0

I have account with a stock option trading platform. They are well known and reputable. I had a couple thousand in the account, bought and sold for a while, and then cashed out and withdrew. So I'm not concerned this a is some scam to get money or else they would've done it when I willingly handed them that much cash.

However, now that I've cashed out I want to close my account as I don't plan on using it again and it has my bank account tied to it. I looked up their process of closing the account and their instructions, given on their website, are to email their customer service and include the following in the email:

  1. The name of the account owners(s)
  2. The last four digits of the Social Security number of the account owners(s)
  3. The date of birth of the account owner(s)
  4. The (trading company) account number

This seems like a red flag to me.

Of course they are likely just doing it because they don't have a better way implemented and this verifies people's true identity so that can't close others accounts possibly losing them (many)thousands of dollars. But giving some random customer service rep all of that information seems risky. Would those pieces of data be considered risky? To the extent that I should take an alternative action?

  • Is it possible to disconnect your bank account from the trading account? i.e. keep the trading account open, but disconnect your bank account from it. If so, you could use this as a first step. – mk444 Jan 5 '16 at 13:19
  • 1
    Do they already have this information ? If yes then this is just to prove your identity (if they wanted to be malicious they would've already done something bad since they know this info) and you just have to make sure to submit it securely (no email - prefer contacting them through their HTTPS website). – André Borie Jan 5 '16 at 13:23
  • @mk444 it does appear I can do that, I haven't tried yet though but I will – DasBeasto Jan 5 '16 at 13:24
  • @AndréBorie yes their computer systems have this information. I do not know what clearance their customer service rep that I'd be emailing it all too would have though. There doesn't appear to be any other way to contact them/close the account over the website. – DasBeasto Jan 5 '16 at 13:26
  • The random customer service rep has all that info and more for every customer including those with money in their accounts.... You're not giving them anything they don't already have on a daily basis each day they're at their workstations. I'd be more concerned with their internal audits, monitoring, and hiring processes than providing these small details. – Dave Jan 5 '16 at 18:38
1

The account number you have with them is used to uniquely identify your account with them. This would have been necessary to correctly identify the account to close, so it's perfectly reasonable to request this number. Closing the correct account would be impossible otherwise.

Account holder name isn't usually considered a high value secret. If you were already a customer with them, it's likely the rep would be able to view your name if they have your account number, just so they can call you with the correct name.

The four digits of Social security number does represent a security risk to disclose to a random rep. Due to the way social security number is assigned before SSN randomization in 2011, a moderately advanced attacker has a 44% chance of guessing the first 5 digits of your SSN in a single guess, with just publicly available data, if they know where you were born (which is likely the same as your current address), and your date of birth. The last four digit are the part of SSN that is the hardest to guess since they're just serial number.

I would say that if they are only asking these for questions, they are authenticating you insufficiently.

1

I think you should do it over the phone. It should be possible, and record the call for future reference. The problem with emails is that they can sit around for a longer time than calls since most carriers charge a storage fee by number of recorded calls thus users of such services have the tendency of keeping a shorter history. Add this to the fact that most help desk will have some sort of application in which they type directly your data, and once they're done they move to a new one. Whereas with email, it gets stored from hop to hop until it lands in someone's outlook... To your point NYC has recently passed a city law in 2012 which forbids companies to ask like records over unencrypted channels and makes companies liable for sloppy security work.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.