Vanguard offers multifactor authentication

Vanguard offers multifactor authentication in different ways. By putting the power of authentication in our investors’ hands, clients can opt to have security codes delivered directly to their phones or they may choose to use external security keys.

Watch the full replay »

Other highlights from this webcast

Vanguard webcast library


Emily Farrell: Another great question that we received from one of our registered viewers is from Steven in Minnesota. “Is Vanguard considering offering two-factor authentication for computer access? And if not, why not?” Jeff.

Jeffrey Lampinski: We do offer two-factor authentication. In fact, we offer something known as multifactor authentication. Two-factor authentication is typically something you know and perhaps something you have. So we do enforced two-factor authentication every time one of our clients logs in from a device that we recognize, because we have analyzed that device when the client first logged in and registered the device. So anytime you log in we enforce two-factor authentication. We examine the machine. We satisfy ourselves that that is in fact Ellen Rinaldi’s machine. We recognize it. So it’s something you have.

The other piece, the other factor is something you know, and that’s your password. But since 2014, we’ve gone beyond that. Since 2014, we offer something known as multifactor authentication. Ellen if you want to touch upon the security codes and maybe I’ll talk about the key.

Ellen Rinaldi: Sure. At the end of 2014, the beginning of 2015, we offered an option for our shareholders to sign up for something called security codes. Which means you would put in your user name, then a security code would be sent to either a cell phone or a landline. Some of us still do have landlines. I know that’s hard to believe, but some of us do. You would take that four-digit code. You would type that into the website, and then it would release and allow you to put in your password. That way you are sure that it’s you. Right?

Jeffrey Lampinski: That’s correct.

Ellen Rinaldi: Now that is a popular feature and all retail shareholders will be adopting that over the next several months.

Emily Farrell: Yes. So, essentially, if you’re an individual investor with Vanguard, your retirement account, your brokerage or college savings, you’re eventually going to be enrolled in the service.

Ellen Rinaldi: Right, right.

Jeffrey Lampinski: That’s correct.

Another feature is something that not a lot of people are using yet and that’s a security key. And, Jeff, do you want to talk about that a little bit? It’s one of his favorites is just why he gets to talk about it.

Jeffrey Lampinski: The code, by the way, we really love the code and that’s why we’re going to actually having all clients have to subscribe to receiving that code because it’s, again, something you know. We just send you that code maybe an SMS text to a cell phone. And in my view, it’s something you have.

Emily Farrell: Yes.

Jeffrey Lampinski: Another factor you have that cell phone in your hand.

Emily Farrell: Again, it’s that multi-point really.

Jeffrey Lampinski: That’s exactly right, multifactor authentication. Ellen’s referring to a security key.

Emily Farrell: An actual key.

Ellen Rinaldi: A real key.

Jeffrey Lampinski: It is. It looks like a key. It’s a small token. This is something Vanguard offers. Yet again, another factor this is something you have. So when you login, user ID, password, you’re prompted to insert this in the USB drive. Within a second, this small key here begins to flash. You simply put your thumb on it and you’re authenticated.

Emily Farrell: It’s like a superpower in your pocket.

Ellen Rinaldi: It’s true.

Jeffrey Lampinski: The beauty of this is you can buy these at Amazon. You could buy them at other retailers. We support four keys. This is a YubiKey U2F key. If you go to the security site and visit that site on, you find which keys we support. It is four. They range in price from $18 to maybe $50.

Ellen Rinaldi: $25, $50. That high?

Jeffrey Lampinski: This is $18 and trust me, it does everything I want it to do. And the other beauty of it is if it’s supported, and it is supported by other financial institutions, other retailers, you can use that same key at those retailers, at those other financial institutions. You carry one key.

Emily Farrell: Okay. That’s a good point I guess.

Jeffrey Lampinski: You’re not going to carry six or eight keys. You carry one key.

Emily Farrell: That’s good because I’m always losing my key. No.

Ellen Rinaldi: Another benefit, actually, is even if you lost the key, you’re already signed up for security codes.

Emily Farrell: There you go.

Ellen Rinaldi: So a security code would then substitute.

Emily Farrell: Okay, so you’ve got both.

Ellen Rinaldi: So you don’t have to worry if for some reason you lost it.

Jeffrey Lampinski: That’s correct.

Ellen Rinaldi: And we do offer the service. We don’t offer the keys. You’ll have to buy your own.

Emily Farrell: That’s a great point.

Ellen Rinaldi: Yes.

Emily Farrell: So, actually, our first live question is in. Steve Parks asked us, “Why doesn’t Vanguard provide an email option for its two-factor authentication?” which, of course, we’ve already cleared up multifactor. So email?

Ellen Rinaldi: You notice that we talk about sending a text message to a phone of some kind, either a cell phone or a landline.

Emily Farrell: Yes.

Ellen Rinaldi: We don’t talk about sending authentication messages to email. And that’s because email can be compromised. Much more likely to be compromised.

Emily Farrell: We’ve all heard about it.

Ellen Rinaldi: We all know about it. We’ve all heard about it. In fact, a number of people, I’m sure in the audience have had their email compromised. Some of them didn’t even know it at the time. So we don’t want to be sending messages to compromised email for authentication. We can send emails for notification. But when it comes to authentication, knowing who you are, we want to make sure that the device and the message is getting to the right person.

Important information

This webcast is for educational purposes only. We recommend that you consult a tax or financial advisor about your individual situation.

© 2018 The Vanguard Group, Inc. All rights reserved.