J.P. Morgan Self-Directed Investing account security: passkeys, two-step verification, transfer lock and guarantee
Checked
You sign in to J.P. Morgan Self-Directed Investing through Chase: J.P. Morgan says "Invest in the Chase Mobile® app or at chase.com" (Chase: online investing, checked Oct 22, 2026). The sign-in protections below come from Chase's own security pages.
Quick answers
- Does Chase support passkeys for J.P. Morgan Self-Directed Investing? Yes. Chase says "our chase.com website is passkey and password manager enabled" (Chase: privacy and security, checked Oct 22, 2026). Its security tools page adds "Passkeys make signing in faster and more secure. They let you use your face, fingerprint or device passcode to sign in" (Chase: how you can protect yourself, checked Oct 22, 2026).
- Does Chase have two-factor authentication? Yes. Chase calls it 2-step verification. Chase says "Sign up for 2-step verification and get extra security when you sign in to chase.com. You'll be asked to verify it's you by entering a one-time code" (Chase: how you can protect yourself, checked Oct 22, 2026). The steps are under "How to turn it on" below.
- Does Chase support YubiKey? Not documented. We did not find hardware security keys, of any brand, on Chase's public security pages (Chase: how you can protect yourself, checked Oct 22, 2026).
- Does Chase use Google Authenticator? Not documented. We did not find an authenticator app, or an app approval you can choose as your sign-in method. Chase says that when "you sign in for the first time, or we see unusual login or account activity we'll use additional validation checks like mobile app notifications or a one-time code to authenticate you." Chase describes these as checks it runs, not as a sign-in method you choose (Chase: privacy and security, checked Oct 22, 2026).
- Does Chase have a money transfer lock for J.P. Morgan investment accounts? Not documented. Chase's security pages describe locking debit and credit cards, but we did not find a lock on transfers out of an investment account (Chase: how you can protect yourself, checked Oct 22, 2026).
- Does Chase reimburse fraud in a J.P. Morgan investment account? Not documented. We did not find a written fraud guarantee for J.P. Morgan investment accounts. Chase's published promise covers money "removed from your checking or savings account through our mobile or online banking bill pay or transfer services," and says "We'll reimburse you for those unauthorized transactions when you contact us promptly after the transaction first appears on your statement." Chase's Zero Liability Protection covers unauthorized credit or debit card charges "when reported promptly" (Chase: privacy and security, checked Oct 22, 2026).
All eight protections we track
| Protection | Status | What Chase's docs say | Source |
|---|---|---|---|
| Passkeys | Offered | Chase says chase.com "is passkey and password manager enabled," and its security tools page offers "Add a passkey for more secure sign-in." | Privacy and security; How you can protect yourself |
| Authenticator app or app approval | Not documented | We did not find an authenticator app or an app approval you can choose. Chase may use "mobile app notifications or a one-time code" when it sees a first or unusual sign-in. | Privacy and security |
| Hardware security key | Not documented | We did not find FIDO or passkey security keys. | How you can protect yourself |
| Code-generating key fob | Not documented | We did not find a physical token that shows a code. | How you can protect yourself |
| Text message the only option? | Not offered | Chase documents passkeys and an extra Chase Mobile app sign-in step that asks for "your phone's passcode or screen lock code," as well as one-time codes. | How you can protect yourself |
| Transfer lock | Not documented | We found only debit and credit card locks, not a lock on outgoing account transfers. | How you can protect yourself |
| Phone PIN or verbal password | Not documented | We did not find a phone PIN or verbal password. | How you can protect yourself |
| Written fraud guarantee | Not documented | Chase's published reimbursement promise covers unauthorized bill pay or transfers from checking or savings, and its Zero Liability Protection covers card charges. We did not find one for investment accounts. | Privacy and security |
How to turn it on
We list a step only where Chase's own page gives it (checked Oct 22, 2026).
- 2-step verification on chase.com, from Chase: how you can protect yourself. Chase says "You'll be asked to verify it's you by entering a one-time code."
- Log into chase.com and click on the "Security & Privacy" tab at the top of the page.
- Find the "Enhance your Security" section in "My Account."
- Click "enable 2-step verification for extra security at sign-in."
- You can toggle the switch to "Use 2-step verification every time you sign in on a browser."
- Turn on "Receive one-time codes by email" if you also want the option to receive codes by email.
- Click "Yes" or "Save" to confirm your changes.
Chase notes: "Depending on your account type, you may have to select 'Security' then 'Manage security & privacy' to find these options."
- Extra sign-in step in the Chase Mobile app: Chase says "Once you set it up, you'll be asked to confirm your identity by entering your phone's passcode or screen lock code as a second step to your sign-in." The page doesn't list the setup steps.
- Trusted device: Chase says "A trusted device is a smartphone that you've verified with the Chase Mobile® app" and that "It adds an extra layer of protection against unauthorized access, even if someone has some of your information" (Chase: how you can protect yourself). The page's "Enroll device" button doesn't list steps.
- Passkey: Chase's public pages don't give setup steps.
- The "Set up passkey" and "Turn on now" links go to Chase's sign-in page, so we could not confirm the steps past login (checked Oct 22, 2026).
What the statuses mean
- Offered: Chase's or J.P. Morgan's own documentation describes the feature.
- Not offered: the documentation says it isn't available, or lists its options in a way that clearly leaves it out. For "Text message the only option?", Not offered means Chase documents at least one alternative to text messages.
- Not documented: we could not find the feature in Chase's or J.P. Morgan's public materials. It may still exist.
Features change, so check with J.P. Morgan before relying on any detail. This page is general education, not financial advice.
Think we got it wrong? Tell us.
Sources
- Chase: online investing, checked Oct 22, 2026
- Chase: privacy and security, checked Oct 22, 2026
- Chase: how you can protect yourself, checked Oct 22, 2026