Cyber criminals leave some Robinhood users with looted accounts

It took Soraya Bagheri a day to learn that 450 shares of Moderna had been liquidated in her Robinhood account and that $10,000 in withdrawals were pending. But after alerting the online brokerage to what she believed was a theft in progress, she received a frustrating email.

The firm wrote it would investigate and respond within “a few weeks.” Now her money is gone.

Ms Bagheri is among five Robinhood customers who recounted similar experiences to Bloomberg News, saying they’ve been left in limbo in recent weeks after someone sold their investments and withdrew funds. Because the wildly popular app has no emergency phone number, some said they tried in vain to intervene, only to watch helplessly as their money vanished.

“A limited number of customers appear to have had their Robinhood account targeted by cyber criminals because of their personal email account (that which is associated with their Robinhood account) being compromised outside of Robinhood,” a spokesman for the company said in an email. “We’re actively working with those impacted to secure their accounts.”

The issue didn’t stem from a breach of Robinhood’s systems, the spokesman said.

Ms Bagheri, a Washington attorney, and three other Robinhood users said they also contacted authorities including the Securities and Exchange Commission and the Financial Industry Regulatory Authority. Two of those customers said they have heard back from an official at the SEC seeking more information.

Finra and the SEC declined to comment.

Robinhood, founded seven years ago and based in Menlo Park, California, has exploded in popularity this year as millions of Americans stuck at home – including throngs of millennials – look to make some money during a pandemic that has sent stock prices swinging. But the no-fee brokerage app has also attracted consumer complaints, with novice investors confused by the vagaries of stock options and margin loans.

Now, even though the firm said this year that it has more than doubled its customer-service team, clients complain they’re struggling to get quick help when their funds are disappearing.

“They don’t have a customer service line, which I’m quite shocked about,” Ms Bagheri said.

Pruthvi Rao, a Chicago software engineer, said his account was hit on October 6. His bet on Netflix was liquidated and $2,850 was soon withdrawn. He said he’s sent more than a dozen emails to Robinhood’s customer support address, and that he even tried messaging some of the brokerage’s executives on LinkedIn.

“I’m in tremendous mental stress right now because this is all of my savings,” said Mr Rao, 36, whose account was frozen by Robinhood in response to the fraudulent activity. He said Robinhood contacted him on Friday and unlocked the account after sending several emails late Thursday asking for help.

Mr Rao showed Bloomberg the same emailed response from Robinhood that Bagheri received. “We understand the sensitivity of your situation and will be escalating the matter to our fraud investigations team,” Robinhood customer service agents wrote them. “Please be aware that this process may take a few weeks, and the team working on your case won’t be able to provide constant updates.”

Mr Rao said he had previously set up two-factor authentication to access his account, and Ms Bagheri said she’s certain her Robinhood password is unique from all others, including her email. Neither believed they had been duped by phishing scams or malware. Both said they use the same email for Robinhood and other accounts, and that only Robinhood has been affected.

“Unfortunately, it’s a common occurrence that online accounts of monetary value are bought, sold and traded by cyber-criminals,” said Mark Arena, chief executive of Intel 471, which monitors activities of digital criminals. “This shows the importance of people practicing common information-security hygiene such as not re-using the same password across multiple accounts and enabling two-factor authentication, which Robinhood supports.”

They also said Robinhood’s online portal showed their money went to a recipient at Revolut, another popular financial-technology startup. London-based Revolut, which offers a money transfer and exchange app, expanded to the US this year.

“Revolut has been made aware of the issue and is investigating urgently,” a company spokesman said Friday in an email.

Bill Hurley, who owns a metal-fabrication shop in Windsor, Connecticut, said he received notifications that stock and Bitcoin had been sold from his account on September 21, and that $5,000 was transferred to Revolut accounts in two transactions. He said he emailed Robinhood for assistance while the transactions were pending but received none.

“They’ve had more than enough time to deal with this,” he said.

Mr Hurley, 56, said he reached out to the SEC and heard back from a lawyer for the regulator, who asked for additional information on what had happened.

After more than two weeks of emails seeking help from Robinhood, a customer support representative called him on Thursday, he said.