How we score account protections
Our scorecards record which account protections a firm offers its customers, based on what the firm itself publishes. We don't test or hack anything, and we don't rate a company's internal security. A score is not a guarantee that an account is safe, and it is not a recommendation to open or close an account.
What we check
We look at eight protections. Each one makes it harder for someone else to get into your account or move your money.
| Protection | What it means |
|---|---|
| Passkeys | A way to sign in with your face, fingerprint or device PIN instead of a password. A passkey only works on the real website or app, so it resists phishing. |
| Authenticator app or app approval | An app that gives you a one-time code, or a "yes, it's me" prompt sent to the firm's own app on your phone. We count both third-party authenticator apps and firm app push approvals. |
| Hardware security key | A small physical key that you plug in or tap to confirm a login. We count only FIDO or passkey hardware, which works only with the real site and so resists phishing. |
| Code-generating key fob | A physical fob or card that shows a one-time code to type in. It is stronger than a password alone, but it is not phishing-resistant like a FIDO key, because a code can be read out to a scammer. We list it separately. |
| Text message the only option? | Whether a code sent by text message is the only way to confirm a login. Text codes can be stolen through SIM swaps, so here "Offered" is a flag: it means text is the only option we found. "Not offered" means the firm documents at least one other option. |
| Transfer lock | A lock you can turn on yourself that blocks money or assets from leaving your account until you turn it off. Some locks block electronic transfers out, some block transfers to another brokerage (ACATS transfers), and some block both; we say which. A block available only by calling customer service is not counted. |
| Phone PIN or verbal password | A code or word you set that a caller must give before the firm acts on your account by phone. Voiceprints and voice ID checks don't count. |
| Written fraud guarantee | A written promise from the firm to reimburse losses from unauthorized activity in your account, usually with conditions. SIPC coverage is not a fraud guarantee: it protects customers if a brokerage goes out of business, not if someone breaks into an account. |
How each status is assigned
Every cell in a scorecard gets one of four statuses.
- Offered: the firm's own public documentation describes the protection as available to customers.
- Not offered: the firm's documentation says the protection isn't available, or clearly lists the options in a way that leaves it out. We don't use this status just because we couldn't find something.
- Not documented: we could not find the protection in the firm's public materials. It may still exist. This is not the same as "Not offered."
- Conflicting sources: the firm's own documents disagree with each other, or with another official or primary source, and we could not settle the difference from public documents. The note explains the disagreement and lists both sources. No entry currently has this status.
When a protection is only available for some accounts, platforms or balances, the note says so.
Where the information comes from
We use each firm's own public documentation, such as help pages, security pages, account agreements and forms, for US retail accounts. Every cell links to its source and shows the date we last checked it. We re-check every source at least every 90 days, and sooner when a firm or reader reports a change. Features change, so check with your firm before relying on any detail.
Dated reports are snapshots. Dated third-party reports, such as letters from government officials, describe what firms said at one point in time. We may mention one for context, with its date, for example "An Aug 20, 2026 Senate letter reported..." A snapshot never supports a status on its own. Forum posts and social media are never used as sources.
How we chose the firms
The list covers 10 large US brokerages that offer self-directed accounts, ranked by each firm's own published client-asset figure, such as an earnings release or business update. Firms measure these figures differently. Some include advisor-led, workplace, institutional or non-US assets, so the order is approximate. Each figure, its date and its caveats are listed in our ranking sources file.
Empower is listed separately because it is mainly a 401(k) recordkeeper, and its assets-under-administration figure is not comparable to brokerage client assets. Its entry covers the 401(k) participant website.
Unconfirmed details, and corrections
Where we could not settle a detail from a firm's public pages, the note says "Not yet confirmed by the firm." If a firm later confirms or corrects a detail with documentation we can link, we update the note. We can only change an entry based on documentation we can link.
Think we got something wrong? Tell us on our corrections page, or email [email protected] with a link to the source. We note every correction on the corrections page.
About this page
This page is general education, not financial, legal or security advice. Guarantees have conditions and exclusions, so read each firm's linked terms.