FINRA Alerts Firms to Recent Increase in ACH “Instant Funds” Abuse
FINRA warns member firms that, over the past two months, we have observed a sharp increase in new customers opening online brokerage accounts and engaging in Automated Clearing House (ACH) “instant funds” abuse to effect securities trading. (FINRA has previously warned firms about trends in losses from schemes involving electronic funds transfers, such as those involving outbound wire transfers and ATM withdrawals.1)
Some firms provide individuals opening a brokerage account online with instant access to funds (“instant funds”), allowing those customers to trade in their online accounts as soon as they enable ACH transactions, i.e., without having to wait for the payment to settle. The amount of “instant funds” a customer may access varies from firm to firm. While ACH “instant funds” availability has been misused in the past, the recent increase in these events appears correlated to the recent market volatility driven by social media interest in certain securities. Some discussions on social media include descriptions of the “instant funds” policies of specific firms.
With ACH “instant funds” abuse, a malicious actor will open a brokerage account online or through an application—typically in his or her legal name or, in more limited circumstances, using a stolen or synthetic identity—and will add a bank account to engage in ACH transactions. The malicious actor will then submit a request to the firm to request an ACH transfer (or “pull”) from the linked bank account while also using the “instant funds” to immediately place orders to buy securities. After the orders are executed, the firm will receive a “Non-Sufficient Funds” (NSF) or a “Fraud” message from the bank that was expected to send the ACH—resulting in losses for the firm after it recalls the ACH transaction and is forced to sell out of the malicious actor’s position(s).
FINRA urges firms to evaluate and, as appropriate, mitigate the potential financial risk they face in light of the increase in “instant funds” abuse. This could include adjusting the amount of available “instant funds,” delaying the ability to place orders with unsettled funds or by enhancing their account validation processes.2
In addition, firms that have experienced instant funds abuse should consider whether the activity triggers a Suspicious Activity Report (SAR) filing obligation. The Bank Secrecy Act and its implementing regulations require financial institutions to report suspicious transactions to the Financial Crimes Enforcement Network (FinCEN) using SARs.3
Questions regarding this Notice should be directed to Blake Snyder, Senior Director, Financial Intelligence Unit, at (561) 443-8051 or by email.
2 See the National Automated Clearing House Association (NACHA) Account Validation Resource Center for additional information.
3 See 31 U.S.C. 5318(g); 31 C.F.R. 1023.320.