Trust & Security

Security at Vanguard

Keeping your accounts secure is our priority. Partnership is the key.

Website security

Our website employs various security features—visible and invisible—to help keep you safe.

We also have a redundant data center in case one data center becomes unavailable, and test attack models within Vanguard's network.

Note: A security alert could indicate that either the date on your computer is incorrect or you're using an outdated version of your web browser.

In addition to these safeguards, Vanguard will never:

  • Send an unsolicited email asking you to respond with your personal account information (e.g., username, password, or Social Security number).
  • Ask for your web password in an email or request your personal information over the phone or by U.S.mail. We may ask for personal information if you've contacted us to report you're having trouble logging on to your Vanguard account(s).

When you call Vanguard

We'll take steps to ensure we've verified your identity before discussing personal and financial information with you over the phone. We'll ask you to verify personal information, which may include the security questions you selected as part of the web registration process. For extra verification, you can also request to use a PIN or password of your choice every time you call.

We'll never call you and ask for your password or logon credentials, your Social Security number, or a security code you've received via text or automated call. You should never disclose this information to anyone over the phone. If you suspect someone has gained access to this information, contact our fraud team immediately.

Text messages from Vanguard

Clients can opt in to receive service alerts via text message. You might get a service alert to remind you about an upcoming appointment or if we ever need more information to complete a request you submitted. In addition, you can opt to receive account activity alerts, a security feature that will notify you when certain changes or transactions are made on your account.

Review the terms and conditions to familiarize yourself with Vanguard's policy on service-related text messaging. Always use good judgment before tapping on links in text messages. If you're not expecting a text message from us, we do not recommend tapping on the link.

Online security tips

In addition to taking advantage of Vanguard's security features, here are some general tips and best practices for keeping your personal and financial information safe online.


Secure your computer and mobile devices

  • Keep your operating systems up to date, and be sure to install security software.
  • Set up the screen lock feature on any mobile devices to prevent unauthorized access.
  • Always log off the site and close your internet browser or mobile app when you finish viewing your account information online.

More about securing your devices

Public wi-fi networks

Avoid using public wi-fi networks or unfamiliar hotspots. These networks are much more vulnerable than secure networks to malicious software that can install malware on your device to capture your username, password, and other security credentials when you go online.

Beware of unsolicited "popup" requests

If you didn't ask for it, you should decline the offer and close the window. Before installing any software on your device, always take a few minutes to research it.

Social media

Use common sense and caution when sharing personal information on social media, and make sure you know exactly how to control the privacy settings for every site you use.

FBI's common scams

The FBI website contains helpful information on how to protect your computer, along with an updated list of common scams and internet crimes.

Financial exploitation

Are you at risk?

Financial exploitation is a real concern, particularly for seniors and other vulnerable investors. Elder fraud claims billions of dollars a year in damages, but the truth is that anyone at any age can become a victim. The financial and emotional toll it takes on individuals and families can be devastating.

Take these important steps to protect yourself:

  • Review and update your security settings to ensure you've taken all the steps available to you to safeguard your accounts. Here's how: Once logged on to your account, from My Accounts, go to Profile & Account Settings and Security.
  • Prepare estate planning documents while you're in good health. Work with an attorney to determine if a durable or springing power of attorney is most appropriate for you; either of these would remain in effect if you were to become incapacitated.
  • Beware of "robocalls" from unknown numbers.
  • Don't share personal information (i.e., Social Security number, driver’s license or passport information, passwords, or logon credentials) with anyone if you haven't initiated the original contact.
  • To reduce unwanted calls, register your home or mobile phone number on the FTC's National Do Not Call Registry.
  • Beware of "phishing" emails and clicking or tapping on links in any unsolicited email message.
  • Be wary of pop-up notifications that indicate your computer has been infected with a virus and direct you to click on a link or call a phone number, instead consult a local computer repair specialist for guidance. 
  • Never wire or send money to someone you haven't met in person.

Financial exploitation and seniors

Scammers target seniors in part because they're more likely to have accumulated significant wealth and assets, although seniors at all income levels are vulnerable. A list of common scams can be found on the FBI and FTC resources provided on this page.

In some cases, seniors are financially exploited by a close contact, family member, or caretaker, making the situation even more sensitive and complex.

Fraudulent "phishing" emails

Scams designed to lure you into sharing your personal or financial credentials are becoming increasingly popular throughout the global financial industry. Cyber criminals attempt to get users to click a fraudulent link through a phone text message, email, or voicemail. 

Beware of Smishing, Phishing, Vishing and POP-UPS

These types of cyber-attacks can happen to anyone. All the criminals need are random emails or phone numbers to steal personal data. Cyber criminals are sophisticated and go to great lengths to get you to believe they are from legitimate companies or organizations.

More about phishing emails

More smishing, phishing, vishing and pop-ups

Create strong passwords

Your Vanguard account password should be reasonably complex and preferably at least 8 characters long. You should also update your password regularly and ensure it's different from the passwords you use to log on to other websites.

More tips on passwords and credentials

Monitor your account for fraudulent activity

Vanguard sends confirmation letters or emails when changes occur on your account. You can also sign up to receive account activity alerts via text for more immediate notification. If you see a change or transaction you didn't authorize, or you suspect fraud for any reason, contact us immediately at 877-223-6977 or via email at fraud@vanguard.com.

And if you've been a victim of identity theft within the past 12 months, please let us know.

Vanguard will never call you and ask you for:

  • Your password/logon credentials.
  • A security code you received via text or automated call.
  • Your social security number.

You should never disclose this information to anyone over the phone. If you suspect someone has gained access to this information, contact our fraud team immediately. We won’t send emails with logon links or attachments unless you’re expecting such an email from us based on a conversation with one of our crew members.

Naming a trusted contact can help prevent financial exploitation. A trusted contact is someone Vanguard could reach out to if we ever have concerns that you might be a victim of financial exploitation or are experiencing cognitive decline. This person is strictly an emergency contact and wouldn't have any access to your account.

Help keep your loved ones safe

You can help protect family members, loved ones, and even yourself by having regular conversations about financial planning and physical well-being. Understanding your loved one's overall financial situation, including plans for retirement income and transfer of assets, and making sure their estate planning documents have been prepared, are important steps. Pay attention to any concerns that may arise, especially the warning signs of exploitation, which may include sudden or unexplained withdrawals or charges on their accounts, increased anxiety about their finances, new relationships with people you don't know, and sudden mood or behavioral changes.

Additional resources:

Protect your accounts

As a client, you have an important role to play in account security. These are some of the security features you can adopt to help protect your Vanguard accounts.

Security codes

Security codes are a form of two-factor authentication required for most accounts. You verify your identity with a temporary 6-digit code that we send to your phone after entering your username and password. You may choose to receive your code via text message (mobile only) or phone call (U.S. numbers only).

More about security codes
 

Security keys

A security key is a form of two-factor authentication that uses a physical token to verify your identity. The security key plugs into your computer’s USB port. Some keys also have Bluetooth or near-field communication (NFC) capabilities.

More about security keys
 

Account activity alerts

Receive an immediate text message or email if we discover certain transactions and profile changes made to your account.

More about account activity alerts
 

Voice verification

Get safe, fast access to your accounts via phone using the sound of your voice to confirm your identity.

Watch our video to see how it works

More about voice verification

Trusted contact

Naming a trusted contact can be an important way to help keep your assets safe and sound. This is a person Vanguard could reach out to if we ever had concerns that you may be a victim of financial exploitation or are experiencing cognitive decline.

More about trusted contacts
 

Mobile app verification

Use the Vanguard app to verify your identity when logging in on our website. This process uses push notifications and your device’s existing biometrics authentication to ensure a fast and safe verification experience.

More about mobile app verification
 

Biometrics

Biometric authentication allows you to use your fingerprint or facial features stored on your phone to log in to the Vanguard mobile app. It’s convenient, safe, and uniquely you!

More about biometrics

Security codes are required for personal investor clients and participants in an employee-sponsored plan. Voice verification and trusted contact are only available for personal investor clients.

Suspect fraud?

Call us at 877-223-6977 or email  us immediately to report unauthorized activity on your accounts, or if you suspect fraud.

Under Vanguard’s Customer Protection Guarantee, Vanguard will reimburse you for unauthorized distributions from your account(s) that occur through no fault of your own, subject to eligibility requirements. See Our Promise for more information.

Step-by-step guide to reporting fraud

We need to know immediately if you've been a victim of fraud. Please take the following steps:

  1. Contact Vanguard immediately at 877-223-6977 or send an email to fraud@vanguard.com.
  2. Conduct a full virus scan on all your computers and mobile devices. You need to make sure you've removed any malicious code from your computers and devices before completing the next steps.
  3. Change your credentials on all websites you log on to. This includes your username, password, and security questions. Also remember to change your email and social media accounts.
  4. Alert the 3 major credit bureaus. These companies monitor your credit activity and can block people from opening accounts using your information. Contact each credit bureau below:

Protect your computer/devices

  • Make sure that any computer or device you use to access your accounts has up-to-date antivirus and antispyware software and is protected by a firewall.
  • Don't use a public computer unless you know it has up-to-date security and you can log off completely.

Protect your vanguard.com username, password, and other account-related information

  • Make sure your username, password, and answers to your security questions are unique and strong and keep them secure.
  • Be careful about responding to, opening attachments in, or clicking or tapping links in emails that ask you for personal or financial information, because you may expose account-related information. Vanguard will never send you an email asking for your Social Security number, account numbers, passwords, or security questions and answers.
  • Don't store your password or answers to security questions on the computer or device you use to access your Vanguard accounts.

If you've been a victim of identity theft in the last 12 months and you're a Vanguard client, let us know.

You can send an email to fraud@vanguard.com and include your name, the circumstances of the criminal activity, and a phone number where we can reach you. Or you can call us at 877-223-6977 so we can collect the details and begin to investigate.

For more information on identity theft, visit the Federal Trade Commission (FTC) website. You'll get more information about this crime, see some helpful tips about how to protect yourself, and read about the latest scams.

Monitor the activity in your account, and alert us immediately of any activity you didn't authorize

  • Review the account-related information we send or make available to you as soon as you receive it, such as account statements, confirmations, changes to your mail preferences (such as an address change), bank information (such as the addition or deletion of a bank), and other services.
  • Let us know immediately if you discover unauthorized activity, whether that activity is a transaction, a change to your account, or the addition, removal, or change of an account option or service. If you see something that you don't understand or that looks unusual, contact us for an explanation.

Our promise to you

We appreciate the trust you’ve placed in Vanguard and promise to protect your money as if it were our own.

Where you have taken the steps to protect your account as detailed below, Vanguard will reimburse every dollar that leaves your account by way of an unauthorized distribution.

What can I do to stay safe?

The security of your account is a team effort between you and Vanguard. To help protect your account and qualify for this guarantee you must do the following:

  • Guard your logon info. Never share your username, password, or security question answers with anyone. Vanguard will never email or text you to ask for this information.
  • Protect your devices. Keep the software on your computer and mobile devices up to date, especially the security features.
  • Monitor your account. Log on regularly, review all correspondence and account alerts and, if you notice suspicious transactions or other activity, let us know right away at 877-223-6977 or fraud@vanguard.com.
  • Once you notify Vanguard of potential unauthorized activity in your account, cooperate with Vanguard’s investigation of that claim.

For more information, please review the sections on online security tips and what to do if you suspect fraud.

What happens if I make a claim?

Vanguard may ask for your assistance investigating suspected unauthorized activity. That may involve steps like filing a police report, providing us with a statement of facts, and/or allowing us access to your computer. It’s important to clearly establish that the activity was unauthorized. Vanguard may investigate each claim and will determine your eligibility for this coverage based on your case.

Are claims ever denied?

If you take the steps noted above to protect your account and cooperate with Vanguard’s investigation, claims to recover funds lost by way of an unauthorized distribution from your account will generally be approved. Remember, if you give someone authority to transact on your behalf or share your Vanguard account credentials or information with any person or entity, their activity will be considered authorized, and you will not be eligible for this guarantee.

What accounts are covered?

Our reimbursement commitment covers accounts that you hold directly with Vanguard mutual funds and accounts with Vanguard Brokerage Services®, a division of Vanguard Marketing Corporation. If you participate in a retirement plan for which Vanguard provides record keeping and administrative services, your participant account is covered too (unless the activity is performed by an employer or plan sponsor representative who is authorized to access your account, in which case your employer or the plan sponsor may provide reimbursement for the unauthorized activity).

What accounts aren’t covered?

Our reimbursement commitment doesn't apply to unauthorized activity in annuities or 529 savings plan accounts.

Website security

Our website employs various security features—visible and invisible—to help keep you safe.

We also have a redundant data center in case one data center becomes unavailable, and test attack models within Vanguard's network.

Note: A security alert could indicate that either the date on your computer is incorrect or you're using an outdated version of your web browser.

In addition to these safeguards, Vanguard will never:

  • Send an unsolicited email asking you to respond with your personal account information (e.g., username, password, or Social Security number).
  • Ask for your web password in an email or request your personal information over the phone or by U.S.mail. We may ask for personal information if you've contacted us to report you're having trouble logging on to your Vanguard account(s).

When you call Vanguard

We'll take steps to ensure we've verified your identity before discussing personal and financial information with you over the phone. We'll ask you to verify personal information, which may include the security questions you selected as part of the web registration process. For extra verification, you can also request to use a PIN or password of your choice every time you call.

We'll never call you and ask for your password or logon credentials, your Social Security number, or a security code you've received via text or automated call. You should never disclose this information to anyone over the phone. If you suspect someone has gained access to this information, contact our fraud team immediately.

Text messages from Vanguard

Clients can opt in to receive service alerts via text message. You might get a service alert to remind you about an upcoming appointment or if we ever need more information to complete a request you submitted. In addition, you can opt to receive account activity alerts, a security feature that will notify you when certain changes or transactions are made on your account.

Review the terms and conditions to familiarize yourself with Vanguard's policy on service-related text messaging. Always use good judgment before tapping on links in text messages. If you're not expecting a text message from us, we do not recommend tapping on the link.

Online security tips

In addition to taking advantage of Vanguard's security features, here are some general tips and best practices for keeping your personal and financial information safe online.


Secure your computer and mobile devices

  • Keep your operating systems up to date, and be sure to install security software.
  • Set up the screen lock feature on any mobile devices to prevent unauthorized access.
  • Always log off the site and close your internet browser or mobile app when you finish viewing your account information online.

More about securing your devices

Public wi-fi networks

Avoid using public wi-fi networks or unfamiliar hotspots. These networks are much more vulnerable than secure networks to malicious software that can install malware on your device to capture your username, password, and other security credentials when you go online.

Beware of unsolicited "popup" requests

If you didn't ask for it, you should decline the offer and close the window. Before installing any software on your device, always take a few minutes to research it.

Social media

Use common sense and caution when sharing personal information on social media, and make sure you know exactly how to control the privacy settings for every site you use.

FBI's common scams

The FBI website contains helpful information on how to protect your computer, along with an updated list of common scams and internet crimes.

Financial exploitation

Are you at risk?

Financial exploitation is a real concern, particularly for seniors and other vulnerable investors. Elder fraud claims billions of dollars a year in damages, but the truth is that anyone at any age can become a victim. The financial and emotional toll it takes on individuals and families can be devastating.

Take these important steps to protect yourself:

  • Review and update your security settings to ensure you've taken all the steps available to you to safeguard your accounts. Here's how: Once logged on to your account, from My Accounts, go to Profile & Account Settings and Security.
  • Prepare estate planning documents while you're in good health. Work with an attorney to determine if a durable or springing power of attorney is most appropriate for you; either of these would remain in effect if you were to become incapacitated.
  • Beware of "robocalls" from unknown numbers.
  • Don't share personal information (i.e., Social Security number, driver’s license or passport information, passwords, or logon credentials) with anyone if you haven't initiated the original contact.
  • To reduce unwanted calls, register your home or mobile phone number on the FTC's National Do Not Call Registry.
  • Beware of "phishing" emails and clicking or tapping on links in any unsolicited email message.
  • Be wary of pop-up notifications that indicate your computer has been infected with a virus and direct you to click on a link or call a phone number, instead consult a local computer repair specialist for guidance. 
  • Never wire or send money to someone you haven't met in person.

Financial exploitation and seniors

Scammers target seniors in part because they're more likely to have accumulated significant wealth and assets, although seniors at all income levels are vulnerable. A list of common scams can be found on the FBI and FTC resources provided on this page.

In some cases, seniors are financially exploited by a close contact, family member, or caretaker, making the situation even more sensitive and complex.

Fraudulent "phishing" emails

Scams designed to lure you into sharing your personal or financial credentials are becoming increasingly popular throughout the global financial industry. Cyber criminals attempt to get users to click a fraudulent link through a phone text message, email, or voicemail. 

Beware of Smishing, Phishing, Vishing and POP-UPS

These types of cyber-attacks can happen to anyone. All the criminals need are random emails or phone numbers to steal personal data. Cyber criminals are sophisticated and go to great lengths to get you to believe they are from legitimate companies or organizations.

More about phishing emails

More smishing, phishing, vishing and pop-ups

Create strong passwords

Your Vanguard account password should be reasonably complex and preferably at least 8 characters long. You should also update your password regularly and ensure it's different from the passwords you use to log on to other websites.

More tips on passwords and credentials

Monitor your account for fraudulent activity

Vanguard sends confirmation letters or emails when changes occur on your account. You can also sign up to receive account activity alerts via text for more immediate notification. If you see a change or transaction you didn't authorize, or you suspect fraud for any reason, contact us immediately at 877-223-6977 or via email at fraud@vanguard.com.

And if you've been a victim of identity theft within the past 12 months, please let us know.

Vanguard will never call you and ask you for:

  • Your password/logon credentials.
  • A security code you received via text or automated call.
  • Your social security number.

You should never disclose this information to anyone over the phone. If you suspect someone has gained access to this information, contact our fraud team immediately. We won’t send emails with logon links or attachments unless you’re expecting such an email from us based on a conversation with one of our crew members.

Naming a trusted contact can help prevent financial exploitation. A trusted contact is someone Vanguard could reach out to if we ever have concerns that you might be a victim of financial exploitation or are experiencing cognitive decline. This person is strictly an emergency contact and wouldn't have any access to your account.

Help keep your loved ones safe

You can help protect family members, loved ones, and even yourself by having regular conversations about financial planning and physical well-being. Understanding your loved one's overall financial situation, including plans for retirement income and transfer of assets, and making sure their estate planning documents have been prepared, are important steps. Pay attention to any concerns that may arise, especially the warning signs of exploitation, which may include sudden or unexplained withdrawals or charges on their accounts, increased anxiety about their finances, new relationships with people you don't know, and sudden mood or behavioral changes.

Additional resources:

Protect your accounts

As a client, you have an important role to play in account security. These are some of the security features you can adopt to help protect your Vanguard accounts.

Security codes

Security codes are a form of two-factor authentication required for most accounts. You verify your identity with a temporary 6-digit code that we send to your phone after entering your username and password. You may choose to receive your code via text message (mobile only) or phone call (U.S. numbers only).

More about security codes
 

Security keys

A security key is a form of two-factor authentication that uses a physical token to verify your identity. The security key plugs into your computer’s USB port. Some keys also have Bluetooth or near-field communication (NFC) capabilities.

More about security keys
 

Account activity alerts

Receive an immediate text message or email if we discover certain transactions and profile changes made to your account.

More about account activity alerts
 

Voice verification

Get safe, fast access to your accounts via phone using the sound of your voice to confirm your identity.

Watch our video to see how it works

More about voice verification

Trusted contact

Naming a trusted contact can be an important way to help keep your assets safe and sound. This is a person Vanguard could reach out to if we ever had concerns that you may be a victim of financial exploitation or are experiencing cognitive decline.

More about trusted contacts
 

Mobile app verification

Use the Vanguard app to verify your identity when logging in on our website. This process uses push notifications and your device’s existing biometrics authentication to ensure a fast and safe verification experience.

More about mobile app verification
 

Biometrics

Biometric authentication allows you to use your fingerprint or facial features stored on your phone to log in to the Vanguard mobile app. It’s convenient, safe, and uniquely you!

More about biometrics

Security codes are required for personal investor clients and participants in an employee-sponsored plan. Voice verification and trusted contact are only available for personal investor clients.

Suspect fraud?

Call us at 877-223-6977 or email  us immediately to report unauthorized activity on your accounts, or if you suspect fraud.

Under Vanguard’s Customer Protection Guarantee, Vanguard will reimburse you for unauthorized distributions from your account(s) that occur through no fault of your own, subject to eligibility requirements. See Our Promise for more information.

Step-by-step guide to reporting fraud

We need to know immediately if you've been a victim of fraud. Please take the following steps:

  1. Contact Vanguard immediately at 877-223-6977 or send an email to fraud@vanguard.com.
  2. Conduct a full virus scan on all your computers and mobile devices. You need to make sure you've removed any malicious code from your computers and devices before completing the next steps.
  3. Change your credentials on all websites you log on to. This includes your username, password, and security questions. Also remember to change your email and social media accounts.
  4. Alert the 3 major credit bureaus. These companies monitor your credit activity and can block people from opening accounts using your information. Contact each credit bureau below:

Protect your computer/devices

  • Make sure that any computer or device you use to access your accounts has up-to-date antivirus and antispyware software and is protected by a firewall.
  • Don't use a public computer unless you know it has up-to-date security and you can log off completely.

Protect your vanguard.com username, password, and other account-related information

  • Make sure your username, password, and answers to your security questions are unique and strong and keep them secure.
  • Be careful about responding to, opening attachments in, or clicking or tapping links in emails that ask you for personal or financial information, because you may expose account-related information. Vanguard will never send you an email asking for your Social Security number, account numbers, passwords, or security questions and answers.
  • Don't store your password or answers to security questions on the computer or device you use to access your Vanguard accounts.

If you've been a victim of identity theft in the last 12 months and you're a Vanguard client, let us know.

You can send an email to fraud@vanguard.com and include your name, the circumstances of the criminal activity, and a phone number where we can reach you. Or you can call us at 877-223-6977 so we can collect the details and begin to investigate.

For more information on identity theft, visit the Federal Trade Commission (FTC) website. You'll get more information about this crime, see some helpful tips about how to protect yourself, and read about the latest scams.

Monitor the activity in your account, and alert us immediately of any activity you didn't authorize

  • Review the account-related information we send or make available to you as soon as you receive it, such as account statements, confirmations, changes to your mail preferences (such as an address change), bank information (such as the addition or deletion of a bank), and other services.
  • Let us know immediately if you discover unauthorized activity, whether that activity is a transaction, a change to your account, or the addition, removal, or change of an account option or service. If you see something that you don't understand or that looks unusual, contact us for an explanation.

Our promise to you

We appreciate the trust you’ve placed in Vanguard and promise to protect your money as if it were our own.

Where you have taken the steps to protect your account as detailed below, Vanguard will reimburse every dollar that leaves your account by way of an unauthorized distribution.

What can I do to stay safe?

The security of your account is a team effort between you and Vanguard. To help protect your account and qualify for this guarantee you must do the following:

  • Guard your logon info. Never share your username, password, or security question answers with anyone. Vanguard will never email or text you to ask for this information.
  • Protect your devices. Keep the software on your computer and mobile devices up to date, especially the security features.
  • Monitor your account. Log on regularly, review all correspondence and account alerts and, if you notice suspicious transactions or other activity, let us know right away at 877-223-6977 or fraud@vanguard.com.
  • Once you notify Vanguard of potential unauthorized activity in your account, cooperate with Vanguard’s investigation of that claim.

For more information, please review the sections on online security tips and what to do if you suspect fraud.

What happens if I make a claim?

Vanguard may ask for your assistance investigating suspected unauthorized activity. That may involve steps like filing a police report, providing us with a statement of facts, and/or allowing us access to your computer. It’s important to clearly establish that the activity was unauthorized. Vanguard may investigate each claim and will determine your eligibility for this coverage based on your case.

Are claims ever denied?

If you take the steps noted above to protect your account and cooperate with Vanguard’s investigation, claims to recover funds lost by way of an unauthorized distribution from your account will generally be approved. Remember, if you give someone authority to transact on your behalf or share your Vanguard account credentials or information with any person or entity, their activity will be considered authorized, and you will not be eligible for this guarantee.

What accounts are covered?

Our reimbursement commitment covers accounts that you hold directly with Vanguard mutual funds and accounts with Vanguard Brokerage Services®, a division of Vanguard Marketing Corporation. If you participate in a retirement plan for which Vanguard provides record keeping and administrative services, your participant account is covered too (unless the activity is performed by an employer or plan sponsor representative who is authorized to access your account, in which case your employer or the plan sponsor may provide reimbursement for the unauthorized activity).

What accounts aren’t covered?

Our reimbursement commitment doesn't apply to unauthorized activity in annuities or 529 savings plan accounts.