Security at Vanguard

Security codes

Protecting your account is one of our top priorities- that’s why we require that you set up security codes as your initial method of two-factor authentication before you log into your account for the first time.

With security codes, you choose to receive a text or call you with a temporary 6-digit code. You enter that code on our site, verifying your identity not only with something you know (your password), but also with something you have (your phone).

You can opt to authenticate with security codes each time you log in, or only when we don’t recognize you.

We will never phone you and ask you to disclose a security code.

To sign up for security codes, log in and navigate to the Security Profile section of your Profile & Account Settings.

If you're an institutional investor or a financial professional, security codes may not be part of the logon process.

Please log on to your account and review your security options under Account Maintenance, or call us at 888-353-0547.

What does it mean for Vanguard to “remember” me?

When you log on to your Vanguard account, you'll be asked whether you want us to "remember" you. Choosing “yes” allows us to bypass the security code step in the future. There are a multitude of factors that contribute to your recognition, including but not limited to device, browser, and location. If you're using a public or shared computer or you don't want to bypass this step, choose "no" and you will be prompted with security codes each time you log in.

Is there a cost?

Vanguard doesn't charge a fee for text messages, but carrier fees may apply.

Does a security code replace my password?

No, a security code is an added layer of protection. Enter your username and password first, then the security code.

Can I still get security codes on my phone if I don't receive text messages?

If you have a U.S. phone number, you can choose to get automated phone calls that read the security code to you instead of receiving the code in a text message.

Why can't I get a security code via email?

Email phishing scams can place your personal information at serious risk. Text messages and phone calls provide greater security, and your email providers may be subject to cyberattacks that can compromise personal data on a large scale.

Do security codes work with financial aggregation services?

Yes. If you're using an aggregation service to help manage your financial accounts, you shouldn't have a problem using security codes. If you have questions about your specific aggregation service, call us at 888-353-0547. For TTY/TDD, call 800-749-7273. We're available Monday through Friday, 8 a.m. to 8 p.m., Eastern Time.

Do security codes work with international phone numbers?

Yes, our codes will work with international phone numbers. Just be sure to leave the leading "0" off when you enter your number into our system. Note that if you're enrolled and travel outside the U.S., the mobile carrier may or may not deliver the security code to you, depending on your roaming restrictions and the carrier's ability to detect your location.

Do security codes expire?

Yes, security codes expire after 10 minutes. However, you can always request a new one when you're ready.

Why aren't I receiving my security code text messages?

There are several possible explanations—one of the most common is that your phone blocks calls or texts from unknown numbers. In this case, change your phone settings and then choose to resend a code. We'll send you another security code via text or phone call.

Although unusual, it's also possible that your carrier won't deliver a code because of a network issue. If this happens, call us at 888-353-0547.

How do I update my phone number and security code settings?

If you change your phone number, you must update your Vanguard security code settings in the Security Code section of the Account Maintenance area, or the My Profile section if you're accessing the retirement plans area of the site. We'll send a validation code to your new phone number using the contact method you select. Then you'll need to enter that validation code to update the service.

If you change carriers but keep your phone number, you don't have to make any changes to your security code service. Your security codes will automatically reroute to your existing phone number through your new carrier.

What's the difference between a security code and a security key?

A security code is a unique number we'll send to your phone, while a security key is a physical USB device that connects to your computer. Both security codes and security keys help protect your account. When you obtain a security key, you'll also sign up for security codes so you can access your account if you don't have your key with you.

Security keys

Security keys can be purchased from various online and trusted technology retailers. Be sure to choose a key that is FIDO2 certified. Android users can also use their phone as a security key through Google Chrome or Microsoft Edge.

The first time you use your security key at vanguard.com, you’ll need to register the key so we recognize it (and you) in the future. Once it’s registered, log on to your account with your username and password as you normally do. Your browser will prompt you to complete login with your security key.

It is required to register for security codes even when enrolled in security key as a backup if you lose, misplace or forget your key. 

For more information on security keys, visit our FAQ page.

Account activity alerts

How do these alerts work?

You can elect to be immediately notified by text message or email every time there's activity on your account, including:

• Changes to your account information.
• Account transactions—purchases, sales, or exchanges.
• Transfers into or out of your account.

To choose your alert type and delivery method settings, simply log on to your account and go to the account activity alerts section.

Am I eligible for account activity alerts?

If you're a Vanguard client with an individual account or you have a Vanguard employer-sponsored retirement plan account, you can enroll in this service. If you'd like to receive alerts by text message rather than email, you'll need to use a domestic mobile number.

If there's activity on your account you don't recognize, call us immediately at 877-223-6977 or send an email to fraud@vanguard.com.

Voice verification

Voice verification enables us to quickly authenticate who you are and allows you to perform many transactions by phone. Our system uses sophisticated biometric technology to identify the unique patterns of your voice. It saves you time by letting you bypass security questions and speak directly with one of our investment professionals.

Enrolling in Vanguard Voice Verification™ is free and only takes a few moments.

When you sign up, you'll be asked to repeat a series of phrases. The system captures your vocal characteristics and makes a "voice verification print" that's as unique as your fingerprints. The next time you call us, you'll be prompted to identify yourself and repeat your voice passphrase instead of answering security questions.

Sign up now (logon required)

Trusted contact

Having a trusted contact helps us administer your account and act quickly if we suspect financial exploitation or cognitive decline. You wouldn't want unforeseen circumstances to undermine all your plans and hard work. Just as you create a will, name beneficiaries, and establish durable power of attorney, naming a trusted contact with Vanguard is another measure to help keep your assets secure.

Why name a trusted contact

While it might be uncomfortable to think about, advancing age or declining health means that you may not always be able to manage your finances as you do today. If that happens, you might make decisions you wouldn't have made when you were well—or someone else may step in to make decisions for you, but perhaps not in the way you intended.

Financial exploitation can be alarming and unexpected, especially because it can happen at the hands of a family member, friend, or caregiver.

Who should this person be?

Your trusted contact should be someone you know would be unbiased when it comes to your health, whereabouts, and well-being—someone with integrity whom you can rely on. You can name anyone you decide is best. However, we encourage you to name someone who can't transact on your accounts to help ensure objectivity.

A trusted contact is different from someone with power of attorney—who may have limited or full authority to transact on your behalf in the event you become incapacitated. A trusted contact has a very specific and limited role and no power to transact or make any financial decisions for you. This person would only be contacted if we had concerns about your capacity or wellbeing. They can provide us with information but have no authority to transact on your behalf.

How a trusted contact can help

Our investment professionals are on alert for the signs of cognitive decline and financial exploitation of our clients. If you've provided us with a trusted contact, industry regulations permit us to reach out to them if we have concerns that you may be a victim of, or may be vulnerable to, financial exploitation—or if we're concerned about your mental or physical well-being. Having this process in place is an important way to help protect your assets.

Learn more at FINRA's site

Encryption

A way of securing your data online by scrambling the actual information so it becomes unreadable to anyone without the "key" to unlock the data.

Secure Sockets Layer (SSL) validation

Vanguard passed an independent and rigorous audit to get an "extended validation" SSL certificate from Comodo, a leading internet security authority. This can help prevent "phishing" attacks when you use certain browsers by highlighting the web address bar in green and showing the real company name when you access trusted websites, such as vanguard.com.

Username and password protection

After a limited number of unsuccessful logon attempts, Vanguard will disable your password as a precaution. If your password is disabled, you can restore access through our website or by calling Vanguard.

More on the USA PATRIOT Act

Pursuant to U.S. regulations issued under Section 311 of the USA PATRIOT Act, 31 C.F.R. Chapter X, Part 1010.651 through and including Part 1010.670, Vanguard, Inc. ("Vanguard"), is prohibited from establishing, maintaining, administering, or managing an account for or on behalf of any prohibited financial institutions as determined by the Financial Crimes Enforcement Network ("FinCEN"). In addition, Vanguard will not conduct business with any financial institutions for which FinCEN has issued proposed rules with respect to including such entities on the prohibited financial institutions list.

The Section 311 Special Measures regulations also require that Vanguard notify you that your correspondent account with our financial institution may not be used to provide access or services to any of the jurisdictions or financial institutions, their branches, offices, or subsidiaries in any jurisdiction listed below. If we become aware that any of the jurisdictions or financial institutions, their branches, offices, or subsidiaries in any jurisdiction listed below is directly or indirectly using the correspondent account you hold at our financial institution, we will be required to take appropriate steps to prevent such access, including, where necessary, terminating your account.

The most recent listing of prohibited financial institutions promulgated by FinCEN, as of October 25, 2019, is as follows:

Banco Delta Asia (including its subsidiaries Delta Asia Credit Limited and Delta Asia Insurance Limited)

Commercial Bank of Syria (including its subsidiary Syrian Lebanese Commercial Bank)

Any Burmese banking institution (except to the extent permitted by 31 C.F.R. 1010.651(b)(3))

FBME Bank Ltd. (formerly known as Federal Bank of the Middle East, Ltd.)

Any bank or financial institution of the Democratic People’s Republic of Korea

Bank of Dandong

Any banking institution of the Islamic Republic of Iran

There are proposed rules pending that seek to include the following financial institutions on the above-referenced list of prohibited financial institutions promulgated by FinCEN:

Halawi Exchange Co.

Kassem Rmeiti & Co. For Exchange (including Rmaiti Group SAL and Societe Rmaiti SARL (STE Rmeiti))

ABLV Bank, AS

Vanguard may, from time to time, update this notice to include jurisdictions or entities that are added to this list as new restrictions are proposed or issued. Current listings of entities subject to final or proposed rules under Section 311 can be found on the FinCEN website.

fincen.gov/resources/statutes-and-regulations/311-special-measures

A typical phishing email instructs you to click a link that opens a fake website that will ask for your name, Social Security number, account number, password, and other personal information. It may be a message announcing that you've just won a prize. Other phishing emails try to get you to install "malware" on your computer: This is software that could take over your computer and steal your online credentials. Whatever their approach, these scammers prey on our natural tendencies to react quickly to what seems like an urgent or important request.

Ask yourself

• Do I recognize the sender, or have I done business with them recently? (If not, be suspicious—don’t click or tap.)
• Does the message refer to an action I recently took or a request I've made? (If it feels out of the blue, you should be suspicious—don't click or tap.)
• Are they asking for my personal information? (Bad idea—don’t click or tap.)

Some scammers are quite good at "impersonating" legitimate companies, complete with doctored logos and email addresses that look real, but on closer inspection turn out to be imitations. Since many phishing emails originate overseas, look closely for grammatical/spelling errors or typos, which can tip you off that the email is fake. If you're in any doubt at all, it's best not to click or tap. You can always call the company if you want to verify that the message is real.

What to know about Vanguard emails

• We generate our emails from vanguard.com, e-vanguard.com, evanguard.com, vanguardinvestments.com or m-vanguard.com. If you receive an email not sent from one of these addresses, we didn't send it. However, certain trusted third parties with established business relationships with Vanguard, including investordelivery.com and proxyvote.com, may send emails about our services.
• We won't send unexpected emails with logon links or attachments.
• If you receive an email from a sender claiming to be from Vanguard, and the email requests your private or personal information, forward it to phish@vanguard.com immediately. (If you opened any of the links or entered personal information on an unidentified website, let us know when you forward the message.)

Verify first

Do not open any link on the screen to find out where it leads. Some email scammers use "vanguard.com" in phony links to look legitimate. Unless "vanguard.com" is immediately followed by a slash ("/"), there's a chance the link's invalid or part of a scam. If you're unsure, don't click. Contact us immediately at 877-223-6977 or via email at fraud@vanguard.com if you suspect someone is trying to access your Vanguard account fraudulently.

What is SMISHING?

Smishing is a type of scam where attackers send SMS/text messages referencing an urgent issue or threat to trick victims into responding quickly and sharing personal information or installing malware on their devices.

Should you receive any random, unsolicited, or suspicious text message, please forward to phish@vanguard.com

What is VISHING?

Vishing is a type of scam where cybercriminals place phone calls to victims purporting to be from a legitimate company in order to persuade the victims into sharing their personal and/or financial credentials.

What is PHISHING?

Phishing is a type of scam where attackers send emails with links impersonating organizations to trick victims into sharing personal information or installing malware on their devices.

Should you receive a random, unsolicited, or suspicious email, please forward to phish@vanguard.com

What are POP-UP scams?

This scam involves a pop-up box or alert that appears on your computer screen or on a login screen referencing an urgent message. It is a ploy used by criminals to make you believe there is an issue with your computer or your account. The criminals will then pose as a company support team who can fix the issue. During the scheme, they may request that you grant them remote access to your computer, go to a website, download software, or request a text code to your phone. They may call you or ask you to call an 800# or to click on a link within the pop-up message.  Reminder: Vanguard will NEVER request access to your computer or mobile device.

Examples of fraudulent messages you may receive in any of the above schemes.

• Your account has been locked due to unusual activity. (A fraudulent link will be present after the urgent message)
• Your account has been suspended or disabled, please call ### to reactivate your account
• Did you attempt to make a transaction on #date#, Reply Yes or No (A Phone number not associated with Vanguard may be referenced)
• Please confirm recent transaction, Reply Yes or No (A Phone number not associated with Vanguard may be referenced)
• We have detected suspicious activity on your account. Please call this number to speak to a customer service representative.
• To finish setting up your account, please click this link and enter your personal information.
• Urgent! Your account has been compromised. Please click this link to reset your password and prevent any further fraud.

Be cautious of any unusual, unsolicited text/email messages that ask for personal information and/or include a link. The links can take you to deceptive websites where you are asked to enter your personal and/ or financial information. Take the time to ask yourself why the sender is asking for your information.

If you are unsure whether a text message is legitimate, call the company or organization referenced in the message directly to verify. 

More about securing your devices

Most device manufacturers release operating system updates regularly and you need to keep your device current. Check your device's settings to see if you need to update its operating system.

If you're using a Windows operating system, go to Microsoft's website.

If you're using Apple's operating systems, go to Apple's website.

You should also download security software and keep it current to protect your computer, as well as your Android™ or Apple® mobile device. You should also monitor your computer and browser settings.

Set up personal firewalls

High-speed internet access is very convenient and "always on." But this continuous connection exposes your computer to online threats. You should install and use personal firewall software and keep it updated. Read your computer's operating manual or search the internet for help installing firewalls. Also look for included firewalls if you're purchasing home networking equipment such as a router.

Personal firewall software takes its name from the barriers built into cars and buildings that separate potentially hazardous environments from protected areas. Similarly, firewall software protects computers by monitoring the types of activity or attempted activity between the personal device and a network. Firewalls can refuse attempted connections that aren't initiated by you or that the software deems suspicious.

Get antivirus software and keep it up to date

Malicious code such as viruses, worms, and Trojan horses can wreak havoc on your computer. Bad code can even capture your logon infomation and take control of your computer.

You need to install and regularly update antivirus software to protect against, detect, and repair attacks from most viruses.

Combat spyware

Even if your computer has a firewall and antivirus software, it still could be susceptible to spyware. Spyware is software that appears to offer some tangible benefit, but actually monitors your behavior online. This illegal access is often used to intercept your usernames and passwords to your online accounts. You should install antispyware software and configure it to scan your personal device weekly. You should also:

Verify any software you install on your computer. If you see a Security Warning window when installing a program that reads "Do you want to install and run [name of program] issued by [name of company]?" and you don't recognize the company, select "No" to stop the installation.

Install a popup blocker to prevent spyware popup windows. (Spyware is often installed after clicking or tapping deceptive links in popup windows.) Note: You may want to change the settings in your popup blocker program to allow for popup windows on vanguard.com and other reputable sites you trust.

Log off after accessing your accounts online and close your web browser. Some of your account information can stay in your browser's memory until the browser is closed. You should do this on all computers and for all websites you log on to.

Do not open, click or tap links in, or open attachments in any email you think is suspicious. Vanguard won't send emails with logon links or attachments unless you're expecting such an email based on a conversation with one of our crew members.

Tips for mobile devices

Use apps carefully. Take care when installing apps on your device by following these tips:

Download apps securely. Always get your apps from reputable sources like the Apple App Store® or Google Play™ store to minimize the chance the apps contain malware.

Research apps before downloading. Review what an app can read and change on your device before downloading it to make sure that the app's access to your device is appropriate.

Update apps, especially security-related ones. Speaking of updates, it's usually safer to disable the "automatic update" feature on apps and your devices and update your apps manually. This way, you can review each update and determine if you want to proceed.

Sync your device safely. Syncing your mobile device "in the cloud" allows you to access files and content on any of your devices anywhere there's an internet connection. But you need to sync carefully.

Use a reputable service. Make sure that you use a cloud service provider that offers strong security and encryption services, including an SSL connection, to keep your information protected.

Sweat the details. Research the security features of cloud computing services on the internet or contact the vendors' customer service areas to learn what they do and don't provide.

Protect your password. Periodically change your syncing service password, if the provider offers that service. And never store your syncing password unencrypted on your device.

Mobile app verification

As a Vanguard personal investor, you have the option to authenticate using your mobile app. After you log in with your username and password on the web, we will prompt you to verify your identity with biometrics on your mobile app, then approve the login.

To start using your mobile app to verify your identity, you will need:

1. A device with the Vanguard mobile app installed
2. Biometrics capability on your device
   
3. Enrollment in biometrics login in the mobile app
   
4. Enrollment in security codes for your Vanguard account

We will never phone you and ask you to authenticate with your mobile device.

If you’re an institutional investor or a financial professional, mobile app verification may not be part of the login process. Please log in to your account and review your security options under My Profile, or call us at 888-353-0547.

Do I need push notifications enabled for mobile verification?

No, but you will need to manually open the Vanguard mobile app on your device to verify the login. For a faster, safer mobile verification experience, we recommend you enable push notifications.

Can I still use mobile app verification if I do not have the Vanguard app downloaded on my mobile device? What if my mobile phone doesn’t have biometric capabilities?

No, but you can still use security codes or security keys as an additional means to authenticate.

Does the verification attempt expire?

Yes, each verification attempt will expire after a period. You can always request a new prompt when you’re ready.

More tips on password and credentials

Your password should not be:

• Written down, stored unencrypted on your computer or mobile device, or shared with anyone.
• Given out over the phone.
• A common word or close variation.
• Composed of anyone's Social Security number, name, or other personal information.
• Composed of 3 or more sequential letters, numbers, or keyboard patterns (e.g., QWERTY).
• A minor tweak of your old password. (For example, if your previous password was bikerider23, your next password should not be bikerider24.)

Make it secure and memorable

• Combine 2 or more words or abbreviations with numbers. For example, cpU34ChiP.
• Remove vowels from a phrase and add numbers. For example, swim twenty laps becomes swm20LpS.
• Abbreviate a favorite phrase. For example, I ride my bike 50 miles every Saturday becomes iRmB50meS.
• Use famous people's initials. For example, a list of U.S. presidents including George Washington, Abraham Lincoln, and Thomas Jefferson becomes 1Gw2Al3Tj.
• Note: Don't use any of these examples as your password.

Tips on security questions and answers

• Be consistent with your wording. If you answer the security question "What is your favorite hobby?" with "golfing," the system will reject "golf" in the future.
• Use one-word answers whenever possible. Avoid qualifiers such as "the," "and," "Inc.," "co," etc.
• Note the emphasized words in the questions. For example, if your security question is "What is your current best friend's FIRST NAME?" don't put "John Smith."
• Be careful with names. For example, if someone goes by James, Jimmy, or Jim, think about which one you'll use and remember.
• Avoid overly quirky answers. Make sure you'll remember the answer you've chosen.
• Don't use profanity.

Biometrics

In the Vanguard app, you have the option to log in using your unique biometric features for an additional layer of security on both iOS and Android devices. Because your identifying features are stored on your device and are not retained by Vanguard, this authentication method is safer and more accessible than traditional methods.

What biometrics options are supported?

Currently, the Vanguard mobile app supports the use of Touch ID and Face ID on iOS devices and fingerprint verification on Android devices. Make sure you have these options set up on your device before enrolling in biometrics on the Vanguard app.

How do I enable biometrics on my device?

Visit your profile on the Vanguard app and select Settings, then toggle the Biometric login option to On . Your device should then prompt you to enroll.

Can I use biometrics to verify an online login?

Yes, biometrics can be used as part of our mobile app verification process.