Security at Vanguard

Keeping your accounts secure is our priority. Partnership is the key.

Open an account

How we protect you

Investors are our priority in everything we do, including our security features. Learn how we protect you and what you can do to partner with us to keep your accounts safe.

Vanguard.com security

Vanguard.com integrates an advanced security strategy with features—both visible and invisible—to help keep your investments safe. We prioritize:

  • Keeping your information private.
  • Using artificial intelligence to protect your account, and stop bad actors from using it against you.
  • Making it easy for you, and only you, to access your account.
  • Monitoring your accounts to help block fraud and suspicious activity.
  • Personalizing security needs and relevant information to you as an individual.
  • Evolving to meet the security needs of tomorrow.

Our call center security

Each time you call us, we diligently verify your identity before discussing any personal or financial information with you. Our specialists are highly trained in privacy and security to protect your investments.

Text messages from us

You can choose to receive text message alerts. These messages might remind you about an upcoming appointment or let you know if we need more information to complete a request you've made. Text message alerts also offer a security feature that notifies you when certain changes or transactions happen in your account. It’s a great way to stay informed and in control.

Review the terms and conditions to familiarize yourself with Vanguard's policy on service-related text messaging. Always use good judgment before opening links in text messages. Vanguard may include a link in a text message to help you review your activity and take real-time action on your account.

Notice about Section 311 of the USA PATRIOT Act

U.S. AML Certification (PDF)

Security tips

We want to ensure you have both the tools and knowledge to protect yourself from fraud and financial exploitation. Here are some tips and best practices for keeping your personal and financial information safe.

Top ways to protect yourself from fraud

  1. Be an active participant in your security. Take advantage of our enhanced security tools, and monitor your account regularly.
  2. Ensure your devices are up-to-date with the latest software and security, and avoid public Wi-Fi networks.
  3. Never click on suspicious links. Report and then delete phishing emails and texts and ignore unsolicited pop-up requests to install software.
  4. Never give personal information to unknown callers, and don’t send money to someone you haven’t met in person. Be wary of requests for personal or financial information, money, or security codes.
  5. Be cautious about sharing personal information on social media and control your privacy in your account settings.

Vanguard will never...

We will never call, text, email, or mail you to ask for your login information, your Social Security number, or a security code you've received.

Please note: We may ask for a security code or personal information over the phone if you called us first and requested assistance.


If you suspect someone has gained access to any of this information, contact our fraud team immediately.

Steer clear of scams

Scams can happen to anyone, and they are constantly evolving. Seniors especially are common targets, as they often have accumulated savings.

The best ways to protect yourself from a scam are to name a trusted contact and be cautious of these red flags:

  • Unexpected contact: Certain scams start with contact from someone an investor doesn't know, often via email, phone call, text, or social platforms. A legitimate financial institution or government will never contact you asking for logon credentials, security codes, or Social Security numbers.
  • Emotional manipulation: With this common online exploitation tactic, a fraudster aims to gain a close short-term relationship with an investor with the promise of a long-term partnership.
  • Urgency: Scammers apply pressure by saying an account is unsafe, using fake threats, or promoting "limited time offers", to convince an investor to send money or share personal information.
  • Complicated payment methods: Be wary of anyone asking to be paid in unusual forms such as gift cards, checks, cryptocurrency, and gold.

 

Additional resources

Security tools

As our client, you have an important role to play in your account security. These are some of the security features you can adopt to help protect your Vanguard accounts.

Security codes

Receive a temporary code to verify your identity. You can choose to get your code via text (mobile only) or phone call (U.S. numbers only). Security codes are a required form of multi-factor authentication at Vanguard.

More about security codes
 

Set up security codes

Account activity alerts

Receive an immediate text message or email if we discover certain transactions and profile changes made to your account.

More about account activity alerts
 

Set up account activity alerts

Voice verification

Get safe, fast access to your accounts via phone using the sound of your voice to confirm your identity.

Watch our video to see how it works

More about voice verification

Enroll

Trusted contact

Name the emergency contact Vanguard should reach out to—in limited circumstances—if we ever have concerns about you or the activity in your account.

More about trusted contacts
 

Name a trusted contact

Biometrics

Verify quickly and safely with facial or fingerprint recognition. Your unique biometrics can be used to authenticate on our mobile app or vanguard.com (through a QR code or mobile app push notification).

More about biometrics

Set up biometrics

Security key & passkey

Use a physical or digital key for enhanced online protection. Keys are an authentication method that use your device (passkey) or a physical key (security key) to let us know it’s you.

More about security keys & passkey
 

Register a security key & passkey

Device management

Review and rename the devices you use to access your accounts within the Vanguard app. If a device is lost or stolen, you can remove it to keep your accounts safe.

More about device management

Manage my devices

We’re here for you: Report fraud with confidence

If you suspect fraud or need to report unauthorized activity on your account, contact us as soon as possible at 877-223-6977 or fraud@vanguard.com. Our fraud agents will open a case and work with you to protect the money you worked so hard for.

And don't forget, if someone takes unauthorized money from your account, we will reimburse you, as long as you meet the necessary conditions. For more details, visit the our promise tab.

You've found unauthorized activity on your account. Now what?

  1. Contact us at 877-223-6977 or fraud@vanguard.com as soon as possible.
  2. Conduct a full or manual virus scan on all of your devices to remove any malicious code.
  3. When the scan is complete, change your username, password, email, and security questions on all websites you log in to.
  4. Alert the 3 major credit bureaus. They can monitor your credit activity and block new accounts opened with your information.

Be kind to yourself

Fraudsters and scammers are extremely smart. They use psychology to persuade and influence millions of people all ages, education levels, and financial statuses to get what they want.

Give yourself grace, recognize your emotions, and focus on what you can control. Vanguard will be here every step of the way.

Have you recently been a victim of identity theft?

Your security is our top priority. If you've been a victim of identity theft in the last 12 months, we want to know, so we can help secure your account. 

Contact us and include your:

  • Name
  • Circumstances of the criminal activity
  • Phone number

For more information and tips on how to protect yourself from identity theft, visit the Federal Trade Commission (FTC) website.

Our promise to you

We appreciate the trust you've placed in Vanguard and promise to protect your money as if it were our own. Where you have taken the qualifying steps to protect your account, Vanguard will reimburse every dollar that leaves your account through an unauthorized distribution.

How to qualify

  • Guard your logon information:Never share your username, password, security question answers, or security codes with anyone.
  • Protect your devices: Keep the software on all your devices up-to-date, especially security features.
  • Monitor your account: Log in regularly to review all messages and account alerts. If you notice suspicious transactions, let us know immediately.
  • Cooperate with any Vanguard investigations: If you have an open claim or authorized activity, make sure to be forthcoming and responsive. This information lets us know how to best help you!

Disqualifying actions

The activity will be considered authorized if you:

  • Give someone authority to transact on your behalf.
  • Share your Vanguard account credentials with any person or entity.

Eligible account types

Our reimbursement covers:

  • Accounts held directly with us: Accounts must be directly held with Vanguard mutual funds and accounts with Vanguard Brokerage Services®, a division of Vanguard Marketing Corporation.
  • Retirement participant accounts: If you have a retirement plan that Vanguard provides record keeping and administrative services for, your participant account is covered for unauthorized activity (unless performed by your employer or plan sponsor representative authorized to access participant accounts).

Our reimbursement does NOT cover:

  • 529 savings plan accounts.
  • Annuities.
  • Unauthorized activity performed by an employer or plan sponsor representative who is authorized to access participant accounts. Your employer or plan sponsor may reimburse this activity.

Claim process

We might ask for your help establishing that the activity was unauthorized. This could involve:

  • Filing a police report.
  • Providing us with statements of facts.

We investigate each claim you make individually, so we can determine how to best help.

How we protect you

Investors are our priority in everything we do, including our security features. Learn how we protect you and what you can do to partner with us to keep your accounts safe.

Vanguard.com security

Vanguard.com integrates an advanced security strategy with features—both visible and invisible—to help keep your investments safe. We prioritize:

  • Keeping your information private.
  • Using artificial intelligence to protect your account, and stop bad actors from using it against you.
  • Making it easy for you, and only you, to access your account.
  • Monitoring your accounts to help block fraud and suspicious activity.
  • Personalizing security needs and relevant information to you as an individual.
  • Evolving to meet the security needs of tomorrow.

Our call center security

Each time you call us, we diligently verify your identity before discussing any personal or financial information with you. Our specialists are highly trained in privacy and security to protect your investments.

Text messages from us

You can choose to receive text message alerts. These messages might remind you about an upcoming appointment or let you know if we need more information to complete a request you've made. Text message alerts also offer a security feature that notifies you when certain changes or transactions happen in your account. It’s a great way to stay informed and in control.

Review the terms and conditions to familiarize yourself with Vanguard's policy on service-related text messaging. Always use good judgment before opening links in text messages. Vanguard may include a link in a text message to help you review your activity and take real-time action on your account.

Notice about Section 311 of the USA PATRIOT Act

U.S. AML Certification (PDF)

Security tips

We want to ensure you have both the tools and knowledge to protect yourself from fraud and financial exploitation. Here are some tips and best practices for keeping your personal and financial information safe.

Top ways to protect yourself from fraud

  1. Be an active participant in your security. Take advantage of our enhanced security tools, and monitor your account regularly.
  2. Ensure your devices are up-to-date with the latest software and security, and avoid public Wi-Fi networks.
  3. Never click on suspicious links. Report and then delete phishing emails and texts and ignore unsolicited pop-up requests to install software.
  4. Never give personal information to unknown callers, and don’t send money to someone you haven’t met in person. Be wary of requests for personal or financial information, money, or security codes.
  5. Be cautious about sharing personal information on social media and control your privacy in your account settings.

Vanguard will never...

We will never call, text, email, or mail you to ask for your login information, your Social Security number, or a security code you've received.

Please note: We may ask for a security code or personal information over the phone if you called us first and requested assistance.


If you suspect someone has gained access to any of this information, contact our fraud team immediately.

Steer clear of scams

Scams can happen to anyone, and they are constantly evolving. Seniors especially are common targets, as they often have accumulated savings.

The best ways to protect yourself from a scam are to name a trusted contact and be cautious of these red flags:

  • Unexpected contact: Certain scams start with contact from someone an investor doesn't know, often via email, phone call, text, or social platforms. A legitimate financial institution or government will never contact you asking for logon credentials, security codes, or Social Security numbers.
  • Emotional manipulation: With this common online exploitation tactic, a fraudster aims to gain a close short-term relationship with an investor with the promise of a long-term partnership.
  • Urgency: Scammers apply pressure by saying an account is unsafe, using fake threats, or promoting "limited time offers", to convince an investor to send money or share personal information.
  • Complicated payment methods: Be wary of anyone asking to be paid in unusual forms such as gift cards, checks, cryptocurrency, and gold.

 

Additional resources

Security tools

As our client, you have an important role to play in your account security. These are some of the security features you can adopt to help protect your Vanguard accounts.

Security codes

Receive a temporary code to verify your identity. You can choose to get your code via text (mobile only) or phone call (U.S. numbers only). Security codes are a required form of multi-factor authentication at Vanguard.

More about security codes
 

Set up security codes

Account activity alerts

Receive an immediate text message or email if we discover certain transactions and profile changes made to your account.

More about account activity alerts
 

Set up account activity alerts

Voice verification

Get safe, fast access to your accounts via phone using the sound of your voice to confirm your identity.

Watch our video to see how it works

More about voice verification

Enroll

Trusted contact

Name the emergency contact Vanguard should reach out to—in limited circumstances—if we ever have concerns about you or the activity in your account.

More about trusted contacts
 

Name a trusted contact

Biometrics

Verify quickly and safely with facial or fingerprint recognition. Your unique biometrics can be used to authenticate on our mobile app or vanguard.com (through a QR code or mobile app push notification).

More about biometrics

Set up biometrics

Security key & passkey

Use a physical or digital key for enhanced online protection. Keys are an authentication method that use your device (passkey) or a physical key (security key) to let us know it’s you.

More about security keys & passkey
 

Register a security key & passkey

Device management

Review and rename the devices you use to access your accounts within the Vanguard app. If a device is lost or stolen, you can remove it to keep your accounts safe.

More about device management

Manage my devices

We’re here for you: Report fraud with confidence

If you suspect fraud or need to report unauthorized activity on your account, contact us as soon as possible at 877-223-6977 or fraud@vanguard.com. Our fraud agents will open a case and work with you to protect the money you worked so hard for.

And don't forget, if someone takes unauthorized money from your account, we will reimburse you, as long as you meet the necessary conditions. For more details, visit the our promise tab.

You've found unauthorized activity on your account. Now what?

  1. Contact us at 877-223-6977 or fraud@vanguard.com as soon as possible.
  2. Conduct a full or manual virus scan on all of your devices to remove any malicious code.
  3. When the scan is complete, change your username, password, email, and security questions on all websites you log in to.
  4. Alert the 3 major credit bureaus. They can monitor your credit activity and block new accounts opened with your information.

Be kind to yourself

Fraudsters and scammers are extremely smart. They use psychology to persuade and influence millions of people all ages, education levels, and financial statuses to get what they want.

Give yourself grace, recognize your emotions, and focus on what you can control. Vanguard will be here every step of the way.

Have you recently been a victim of identity theft?

Your security is our top priority. If you've been a victim of identity theft in the last 12 months, we want to know, so we can help secure your account. 

Contact us and include your:

  • Name
  • Circumstances of the criminal activity
  • Phone number

For more information and tips on how to protect yourself from identity theft, visit the Federal Trade Commission (FTC) website.

Our promise to you

We appreciate the trust you've placed in Vanguard and promise to protect your money as if it were our own. Where you have taken the qualifying steps to protect your account, Vanguard will reimburse every dollar that leaves your account through an unauthorized distribution.

How to qualify

  • Guard your logon information:Never share your username, password, security question answers, or security codes with anyone.
  • Protect your devices: Keep the software on all your devices up-to-date, especially security features.
  • Monitor your account: Log in regularly to review all messages and account alerts. If you notice suspicious transactions, let us know immediately.
  • Cooperate with any Vanguard investigations: If you have an open claim or authorized activity, make sure to be forthcoming and responsive. This information lets us know how to best help you!

Disqualifying actions

The activity will be considered authorized if you:

  • Give someone authority to transact on your behalf.
  • Share your Vanguard account credentials with any person or entity.

Eligible account types

Our reimbursement covers:

  • Accounts held directly with us: Accounts must be directly held with Vanguard mutual funds and accounts with Vanguard Brokerage Services®, a division of Vanguard Marketing Corporation.
  • Retirement participant accounts: If you have a retirement plan that Vanguard provides record keeping and administrative services for, your participant account is covered for unauthorized activity (unless performed by your employer or plan sponsor representative authorized to access participant accounts).

Our reimbursement does NOT cover:

  • 529 savings plan accounts.
  • Annuities.
  • Unauthorized activity performed by an employer or plan sponsor representative who is authorized to access participant accounts. Your employer or plan sponsor may reimburse this activity.

Claim process

We might ask for your help establishing that the activity was unauthorized. This could involve:

  • Filing a police report.
  • Providing us with statements of facts.

We investigate each claim you make individually, so we can determine how to best help.

Security codes

What is multi-factor authentication?

Multi-factor authentication verifies you two different ways. For security codes, it authenticates with something you know (your password) and something you have (the device receiving the code). Multi-factor authentication makes it harder for anyone other than you to access your account.


Do I need to receive a code each time I log in?

In your security code settings, you’ll be asked if you want us to remember you. If you choose yes, we will skip security codes any time we recognize you (based on many factors including device, browser, location, etc.) However, to maximize your security, we encourage you to always keep your multi-factor authentication on. This is especially true if you are using a public or shared computer.

Can I receive a security code internationally?

Yes! We can send codes internationally by text message only. Work with your mobile carrier to ensure you are able to receive text messages while outside of the U.S.

What other options do I have instead of security codes?

Security codes are just our baseline authentication option. You can choose to log in with biometrics, a passkey, or a security key instead. These options can actually be quicker and more secure.

To use biometrics, just download the Vanguard app. When you are prompted at login, choose the biometric option by scanning the QR code or selecting verify with the app after entering your username and password.

To use a security key, register your key in your profile & account settings on the security tab. Once registered, you will be prompted for your key at login.

Vanguard Voice ID

Please note: Vanguard Voice ID is being implemented in phases. We are working hard to make it available to all of our clients as soon as possible. Call us to see if you are eligible to enroll!

What makes this safer than methods I use today?

Your voice is a form of biometric authentication, like your face and your fingerprint, with characteristics unique to you that are difficult to replicate.


Additionally, Vanguard Voice ID can be used continuously throughout your call, unlike other methods where verification is completed at a point in time.


How can this not be hacked by recordings or AI?

This technology does not use a recording, but measures over 100 unique characteristics of your voice to store as a biometric data points, making it difficult to fake.


Vanguard Voice ID is also designed to detect synthetic voices, and will continue to evolve this detection as AI technology evolves.


How is my voiceprint stored and protected? Will my voiceprint be sold or used outside of Vanguard?

Your voiceprint is stored safely in our security system and only works at Vanguard with our unique decoding process. We will never sell or authorize use of your voiceprint outside of Vanguard.

Account activity alerts

How do these alerts work?

You can elect to be immediately notified by text message or email every time there's activity on your account, including:

  • Changes to your account information.
  • Account transactions—purchases, sales, or exchanges.
  • Transfers into or out of your account.

To choose your alert type and delivery method settings, simply log on to your account and go to the account activity alerts section.


Am I eligible for account activity alerts?

If you're a Vanguard client with an individual account or you have a Vanguard employer-sponsored retirement plan account, you can enroll in this service. If you'd like to receive alerts by text message rather than email, you'll need to use a domestic mobile number.


If there's activity on your account you don't recognize, call us immediately at 877-223-6977 or send an email to fraud@vanguard.com

Voice verification

Voice verification enables us to quickly authenticate who you are and allows you to perform many transactions by phone. Our system uses sophisticated biometric technology to identify the unique patterns of your voice. It saves you time by letting you bypass security questions and speak directly with one of our investment professionals.

Enrolling in Vanguard Voice Verification™ is free and only takes a few moments.

When you sign up, you'll be asked to repeat a series of phrases. The system captures your vocal characteristics and makes a "voice verification print" that's as unique as your fingerprints. The next time you call us, you'll be prompted to identify yourself and repeat your voice passphrase instead of answering security questions.

Sign up now (logon required)
You have certain cookies disabled on the Vanguard site.
In order to watch this video, you must agree to the use of cookies provided by YouTube.
Click to permit these cookies and watch the video.

How voice verification works

Your voice is unique…just like your fingerprint. In fact, your voice is so unique, you can use it as your password when you call us.

When you sign up for Vanguard Voice Verification, you'll be able to verify your identity and let us know who you are. Just with the sound of your voice.

The privacy and security of your assets and account information are always important to us. That's why we're offering this service as another layer of protection…and extra peace of mind for you.

It's easy to sign up. When you enroll, our system will ask you to repeat a phrase. As it learns your voice, it creates your “voiceprint.”

We safeguard your voiceprint with the same high-level standards that we use to secure your financial information. Our voice verification system uses sophisticated biometric technology to identify the unique patterns of your voice.

Like fingerprints, no two voiceprints are the same. Whenever you call us, you'll repeat the phrase you used when you enrolled. Then, our system will compare your voiceprint to your live voice.

Once you're authenticated, you'll be able to speak with an associate. And you'll be able to conduct certain transactions without having to complete additional paperwork. That means you'll save time, too.

Sign up for Vanguard Voice Verification today and help us help you keep your account safe.

Go to vanguard.com/voice to get started and join the growing number of clients who are making their accounts even more secure with the sound of their voice.

Trusted contact

Why should I name a trusted contact?

A trusted contact is an emergency financial contact and intended to be a resource to Vanguard in protecting you from financial harm. Naming a trusted contact can help keep your accounts secure by helping us act quickly and intentionally if addressing account security concerns.


Who should this person be?

A trusted contact can be a close friend, neighbor, family member, or any individual you trust. Although you can name anyone as your trusted contact, we suggest choosing someone who isn't authorized to transact on your account, so they can remain objective.


How can a trusted contact help?

If we have concerns about financial exploitation or cognitive decline, we will reach out to this person for help. They can also provide us essential information or verify your wellbeing in the event of a natural disaster, health challenge, or financial scam.



A trusted contact has no authority to act financially for you. However,if necessary, they can connect us with key contacts like your power of attorney, lawyer, legal guardian, trustee, or executor.


Learn more at FINRA's site

Encryption

 

A way of securing your data online by scrambling the actual information so it becomes unreadable to anyone without the "key" to unlock the data.

Secure Sockets Layer (SSL) validation

Vanguard passed an independent and rigorous audit to get an "extended validation" SSL certificate from Comodo, a leading internet security authority. This can help prevent "phishing" attacks when you use certain browsers by highlighting the web address bar in green and showing the real company name when you access trusted websites, such as vanguard.com.

Username and password protection

 

After a limited number of unsuccessful logon attempts, Vanguard will disable your password as a precaution. If your password is disabled, you can restore access through our website or by calling Vanguard.

More on the USA PATRIOT Act

 

Pursuant to U.S. regulations issued under Section 311 of the USA PATRIOT Act, 31 C.F.R. Chapter X, Part 1010.651 through and including Part 1010.670, Vanguard, Inc. ("Vanguard"), is prohibited from establishing, maintaining, administering, or managing an account for or on behalf of any prohibited financial institutions as determined by the Financial Crimes Enforcement Network ("FinCEN"). In addition, Vanguard will not conduct business with any financial institutions for which FinCEN has issued proposed rules with respect to including such entities on the prohibited financial institutions list.

The Section 311 Special Measures regulations also require that Vanguard notify you that your correspondent account with our financial institution may not be used to provide access or services to any of the jurisdictions or financial institutions, their branches, offices, or subsidiaries in any jurisdiction listed below. If we become aware that any of the jurisdictions or financial institutions, their branches, offices, or subsidiaries in any jurisdiction listed below is directly or indirectly using the correspondent account you hold at our financial institution, we will be required to take appropriate steps to prevent such access, including, where necessary, terminating your account.

The most recent listing of prohibited financial institutions promulgated by FinCEN, as of June 25, 2025, is as follows:

  • Al-Huda Bank
  • Blitzlato Limited (Blitzlato)
  • CIBanco S.A., Institution de Banca Multiple (CIBanco)
  • Commercial Bank of Syria (including its subsidiary Syrian Lebanese Commercial Bank)
  • Any Burmese banking institution (except to the extent permitted by 31 C.F.R. 1010.651(b)(3))
  • FBME Bank Ltd. (formerly known as Federal Bank of the Middle East, Ltd.)
  • Institución de Banca Multiple (Intercam)
  • Any bank or financial institution of the Democratic People’s Republic of Korea
  • Bank of Dandong
  • Any banking institution of the Islamic Republic of Iran
  • PM2BTC
  • Vector Casa de Bolsa, S.A. de C.V. (Vector)

There are proposed rules pending that seek to include the following financial institutions on the above-referenced list of prohibited financial institutions promulgated by FinCEN:

  • Halawi Exchange Co.
  • Huione Group
  • Kassem Rmeiti & Co. For Exchange (including Rmaiti Group SAL and Societe Rmaiti SARL (STE Rmeiti))

Vanguard may, from time to time, update this notice to include jurisdictions or entities that are added to this list as new restrictions are proposed or issued. Current listings of entities subject to final or proposed rules under Section 311 can be found on the FinCEN website.

fincen.gov/resources/statutes-and-regulations/311-special-measures

How Vanguard protects your assets

Welcome to the Vanguard Security Center. Online privacy is on everybody's mind these days, and with good reason. The news carries many stories about hacked accounts and other online security violations. Increasingly, many of the people in our own lives are affected. As a Vanguard investor we want you to know how seriously we take this threat and how hard we're working to protect you against it.

Vanguard's reputation for asset management is well-known, but back here behind the scenes we are just as committed to protecting the data of our millions of individual, financial advisor, and institutional clients. When it comes to online security, we are your security partner.

As a global company, we guard against, and intercept, information security threats 24/7, around the world.

Our security systems are extensive--automatically tracking and safeguarding all transactions. At Vanguard, we monitor and protect about a million attempts to log on to our website every day.

And our Vanguard security crew is dedicated to the cause of online security. After all, our money is invested here too!

We know that the best defense is being proactive. So we help our investors to establish and maintain secure transactions up front, with valuable information, updated procedures, and careful authentication . . . to avoid security issues in the first place.

But--when there is an issue, we are here to help resolve that issue as quickly and easily as possible.

Sadie's story
"A client was worried about the security of her Vanguard account because her email was recently compromised. I verified that her account information was up-to-date. I also helped her add additional security layers on her account, on the web and when she calls in to Vanguard."

Darya's story
"A client contacted Vanguard after receiving notification that his online account access had been locked. The fraud department explained to him that they had proactively locked his account because of a suspicious phone call to our call center. The client understood why the account was locked and was happy that the investigator took the time to explain the situation and address all of his concerns."

Owen's story
"After a large retail chain's network was breached, a number of clients asked if the security of their Vanguard accounts were also affected. We explained that a simple thing to do was to make sure that their user name and password were different on their Vanguard account than their other online accounts."

You can be sure that we are always here, that we are watching all online transactions, and that we are here to protect investor assets and data in any and every way that we can. But remember . . . security is a partnership. Our efforts are most effective when you do your part too. We depend on you to protect yourself first by securing your online identity . . . keeping your computer up-to-date . . . using up-to-date anti-virus software . . . monitoring your accounts on a regular basis . . . and being very careful with respect to the use of public Wi-Fi.

Check in at our online Security Center often to see the latest safeguards and tips.

A typical phishing email instructs you to click a link that opens a fake website that will ask for your name, Social Security number, account number, password, and other personal information. It may be a message announcing that you've just won a prize. Other phishing emails try to get you to install "malware" on your computer: This is software that could take over your computer and steal your online credentials. Whatever their approach, these scammers prey on our natural tendencies to react quickly to what seems like an urgent or important request.

Ask yourself
  • Do I recognize the sender, or have I done business with them recently? (If not, be suspicious—don’t click or tap.)
  • Does the message refer to an action I recently took or a request I've made? (If it feels out of the blue, you should be suspicious—don't click or tap.)
  • Are they asking for my personal information? (Bad idea—don’t click or tap.)

Some scammers are quite good at "impersonating" legitimate companies, complete with doctored logos and email addresses that look real, but on closer inspection turn out to be imitations. Since many phishing emails originate overseas, look closely for grammatical/spelling errors or typos, which can tip you off that the email is fake. If you're in any doubt at all, it's best not to click or tap. You can always call the company if you want to verify that the message is real.

What to know about Vanguard emails
  • We generate our emails from vanguard.com, e-vanguard.com, evanguard.com, vanguardinvestments.com or m-vanguard.com. If you receive an email not sent from one of these addresses, we didn't send it. However, certain trusted third parties with established business relationships with Vanguard, including investordelivery.com and proxyvote.com, may send emails about our services.
  • We won't send unexpected emails with logon links or attachments.
  • If you receive an email from a sender claiming to be from Vanguard, and the email requests your private or personal information, forward it to phish@vanguard.com immediately. (If you opened any of the links or entered personal information on an unidentified website, let us know when you forward the message.)
Verify first

Do not open any link on the screen to find out where it leads. Some email scammers use "vanguard.com" in phony links to look legitimate. Unless "vanguard.com" is immediately followed by a slash ("/"), there's a chance the link's invalid or part of a scam. If you're unsure, don't click. Contact us immediately at 877-223-6977 or via email at fraud@vanguard.com if you suspect someone is trying to access your Vanguard account fraudulently.

What is SMISHING?

Smishing is a type of scam where attackers send SMS/text messages referencing an urgent issue or threat to trick victims into responding quickly and sharing personal information or installing malware on their devices.

Should you receive any random, unsolicited, or suspicious text message, please forward to phish@vanguard.com

What is VISHING?

Vishing is a type of scam where cybercriminals place phone calls to victims purporting to be from a legitimate company in order to persuade the victims into sharing their personal and/or financial credentials.

What is PHISHING?

Phishing is a type of scam where attackers send emails with links impersonating organizations to trick victims into sharing personal information or installing malware on their devices.

Should you receive a random, unsolicited, or suspicious email, please forward to phish@vanguard.com

What are POP-UP scams?

This scam involves a pop-up box or alert that appears on your computer screen or on a login screen referencing an urgent message. It is a ploy used by criminals to make you believe there is an issue with your computer or your account. The criminals will then pose as a company support team who can fix the issue. During the scheme, they may request that you grant them remote access to your computer, go to a website, download software, or request a text code to your phone. They may call you or ask you to call an 800# or to click on a link within the pop-up message.  Reminder: Vanguard will NEVER request access to your computer or mobile device.

Examples of fraudulent messages you may receive in any of the above schemes.

  • Your account has been locked due to unusual activity. (A fraudulent link will be present after the urgent message)
  • Your account has been suspended or disabled, please call ### to reactivate your account
  • Did you attempt to make a transaction on #date#, Reply Yes or No (A Phone number not associated with Vanguard may be referenced)
  • Please confirm recent transaction, Reply Yes or No (A Phone number not associated with Vanguard may be referenced)
  • We have detected suspicious activity on your account. Please call this number to speak to a customer service representative.
  • To finish setting up your account, please click this link and enter your personal information.
  • Urgent! Your account has been compromised. Please click this link to reset your password and prevent any further fraud.

Be cautious of any unusual, unsolicited text/email messages that ask for personal information and/or include a link. The links can take you to deceptive websites where you are asked to enter your personal and/ or financial information. Take the time to ask yourself why the sender is asking for your information.

If you are unsure whether a text message is legitimate, call the company or organization referenced in the message directly to verify. 

More about securing your devices



Most device manufacturers release operating system updates regularly and you need to keep your device current. Check your device's settings to see if you need to update its operating system.

If you're using a Windows operating system, go to Microsoft's website.

If you're using Apple's operating systems, go to Apple's website.

You should also download security software and keep it current to protect your computer, as well as your Android™ or Apple® mobile device. You should also monitor your computer and browser settings.

Set up personal firewalls

High-speed internet access is very convenient and "always on." But this continuous connection exposes your computer to online threats. You should install and use personal firewall software and keep it updated. Read your computer's operating manual or search the internet for help installing firewalls. Also look for included firewalls if you're purchasing home networking equipment such as a router.

Personal firewall software takes its name from the barriers built into cars and buildings that separate potentially hazardous environments from protected areas. Similarly, firewall software protects computers by monitoring the types of activity or attempted activity between the personal device and a network. Firewalls can refuse attempted connections that aren't initiated by you or that the software deems suspicious.

Get antivirus software and keep it up to date

Malicious code such as viruses, worms, and Trojan horses can wreak havoc on your computer. Bad code can even capture your logon infomation and take control of your computer.

You need to install and regularly update antivirus software to protect against, detect, and repair attacks from most viruses.

Combat spyware

Even if your computer has a firewall and antivirus software, it still could be susceptible to spyware. Spyware is software that appears to offer some tangible benefit, but actually monitors your behavior online. This illegal access is often used to intercept your usernames and passwords to your online accounts. You should install antispyware software and configure it to scan your personal device weekly. You should also:

Verify any software you install on your computer. If you see a Security Warning window when installing a program that reads "Do you want to install and run [name of program] issued by [name of company]?" and you don't recognize the company, select "No" to stop the installation.

Install a popup blocker to prevent spyware popup windows. (Spyware is often installed after clicking or tapping deceptive links in popup windows.) Note: You may want to change the settings in your popup blocker program to allow for popup windows on vanguard.com and other reputable sites you trust.

Log off after accessing your accounts online and close your web browser. Some of your account information can stay in your browser's memory until the browser is closed. You should do this on all computers and for all websites you log on to.

Do not open, click or tap links in, or open attachments in any email you think is suspicious. Vanguard won't send emails with logon links or attachments unless you're expecting such an email based on a conversation with one of our crew members.

Tips for mobile devices

Use apps carefully. Take care when installing apps on your device by following these tips:

Download apps securely. Always get your apps from reputable sources like the Apple App Store® or Google Play™ store to minimize the chance the apps contain malware.

Research apps before downloading. Review what an app can read and change on your device before downloading it to make sure that the app's access to your device is appropriate.

Update apps, especially security-related ones. Speaking of updates, it's usually safer to disable the "automatic update" feature on apps and your devices and update your apps manually. This way, you can review each update and determine if you want to proceed.

Sync your device safely. Syncing your mobile device "in the cloud" allows you to access files and content on any of your devices anywhere there's an internet connection. But you need to sync carefully.

Use a reputable service. Make sure that you use a cloud service provider that offers strong security and encryption services, including an SSL connection, to keep your information protected.

Sweat the details. Research the security features of cloud computing services on the internet or contact the vendors' customer service areas to learn what they do and don't provide.

Protect your password. Periodically change your syncing service password, if the provider offers that service. And never store your syncing password unencrypted on your device.

Mobile app verification

As a Vanguard personal investor, you have the option to authenticate using your mobile app. After you log in with your username and password on the web, we will prompt you to verify your identity with biometrics on your mobile app, then approve the login.

To start using your mobile app to verify your identity, you will need:

  1. A device with the Vanguard mobile app installed
  2. Biometrics capability on your device
  3. Enrollment in biometrics login in the mobile app
  4. Enrollment in security codes for your Vanguard account

We will never phone you and ask you to authenticate with your mobile device.

If you’re an institutional investor or a financial professional, mobile app verification may not be part of the login process. Please log in to your account and review your security options under My Profile, or call us at 888-353-0547.

Do I need push notifications enabled for mobile verification?

No, but you will need to manually open the Vanguard mobile app on your device to verify the login. For a faster, safer mobile verification experience, we recommend you enable push notifications.

Can I still use mobile app verification if I do not have the Vanguard app downloaded on my mobile device? What if my mobile phone doesn’t have biometric capabilities?

No, but you can still use security codes or security keys as an additional means to authenticate.

Does the verification attempt expire?

Yes, each verification attempt will expire after a period. You can always request a new prompt when you’re ready.

More tips on password and credentials


Your password should not be:

  • Written down, stored unencrypted on your computer or mobile device, or shared with anyone.
  • Given out over the phone.
  • A common word or close variation.
  • Composed of anyone's Social Security number, name, or other personal information.
  • Composed of 3 or more sequential letters, numbers, or keyboard patterns (e.g., QWERTY).
  • A minor tweak of your old password. (For example, if your previous password was bikerider23, your next password should not be bikerider24.)
Make it secure and memorable
  • Combine 2 or more words or abbreviations with numbers. For example, cpU34ChiP.
  • Remove vowels from a phrase and add numbers. For example, swim twenty laps becomes swm20LpS.
  • Abbreviate a favorite phrase. For example, I ride my bike 50 miles every Saturday becomes iRmB50meS.
  • Use famous people's initials. For example, a list of U.S. presidents including George Washington, Abraham Lincoln, and Thomas Jefferson becomes 1Gw2Al3Tj.
  • Note: Don't use any of these examples as your password.
Tips on security questions and answers
  • Be consistent with your wording. If you answer the security question "What is your favorite hobby?" with "golfing," the system will reject "golf" in the future.
  • Use one-word answers whenever possible. Avoid qualifiers such as "the," "and," "Inc.," "co," etc.
  • Note the emphasized words in the questions. For example, if your security question is "What is your current best friend's FIRST NAME?" don't put "John Smith."
  • Be careful with names. For example, if someone goes by James, Jimmy, or Jim, think about which one you'll use and remember.
  • Avoid overly quirky answers. Make sure you'll remember the answer you've chosen.
  • Don't use profanity.

Biometrics

Which biometrics options can I use?

Currently, the Vanguard mobile app supports the use of Touch ID and Face ID on iOS devices and facial and fingerprint verification on Android devices. 

For your security, the biometric you use on the Vanguard app may differ from how you unlock your device, as security certifications need to be met. 


How do I allow biometrics on my Vanguard app?

First, make sure you have biometric options set up on your device. Then open the app and select profile. Under settings, choose login & security. Turn on the toggle aligned to your device’s biometrics.


How do I use biometrics to verify on my web browser?

When you log in on your web browser, choose verify with the app. Then simply open your app, verify with biometrics, and select yes, it's me on the login request. You will need to have biometrics already enabled on your app.


Additionally, you may have an option to skip the password at login. When you scan the QR code on that page, we'll guide you to verify quickly and safely with your facial or fingerprint recognition. There's no need to remember another password!

Security key & passkey

How do keys protect me?

A key is a form of authentication that is resistant to phishing, not able to be tracked, and only works with the websites you register it with. You can think of vanguard.com or our mobile app as the padlock, and you possess the key. 


What if my security key is lost or stolen?

We encourage our security key users to register a backup key. Like car keys, you never know when you may need a spare. If you prefer, your backup key can be a smart phone or a computer (passkey). You can log in with your spare key to remove the lost or stolen key from your account, so it can no longer be used. If you don’t have a spare, you can call us to remove it for you.


Can I use a security key with the mobile app?

Yes, as long as your key has compatibility with your mobile device, you are able to use it on the Vanguard app.


Can I remove security codes if I have a key?

You can remove security codes from your account when you register two or more keys to your account. Both passkeys and security keys count towards that total. We encourage you to use multiple keys and remove security codes to minimize phish risk.

Device management

What is a “trusted device”?

A trusted device is a device that you’ve previously authorized to access your Vanguard account. These devices will appear on the device management screen for you to review, rename, or remove. 

How do I access the device management screen?

This feature is only available within the Vanguard app. In the app, select the profile tab, then navigate to the settings section. Select login & security, then select device management to access your device list. 

I’m seeing a web login session in device management after logging in to the Vanguard app on my phone, is this normal?

Yes, this is normal. Users who log in with their username and password may see a web session added to the device list as a result of the login process.

How do I rename my devices?

To rename your devices, simply select the device you wish to rename from the list on the device management screen, then select rename at the bottom of the screen and enter the new name. When you’re finished, select save to complete the process!

There’s a device that looks unfamiliar on my device list, how do I remove it?

If you see an unfamiliar device on your device list from a location you don’t recognize, we recommend that you remove the device and change your password as soon as possible. You can remove the device by selecting it from the device list and selecting remove at the bottom of the screen. When prompted by your device, select continue to remove it from your account.

Device management

  1. Scan the QR code to open your Vanguard app. If you don’t have the app, we will take you to the app store.
  2.  In the app, select the profile tab, then navigate to the settings section.
  3. Select login & security, then select device management to access your device list. 
  4. Review your device list, remove any outdated devices, and if you’d like, you can rename your devices. 

Vanguard Voice ID

Call us at 877-662-7447 to add the protection of Vanguard Voice ID to your account.



Please note: Vanguard Voice ID is being implemented in phases. We are working hard to make it available to all of our clients as soon as possible. When you call, we will automatically offer Vanguard Voice ID if you are eligible to enroll.

Set up biometrics to stop using passwords!

  1. Download and/or log in to the Vanguard app.
  2. Select profile.
  3. Under settings, choose login & security.
  4. Turn on the toggle aligned to your device's biometrics.

Next time you log in to vanguard.com or the mobile app, use your biometrics to authenticate and skip the password.

It's simple, secure, and uniquely you!

Ready to open an account?

Open an account