Chicago Couple Loses $180,000 in Retirement Account Hack, Brokerage Cites Optional Security Feature
A Chicago-area couple discovered $180,000 missing from their retirement accounts after a security breach, raising questions about the responsibility of online brokerage firms to protect customer assets.
Tali and Erez Hartal noticed suspicious activity in their Tastytrade accounts while on vacation in August, with dozens of unauthorized trades executed even after market close. “Look at these trades at 3:32. That’s after the market closed. I usually don’t place trades after the market has closed,” Erez Hartal said. The unauthorized transactions resulted in significant losses, jeopardizing the couple’s retirement plans. “It makes us think twice of if we’ll be able to retire at all, and if so, when,” Tali Hartal stated.
Wilmette Police confirmed the account login originated from an IP address in New Jersey. In response to the breach, Tastytrade acknowledged the “intrusion” but attributed the loss to the Hartals’ decision not to enable optional two-factor authentication. The firm’s fraud manager stated in an email that the feature was “rolled out…to mitigate the risk of this occurring to our customers.” Cybersecurity expert Nicole Jiang, CEO and co-founder of Fable Security, emphasized the importance of multi-factor authentication, suggesting that biometric verification methods are more secure than traditional codes. This incident highlights the growing vulnerability of online financial accounts to increasingly sophisticated cyberattacks.
Tastytrade has offered to reimburse 50% of the lost funds, a gesture the Hartals believe is insufficient, suggesting it implies some level of responsibility on the firm’s part. The couple is now considering legal action and has since activated two-factor authentication on their account. The Financial Industry Regulatory Authority (FINRA) offers resources on protecting your investment accounts from fraud.
The Hartals are awaiting a response from Tastytrade regarding their policies, and the firm has not yet issued a public statement on the matter.
