Picture this: you log into your brokerage account on a Tuesday morning and find that your entire portfolio, decades of investment savings, has been moved to an account you've never heard of, at a firm you've never used. No phone call. No email you noticed in time. Just gone.

This isn't a hypothetical. FINRA has formally warned member firms about this exact scheme: in Regulatory Notice 22-21 (2022), FINRA alerted firms to a "heightened threat" of fraudulent ACATS transfers tied to a rise in account takeover (ATO) incidents, and followed up in Regulatory Notice 23-06 (2023) with recommended safeguards after continuing to see the pattern. As recently as August 2026, Senators Ron Wyden and Elizabeth Warren sent a letter to FINRA CEO Robert Cook pressing for new ACATS rules, citing an October 2025 New York Times investigation into transfer-fraud incidents at domestic brokerage firms. It exploits a system most investors have never heard of: ACATS.

What Is ACATS, and Why Does It Matter?

ACATS stands for the Automated Customer Account Transfer Service. It's the behind-the-scenes system that lets you move your investment account from one brokerage to another. Say, from a bank's brokerage arm to Webull, without having to sell everything and start over. You initiate a transfer request at the receiving firm, and ACATS handles pulling your holdings over from the old one, typically within a few business days.

It's a convenient, investor-friendly system. It's also, unfortunately, a system that fraudsters have learned to exploit.

How Fraudsters Abuse ACATS

Because ACATS transfers are initiated by the receiving firm, not the one holding your assets, a criminal doesn't need to break into your brokerage account directly. They just need enough of your personal information: name, account number, Social Security number, maybe a forged signature or a spoofed email, to open a new account somewhere else and request a transfer of your holdings into it.

From your original broker's perspective, this can look like a routine, legitimate transfer request. By the time anyone notices something is wrong, your assets may already be in the fraudster's hands and moving again.

This is exactly the kind of fraud that doesn't show up as a hacked password or a suspicious login. It shows up as your money quietly walking out the front door through a process designed to be fast and low-friction.

Enter the ACATS Transfer Lock

An ACATS transfer lock closes this gap. When you enable it, you're placing a hold on your account that blocks any ACATS transfer request from going through, even one that appears to come from a legitimate receiving firm—until you personally authorize it.

Here's what that means in practice:

• No surprise transfers. If a bad actor tries to move your account elsewhere, the transfer is stopped before it can execute, not after.

• You're in control of the unlock. Removing the lock requires you to verify your identity directly with us, through a channel a fraudster can't easily spoof.

• It works quietly in the background. You don't have to think about it day to day. It simply stands guard.

Think of it less like an alarm that goes off after a break-in, and more like a lock the burglar can't pick in the first place.

Why This Is a Competitive Advantage, Not Just a Checkbox

Plenty of security features are reactive: fraud monitoring, alerts, reimbursement policies. Those matter, but they all kick in after something has already gone wrong. An ACATS transfer lock is different because it's preventive. It removes the opportunity for this specific, high-dollar fraud pattern to succeed at all.

For a platform like Webull, offering this feature, and making it easy to find and turn on, signals something important to investors: we understand where the real vulnerabilities in the industry actually are, and we've built a specific defense for them, rather than relying on generic "we take security seriously" language.

That's a meaningful differentiator. FINRA's own regulatory notices (22-21, 23-06) and the August 2026 Senate letter to FINRA's CEO show account transfer fraud has been a persistent, rising concern industry-wide and regulators note that many firms still don't reliably notify customers when a transfer is initiated, let alone offer a lock. Investors researching where to hold their life savings are increasingly asking sharper questions about custody and fraud protection.

What This Means for You

At Webull we offer an ACATS transfer lock, turning it on costs you almost nothing, a few minutes, maybe a small extra step the next time you do want to legitimately transfer assets. What it buys you is real protection against a fraud method specifically designed to bypass your password, your login alerts, and your day-to-day vigilance.

Security in financial services isn’t just about stopping hackers from breaking in through the front door. Increasingly, it’s about closing the side doors that most people don’t even know exist. The ACATS transfer lock is one of those doors and now you know where it is.

Have questions about enabling a transfer lock on your account, or want to understand how your assets are protected?

Feel free to visit our dedicated FAQ page by clicking here (https://www.webull.com/help/faq/11142-ACATS-Transfer-Lock) for more information about transfer locks, including how they work, how they help protect your account, and how to enable or disable the feature.

Dislaimer: Webull Financial LLC (member SIPC, FINRA) offers self-directed securities trading. All investments involve risk. More info: https://www.webull.com/policy

The information provided does not constitute investment advice and it should not be relied on as such. It should not be considered a solicitation to buy or an offer to sell a security. It does not take into account any investor's particular investment objectives, strategies, tax status or investment horizon. Investing involves risk, including the risk of loss of principal.