SoFi's $1.1M FINRA Fine: Auto-Approved Accounts

Updated October 2026. First published August 2024. The first version gave almost no facts about the case; this version follows FINRA's order.

On May 2, 2024, FINRA accepted a Letter of Acceptance, Waiver, and Consent from SoFi Securities LLC (AWC No. 2019062705801). SoFi agreed to a censure and a $1.1 million fine, without admitting or denying the findings.

The findings cover five months, December 2018 through April 2019, and one product, SoFi Money. People using stolen or fictitious identities opened about 800 SoFi Money accounts. They used them to pull about $8.6 million out of accounts that customers of other financial institutions held, without those customers' authorization, and withdrew about $2.5 million of it. FINRA found that SoFi's Customer Identification Program (CIP) wasn't reasonably designed, in violation of FINRA Rules 3310(b) and 2010. It also found that SoFi's written Identity Theft Prevention Program wasn't reasonably designed, in violation of Rule 201 of the SEC's Regulation S-ID and FINRA Rule 2010. The order notes that all injured parties were reimbursed.

For numerous accounts, the vendor SoFi used to check identities had flagged the problems. SoFi's process didn't read the flags when the score passed.

What SoFi Money Was

SoFi Money was a cash management brokerage account with features of a bank account, such as check writing and debit cards. SoFi began offering it in 2018 and rolled it out in phases: first to employees and existing SoFi customers, then in December 2018 to people on a waitlist, and in February 2019 to the general public. Before the public launch, unauthorized transfers into SoFi Money accounts were minimal.

The fraud followed a simple path. An applicant opened an account under a stolen or made-up identity and linked it to an outside bank account they had gotten into without permission. SoFi confirmed the link with trial deposits, small amounts sent to the outside account. Since the fraudsters could see that account, they could confirm the amounts. They then moved money in and took it out by ACH transfer, ATM withdrawal, and debit card purchases.

In February 2022 SoFi became a bank holding company and began offering checking and savings accounts. In June 2022 it stopped opening SoFi Money accounts for new customers, with limited exceptions.

Where Account Opening Broke Down

SoFi's third-party identity vendor returned two things for each applicant: a number score and a report of the risks its analysis found. If the score missed SoFi's threshold, a person reviewed the application. If the score met the threshold and SoFi's other commercial tools also supported the applicant's identity, SoFi approved the account automatically. Nobody looked at the report.

The reports that went unread listed these red flags, among others:

A phone number or home address that conflicted with other available information.
The same address or phone number as another, unrelated account.
No credit history.
An application from an IP address more than 100 miles from the applicant's home address.
A Social Security number that wasn't valid, or that belonged to someone else, including a person who had died.

Some applications carried several at once. In one auto-approved application the order describes, the name was invalid, the address didn't exist, the email address and phone number were both high risk, the vendor couldn't verify the date of birth, and the Social Security number was issued before that date of birth and tied to a different name and address.

SoFi's system also wasn't designed to spot applicants who had already tried fraud on another SoFi product, and it didn't. Consultants SoFi hired to test its fraud and supervisory systems before launch had recommended screening former customers whose loan or investment accounts were rejected or closed for possible fraud. SoFi didn't put that screen in place before the public launch.

Where the Identity Theft Program Broke Down

Regulation S-ID applies to "covered accounts," which include accounts kept mainly for personal, family, or household purposes that allow multiple payments or transactions. SoFi's written program didn't list SoFi Money as a covered account until April 2019.

The program itself named the right red flags. It listed an address that doesn't match a consumer report, a Social Security number that was never issued or appears on the Social Security Administration's Death Master File, and identifying information already used on an account the firm knew was fraudulent. Those were the same flags showing up in the vendor reports SoFi didn't read.

Alerts sat too long. SoFi's procedures required review of fraud alerts within 48 to 72 hours. With the volume of alerts the fraud generated, reviews took an average of 63 days, and up to 132 days in some cases. SoFi put no holds or restrictions on the accounts while alerts waited, and in some cases money left accounts opened with stolen identities during that wait. The pre-launch consultants had warned that projected growth would produce more alerts than SoFi's staff could handle. SoFi didn't hire enough people to meet that forecast before the launch.

The case came from SoFi's own report. In response to the fraud, SoFi added staff trained to review fraud alerts. Starting in April 2019, it upgraded its fraud tool to do more identity checks, changed its verification logic to decline certain applicants automatically, and hired consultants to work through the alert backlog. It reviewed thousands of high-risk accounts and self-reported to FINRA.

What to Check in Your Own Account Opening

The CIP rule for broker-dealers, 31 CFR 1023.220, requires risk-based procedures that let the firm "form a reasonable belief that it knows the true identity of each customer." It also requires procedures for when the firm can't, covering when not to open the account, what the customer may do while verification is pending, when to close the account, and when to file a Suspicious Activity Report. Regulation S-ID requires a written program that identifies relevant red flags, detects them, responds to them, and is updated over time, and it requires oversight of service providers. Read against SoFi's facts, those rules raise these questions:

Does your automated approval path act on the vendor's red-flag codes, or only on the score? A passing score is a summary. SoFi's vendor reported the flags, and the approval logic never looked at them.
Do the red flags in your written identity theft program map to specific fields in your onboarding tool? If your program lists the Death Master File, something in the approval flow should check for it.
When you launch a new account type, does someone decide in writing whether it's a covered account before the first customer opens one? Regulation S-ID requires that determination periodically.
What happens to an account while its fraud alert waits? Regulation S-ID requires an appropriate response to the red flags you detect. SoFi's alerts waited an average of 63 days, with no hold on the accounts.
Can your onboarding check catch an applicant your firm already rejected or closed for suspected fraud on another product? Some of SoFi's applicants had tried before.
Are pre-launch test findings tracked to closure? The order cites two consultant recommendations, screening for prior fraud and adding alert staff, that SoFi had before the public launch and hadn't carried out by then.
What do your linking checks prove? Trial deposits show that someone can see the outside account. In SoFi's case, the fraudsters could.

SoFi at least had a written identity theft program. For a firm FINRA found had none, see our post on FINRA's action against Ceros Financial.

This post is for informational purposes only and does not constitute legal advice. For guidance on specific regulatory obligations, consult your counsel or compliance advisor.