiceprint with the same high-level standards that we use to secure your financial information. Our voice verification system uses sophisticated biometric technology to identify the unique patterns of your voice.

Like fingerprints, no two voiceprints are the same. Whenever you call us, you'll repeat the phrase you used when you enrolled. Then, our system will compare your voiceprint to your live voice.

Once you're authenticated, you'll be able to speak with an associate. And you'll be able to conduct certain transactions without having to complete additional paperwork. That means you'll save time, too.

Sign up for Vanguard Voice Verification today and help us help you keep your account safe.

Go to vanguard.com/voice to get started and join the growing number of clients who are making their accounts even more secure with the sound of their voice.

Trusted contact

Having a trusted contact helps us administer your account and act quickly if we suspect financial exploitation or cognitive decline. You wouldn't want unforeseen circumstances to undermine all your plans and hard work. Just as you create a will, name beneficiaries, and establish durable power of attorney, naming a trusted contact with Vanguard is another measure to help keep your assets secure.

Why name a trusted contact

While it might be uncomfortable to think about, advancing age or declining health means that you may not always be able to manage your finances as you do today. If that happens, you might make decisions you wouldn't have made when you were well—or someone else may step in to make decisions for you, but perhaps not in the way you intended.

Financial exploitation can be alarming and unexpected, especially because it can happen at the hands of a family member, friend, or caregiver.

Who should this person be?

Your trusted contact should be someone you know would be unbiased when it comes to your health, whereabouts, and well-being—someone with integrity whom you can rely on. You can name anyone you decide is best. However, we encourage you to name someone who can't transact on your accounts to help ensure objectivity.

A trusted contact is different from someone with power of attorney—who may have limited or full authority to transact on your behalf in the event you become incapacitated. A trusted contact has a very specific and limited role and no power to transact or make any financial decisions for you. This person would only be contacted if we had concerns about your capacity or wellbeing. They can provide us with information but have no authority to transact on your behalf.

How a trusted contact can help

Our investment professionals are on alert for the signs of cognitive decline and financial exploitation of our clients. If you've provided us with a trusted contact, industry regulations permit us to reach out to them if we have concerns that you may be a victim of, or may be vulnerable to, financial exploitation—or if we're concerned about your mental or physical well-being. Having this process in place is an important way to help protect your assets.

Learn more at FINRA's site

Encryption

 

A way of securing your data online by scrambling the actual information so it becomes unreadable to anyone without the "key" to unlock the data.

Secure Sockets Layer (SSL) validation

Vanguard passed an independent and rigorous audit to get an "extended validation" SSL certificate from Comodo, a leading internet security authority. This can help prevent "phishing" attacks when you use certain browsers by highlighting the web address bar in green and showing the real company name when you access trusted websites, such as vanguard.com.

Username and password protection

 

After a limited number of unsuccessful logon attempts, Vanguard will disable your password as a precaution. If your password is disabled, you can restore access through our website or by calling Vanguard.

More on the USA PATRIOT Act

 

Pursuant to U.S. regulations issued under Section 311 of the USA PATRIOT Act, 31 C.F.R. Chapter X, Part 1010.651 through and including Part 1010.670, Vanguard, Inc. ("Vanguard"), is prohibited from establishing, maintaining, administering, or managing an account for or on behalf of any prohibited financial institutions as determined by the Financial Crimes Enforcement Network ("FinCEN"). In addition, Vanguard will not conduct business with any financial institutions for which FinCEN has issued proposed rules with respect to including such entities on the prohibited financial institutions list.

The Section 311 Special Measures regulations also require that Vanguard notify you that your correspondent account with our financial institution may not be used to provide access or services to any of the jurisdictions or financial institutions, their branches, offices, or subsidiaries in any jurisdiction listed below. If we become aware that any of the jurisdictions or financial institutions, their branches, offices, or subsidiaries in any jurisdiction listed below is directly or indirectly using the correspondent account you hold at our financial institution, we will be required to take appropriate steps to prevent such access, including, where necessary, terminating your account.

The most recent listing of prohibited financial institutions promulgated by FinCEN, as of October 25, 2019, is as follows:

Banco Delta Asia (including its subsidiaries Delta Asia Credit Limited and Delta Asia Insurance Limited)

Commercial Bank of Syria (including its subsidiary Syrian Lebanese Commercial Bank)

Any Burmese banking institution (except to the extent permitted by 31 C.F.R. 1010.651(b)(3))

FBME Bank Ltd. (formerly known as Federal Bank of the Middle East, Ltd.)

Any bank or financial institution of the Democratic People’s Republic of Korea

Bank of Dandong

Any banking institution of the Islamic Republic of Iran

There are proposed rules pending that seek to include the following financial institutions on the above-referenced list of prohibited financial institutions promulgated by FinCEN:

Halawi Exchange Co.

Kassem Rmeiti & Co. For Exchange (including Rmaiti Group SAL and Societe Rmaiti SARL (STE Rmeiti))

ABLV Bank, AS

Vanguard may, from time to time, update this notice to include jurisdictions or entities that are added to this list as new restrictions are proposed or issued. Current listings of entities subject to final or proposed rules under Section 311 can be found on the FinCEN website.

fincen.gov/resources/statutes-and-regulations/311-special-measures

How Vanguard protects your assets

Welcome to the Vanguard Security Center. Online privacy is on everybody's mind these days, and with good reason. The news carries many stories about hacked accounts and other online security violations. Increasingly, many of the people in our own lives are affected. As a Vanguard investor we want you to know how seriously we take this threat and how hard we're working to protect you against it.

Vanguard's reputation for asset management is well-known, but back here behind the scenes we are just as committed to protecting the data of our millions of individual, financial advisor, and institutional clients. When it comes to online security, we are your security partner.

As a global company, we guard against, and intercept, information security threats 24/7, around the world.

Our security systems are extensive--automatically tracking and safeguarding all transactions. At Vanguard, we monitor and protect about a million attempts to log on to our website every day.

And our Vanguard security crew is dedicated to the cause of online security. After all, our money is invested here too!

We know that the best defense is being proactive. So we help our investors to establish and maintain secure transactions up front, with valuable information, updated procedures, and careful authentication . . . to avoid security issues in the first place.

But--when there is an issue, we are here to help resolve that issue as quickly and easily as possible.

Sadie's story
"A client was worried about the security of her Vanguard account because her email was recently compromised. I verified that her account information was up-to-date. I also helped her add additional security layers on her account, on the web and when she calls in to Vanguard."

Darya's story
"A client contacted Vanguard after receiving notification that his online account access had been locked. The fraud department explained to him that they had proactively locked his account because of a suspicious phone call to our call center. The client understood why the account was locked and was happy that the investigator took the time to explain the situation and address all of his concerns."

Owen's story
"After a large retail chain's network was breached, a number of clients asked if the security of their Vanguard accounts were also affected. We explained that a simple thing to do was to make sure that their user name and password were different on their Vanguard account than their other online accounts."

You can be sure that we are always here, that we are watching all online transactions, and that we are here to protect investor assets and data in any and every way that we can. But remember . . . security is a partnership. Our efforts are most effective when you do your part too. We depend on you to protect yourself first by securing your online identity . . . keeping your computer up-to-date . . . using up-to-date anti-virus software . . . monitoring your accounts on a regular basis . . . and being very careful with respect to the use of public Wi-Fi.

Check in at our online Security Center often to see the latest safeguards and tips.

A typical phishing email instructs you to click a link that opens a fake website that will ask for your name, Social Security number, account number, password, and other personal information. It may be a message announcing that you've just won a prize. Other phishing emails try to get you to install "malware" on your computer: This is software that could take over your computer and steal your online credentials. Whatever their approach, these scammers prey on our natural tendencies to react quickly to what seems like an urgent or important request.

Ask yourself
  • Do I recognize the sender, or have I done business with them recently? (If not, be suspicious—don’t click or tap.)
  • Does the message refer to an action I recently took or a request I've made? (If it feels out of the blue, you should be suspicious—don't click or tap.)
  • Are they asking for my personal information? (Bad idea—don’t click or tap.)

Some scammers are quite good at "impersonating" legitimate companies, complete with doctored logos and email addresses that look real, but on closer inspection turn out to be imitations. Since many phishing emails originate overseas, look closely for grammatical/spelling errors or typos, which can tip you off that the email is fake. If you're in any doubt at all, it's best not to click or tap. You can always call the company if you want to verify that the message is real.

What to know about Vanguard emails
  • We generate our emails from vanguard.com, e-vanguard.com, evanguard.com, vanguardinvestments.com or m-vanguard.com. If you receive an email not sent from one of these addresses, we didn't send it. However, certain trusted third parties with established business relationships with Vanguard, including investordelivery.com and proxyvote.com, may send emails about our services.
  • We won't send unexpected emails with logon links or attachments.
  • If you receive an email from a sender claiming to be from Vanguard, and the email requests your private or personal information, forward it to phish@vanguard.com immediately. (If you opened any of the links or entered personal information on an unidentified website, let us know when you forward the message.)
Verify first

Do not open any link on the screen to find out where it leads. Some email scammers use "vanguard.com" in phony links to look legitimate. Unless "vanguard.com" is immediately followed by a slash ("/"), there's a chance the link's invalid or part of a scam. If you're unsure, don't click. Contact us immediately at 877-223-6977 or via email at fraud@vanguard.com if you suspect someone is trying to access your Vanguard account fraudulently.

What is SMISHING?

Smishing is a type of scam where attackers send SMS/text messages referencing an urgent issue or threat to trick victims into responding quickly and sharing personal information or installing malware on their devices.

Should you receive any random, unsolicited, or suspicious text message, please forward to phish@vanguard.com

What is VISHING?

Vishing is a type of scam where cybercriminals place phone calls to victims purporting to be from a legitimate company in order to persuade the victims into sharing their personal and/or financial credentials.

What is PHISHING?

Phishing is a type of scam where attackers send emails with links impersonating organizations to trick victims into sharing personal information or installing malware on their devices.

Should you receive a random, unsolicited, or suspicious email, please forward to phish@vanguard.com

What are POP-UP scams?

This scam involves a pop-up box or alert that appears on your computer screen or on a login screen referencing an urgent message. It is a ploy used by criminals to make you believe there is an issue with your computer or your account. The criminals will then pose as a company support team who can fix the issue. During the scheme, they may request that you grant them remote access to your computer, go to a website, download software, or request a text code to your phone. They may call you or ask you to call an 800# or to click on a link within the pop-up message.  Reminder: Vanguard will NEVER request access to your computer or mobile device.

Examples of fraudulent messages you may receive in any of the above schemes.

  • Your account has been locked due to unusual activity. (A fraudulent link will be present after the urgent message)
  • Your account has been suspended or disabled, please call ### to reactivate your account
  • Did you attempt to make a transaction on #date#, Reply Yes or No (A Phone number not associated with Vanguard may be referenced)
  • Please confirm recent transaction, Reply Yes or No (A Phone number not associated with Vanguard may be referenced)
  • We have detected suspicious activity on your account. Please call this number to speak to a customer service representative.
  • To finish setting up your account, please click this link and enter your personal information.
  • Urgent! Your account has been compromised. Please click this link to reset your password and prevent any further fraud.

Be cautious of any unusual, unsolicited text/email messages that ask for personal information and/or include a link. The links can take you to deceptive websites where you are asked to enter your personal and/ or financial information. Take the time to ask yourself why the sender is asking for your information.

If you are unsure whether a text message is legitimate, call the company or organization referenced in the message directly to verify. 

More about securing your devices



Most device manufacturers release operating system updates regularly and you need to keep your device current. Check your device's settings to see if you need to update its operating system.

If you're using a Windows operating system, go to Microsoft's website.

If you're using Apple's operating systems, go to Apple's website.

You should also download security software and keep it current to protect your computer, as well as your Android™ or Apple® mobile device. You should also monitor your computer and browser settings.

Set up personal firewalls

High-speed internet access is very convenient and "always on." But this continuous connection exposes your computer to online threats. You should install and use personal firewall software and keep it updated. Read your computer's operating manual or search the internet for help installing firewalls. Also look for included firewalls if you're purchasing home networking equipment such as a router.

Personal firewall software takes its name from the barriers built into cars and buildings that separate potentially hazardous environments from protected areas. Similarly, firewall software protects computers by monitoring the types of activity or attempted activity between the personal device and a network. Firewalls can refuse attempted connections that aren't initiated by you or that the software deems suspicious.

Get antivirus software and keep it up to date

Malicious code such as viruses, worms, and Trojan horses can wreak havoc on your computer. Bad code can even capture your logon infomation and take control of your computer.

You need to install and regularly update antivirus software to protect against, detect, and repair attacks from most viruses.

Combat spyware

Even if your computer has a firewall and antivirus software, it still could be susceptible to spyware. Spyware is software that appears to offer some tangible benefit, but actually monitors your behavior online. This illegal access is often used to intercept your usernames and passwords to your online accounts. You should install antispyware software and configure it to scan your personal device weekly. You should also:

Verify any software you install on your computer. If you see a Security Warning window when installing a program that reads "Do you want to install and run [name of program] issued by [name of company]?" and you don't recognize the company, select "No" to stop the installation.

Install a popup blocker to prevent spyware popup windows. (Spyware is often installed after clicking or tapping deceptive links in popup windows.) Note: You may want to change the settings in your popup blocker program to allow for popup windows on vanguard.com and other reputable sites you trust.

Log off after accessing your accounts online and close your web browser. Some of your account information can stay in your browser's memory until the browser is closed. You should do this on all computers and for all websites you log on to.

Do not open, click or tap links in, or open attachments in any email you think is suspicious. Vanguard won't send emails with logon links or attachments unless you're expecting such an email based on a conversation with one of our crew members.

Tips for mobile devices

Use apps carefully. Take care when installing apps on your device by following these tips:

Download apps securely. Always get your apps from reputable sources like the Apple App Store® or Google Play™ store to minimize the chance the apps contain malware.

Research apps before downloading. Review what an app can read and change on your device before downloading it to make sure that the app's access to your device is appropriate.

Update apps, especially security-related ones. Speaking of updates, it's usually safer to disable the "automatic update" feature on apps and your devices and update your apps manually. This way, you can review each update and determine if you want to proceed.

Sync your device safely. Syncing your mobile device "in the cloud" allows you to access files and content on any of your devices anywhere there's an internet connection. But you need to sync carefully.

Use a reputable service. Make sure that you use a cloud service provider that offers strong security and encryption services, including an SSL connection, to keep your information protected.

Sweat the details. Research the security features of cloud computing services on the internet or contact the vendors' customer service areas to learn what they do and don't provide.

Protect your password. Periodically change your syncing service password, if the provider offers that service. And never store your syncing password unencrypted on your device.

Mobile app verification

As a Vanguard personal investor, you have the option to authenticate using your mobile app. After you log in with your username and password on the web, we will prompt you to verify your identity with biometrics on your mobile app, then approve the login.

To start using your mobile app to verify your identity, you will need:

  1. A device with the Vanguard mobile app installed
  2. Biometrics capability on your device
  3. Enrollment in biometrics login in the mobile app
  4. Enrollment in security codes for your Vanguard account

We will never phone you and ask you to authenticate with your mobile device.

If you’re an institutional investor or a financial professional, mobile app verification may not be part of the login process. Please log in to your account and review your security options under My Profile, or call us at 888-353-0547.

Do I need push notifications enabled for mobile verification?

No, but you will need to manually open the Vanguard mobile app on your device to verify the login. For a faster, safer mobile verification experience, we recommend you enable push notifications.

Can I still use mobile app verification if I do not have the Vanguard app downloaded on my mobile device? What if my mobile phone doesn’t have biometric capabilities?

No, but you can still use security codes or security keys as an additional means to authenticate.

Does the verification attempt expire?

Yes, each verification attempt will expire after a period. You can always request a new prompt when you’re ready.

More tips on password and credentials


Your password should not be:

  • Written down, stored unencrypted on your computer or mobile device, or shared with anyone.
  • Given out over the phone.
  • A common word or close variation.
  • Composed of anyone's Social Security number, name, or other personal information.
  • Composed of 3 or more sequential letters, numbers, or keyboard patterns (e.g., QWERTY).
  • A minor tweak of your old password. (For example, if your previous password was bikerider23, your next password should not be bikerider24.)
Make it secure and memorable
  • Combine 2 or more words or abbreviations with numbers. For example, cpU34ChiP.
  • Remove vowels from a phrase and add numbers. For example, swim twenty laps becomes swm20LpS.
  • Abbreviate a favorite phrase. For example, I ride my bike 50 miles every Saturday becomes iRmB50meS.
  • Use famous people's initials. For example, a list of U.S. presidents including George Washington, Abraham Lincoln, and Thomas Jefferson becomes 1Gw2Al3Tj.
  • Note: Don't use any of these examples as your password.
Tips on security questions and answers
  • Be consistent with your wording. If you answer the security question "What is your favorite hobby?" with "golfing," the system will reject "golf" in the future.
  • Use one-word answers whenever possible. Avoid qualifiers such as "the," "and," "Inc.," "co," etc.
  • Note the emphasized words in the questions. For example, if your security question is "What is your current best friend's FIRST NAME?" don't put "John Smith."
  • Be careful with names. For example, if someone goes by James, Jimmy, or Jim, think about which one you'll use and remember.
  • Avoid overly quirky answers. Make sure you'll remember the answer you've chosen.
  • Don't use profanity.

Biometrics

In the Vanguard app, you have the option to log in using your unique biometric features for an additional layer of security on both iOS and Android devices. Because your identifying features are stored on your device and are not retained by Vanguard, this authentication method is safer and more accessible than traditional methods.

What biometrics options are supported?

Currently, the Vanguard mobile app supports the use of Touch ID and Face ID on iOS devices and fingerprint verification on Android devices. Make sure you have these options set up on your device before enrolling in biometrics on the Vanguard app.

How do I enable biometrics on my device?

Visit your profile on the Vanguard app and select Settings, then toggle the Biometric login option to On . Your device should then prompt you to enroll.

Can I use biometrics to verify an online login?

Yes, biometrics can be used as part of our mobile app verification process.