Most account security is about stopping people from logging in as you. Transfer fraud doesn't need your login. A fraudster opens an account in your name at another bank or brokerage, then uses it to request a transfer of your investments out of your main institution.
With the outgoing transfer lock on, Wealthsimple automatically cancels any transfer out request from another institution, rather than just processing it, and lets you know right away. You can turn it on in the Wealthsimple app in a few taps.
What is transfer fraud?
Transfer fraud is a form of identity theft. A fraudster uses your stolen personal information, such as your name, address, social insurance number (SIN), and account number, to open an account in your name at another financial institution. That institution then sends a transfer request to the one that holds your investments, asking to move them out of your real account and into the fraudster's. Fraudsters usually get your details through phishing, data breaches, or stolen mail.
It's hard to catch because the fraudster never logs in to your account at your actual institution, so your password, passkey, and two-factor authentication don't help. Because the fraudster opened the account with your real details, the request matches your information and looks legitimate.
What does the outgoing transfer lock do?
Wealthsimple’s outgoing transfer lock is a free, optional security setting that adds an extra layer of protection: while it's on, we automatically cancel any request from another financial institution to move your investments out of Wealthsimple. That includes full and partial transfers, however the request is sent to us.
Turn it on once and it works in the background on every transfer out request from then on. The lock covers every Wealthsimple investment account you have at once, from your TFSA and RRSP to your non-registered accounts. It doesn't freeze anything else. You can still trade, deposit, withdraw to your bank, and move money between your own Wealthsimple accounts as usual.
How do I turn on the outgoing transfer lock?
Turn it on in the Wealthsimple mobile app.
Open the Wealthsimple app and tap the Profile icon.
Tap Settings (the gear icon), then Security.
Under Extra protection, tap Lock outgoing transfers and switch it on.
Each time you turn the lock on or off, we'll confirm it by email and with an alert in the app's notification centre. To turn it off, you may need to confirm it’s you with your passkey or a verification code.
What happens if someone tries to transfer my investments out?
With the lock on, we automatically cancel the request, so nothing moves. We'll notify you by email and in the app, and tell you which institution the request came from. If you started that transfer yourself, turn the lock off and ask the other institution to send the request again. If you didn't, report it to that institution and contact us right away.
A request in your name also means someone has your personal details, so it's a good moment to brush up on common scams to watch for.
What else keeps your Wealthsimple account safe?
Each of these settings protects against something different, and together they help keep your account safe.
Setting | What it protects against |
|---|---|
| Passkey | Someone logging in as you. It uses your face, fingerprint, or device PIN instead of a password. |
| Two-factor authentication | Someone logging in with your password on a new device. |
| Trusted device | Someone logging in to Wealthsimple on the web from a browser we don't recognize. The login needs your approval on your phone first. |
| Trusted location | Someone using your login details to make transactions or account changes from somewhere you haven't approved. You choose up to 5 places you trust, like home or work. |
| Outgoing transfer lock | Another institution moving your investments out with your stolen details. |
And good news, using passkeys on every device you use for Wealthsimple can also qualify you for the Wealthsimple account guarantee, which reimburses direct losses from unauthorized transactions under its terms. See all the ways we protect your account.
Who should use the lock, and what's the catch?
If you have investments you aren't planning to move, especially long-term savings like an RRSP or TFSA, the lock is an easy way to keep them safe. You'll mainly notice it when you move an account to another institution yourself.
Turn it off before you move an account. The lock cancels every transfer out request, including ones you started yourself, so switch it off before you start a transfer at another institution and we'll process the request as usual. If a request is cancelled, you'd need to ask the other institution to send it again. Here's how TFSA transfers and RRSP transfers work.
Requests can take days to reach us. Transfers started at another institution take a few business days to arrive, and sometimes longer. Keep the lock off until your transfer has arrived, or it'll be cancelled. A request that reaches us before you turn the lock on still goes through.
It only covers requests from other institutions. Withdrawals and moves you start in the app still go through, so someone who logs in as you could still move money. That's why your passkey and two-factor authentication matter too.
With the lock off, we process transfer requests as usual.
Turn on the outgoing transfer lock
Open the Wealthsimple app and turn it on today. While you're in Security, check that your passkey is set up too.
