Jean, an 84-year-old retiree from Chattanooga, Tennessee, had never logged in to any online banking portal in her life. She managed her wealth management account by phone and traditional mail, just as she always had.
When her wealth management firm mailed a letter asking whether she had recently changed her email address and linked bank account, the question made no sense because she had done neither, Moneywise reported.
Criminals used her identity to open a new checking account elsewhere and link it to her investment profile. They drained $45,500 from her $169,790 balance without a single verification call to the legitimate account holder.
By the time the firm tried to reverse the wire, the money was already gone. Jean called in to “The Ramsey Show” to explore her options.
Ramsey points to a major security failure behind the theft
“I think that’s on them,” Ramsey said of the wealth management firm, noting that the firm’s own systems allowed the changes to go through.
He told Jean that permitting someone to alter her email and linked bank account without verifying the change with the actual account holder was a fundamental security failure.
“Cybersecurity at a minimum is horrible at this company,” Ramsey added on the show.
Jean’s ordeal reflects what cybersecurity experts call an account takeover, a fraud scheme targeting financial accounts and identities. The attackers seemingly possessed enough personal information to open a bank account and link it successfully.
Ramsey co-host Jade Warshaw warned that the criminals behind the theft may still possess Jean’s personal information. That means risks to her other financial accounts could persist beyond the $45,500 already stolen from her.
Federal rules may give Jean a way to recover her money
Ramsey’s instinct that the firm bears responsibility is consistent with what federal regulators actually require of wealth management firms and brokerage dealers.
The Financial Industry Regulatory Authority’s (FINRA) 2026 Annual Regulatory Oversight Report outlines cybersecurity requirements for brokerage firms nationwide.
Under SEC Regulations S-P and S-ID, firms must address risks of unauthorized access, fraudulent transfers, and identity theft.
More Retirement:
- Vanguard drops playbook on retirement income
- Vanguard warns workers losing thousands in 401(k)s
- Fidelity’s wake-up call on Social Security, IRAs, and 401(k)s
The SEC has identified Regulation S-P and Regulation S-ID compliance as explicit examination priorities for 2026, according to a legal analysis by Lowenstein Sandler, the securities law firm.
The agency has pursued enforcement actions against investment advisers who allowed email account takeovers to go undetected and unaddressed for extended periods.
If Jean’s firm changed her contact information without first verifying the request with the legitimate account holder, releasing funds to a newly linked account afterward may have breached regulatory obligations and created reimbursement liability.
Federal cybersecurity rules may allow recovery if firms fail to verify identity changes or prevent unauthorized account access and transfers.
South_agency/Getty Images
Fraud losses among older Americans have quadrupled
Jean’s situation reflects a crisis that has become dramatically worse in recent years.
Total fraud losses reported by Americans 60 and older increased about fourfold from 2020 to 2024, rising from roughly $600 million to $2.4 billion, according to the Federal Trade Commission.
Because most fraud goes unreported, the FTC estimated in the December 2025 report to Congress that true losses among older adults in 2024 may have totaled as much as $81.5 billion.
The Federal Bureau of Investigation’s (FBI) 2025 internet crime report found that Americans 60 and older lost $7.75 billion to internet crime, a 59% jump from the prior year.
Senator Rick Scott (R-Fla.), Chairman of the U.S. Senate Special Committee on Aging, issued a statement in 2025 warning that increasingly sophisticated scam operations are making older Americans a primary target.
Across our nation, older Americans are being targeted every day by increasingly sophisticated scams that rob them not only of their hard-earned savings but also of their security and peace of mind.
Investment fraud alone accounted for $3.5 billion of those losses among older Americans, according to the FBI’s 2025 Internet Crime Report.
Adults aged 80 and older reported a median individual loss exceeding $1,600, well above that of younger victims, the FTC noted.
Older Americans are an especially vulnerable target because of how much they have saved. Americans aged 65 to 74 had a median net worth of $409,900 in 2022, more than 10 times that of adults under 35, according to the Federal Reserve‘s Survey of Consumer Finances.
Next steps for Jean and others in similar situations
On “The Ramsey Show,” Ramsey told Jean to call the firm immediately, confirm her remaining balance was secure, and demand full reimbursement based on the firm’s security failure.
If the firm declines to reimburse voluntarily, FINRA arbitration is the standard route for investment account disputes, according to FINRA’s dispute resolution guidance.
Investors can file without an attorney, though brokerage firms typically retain experienced defense counsel and claimants may choose to hire their own representation, FINRA notes.
For any account takeover victim, the Federal Trade Commission recommends filing an Identity Theft Report at IdentityTheft.gov, which generates a personalized recovery plan and creates a document that creditors are required to honor.
The FTC also points victims to a free credit freeze with each of the three nationwide credit bureaus, Equifax, Experian, and TransUnion, to block criminals from opening new accounts in the victim’s name.
Internet-enabled financial crimes can also be reported to the FBI’s Internet Crime Complaint Center at IC3.gov.
Jean’s case shows that managing accounts by phone and mail does not insulate customers from online attackers, Warshaw said on the show.
Related: Dave Ramsey, Vanguard warn Americans on IRAs, Roth IRAs