SoFi Securities LLC (SoFi Technologies) · Governance finding · severity 3 of 5
Per FINRA, SoFi Securities used "a largely automated process" to approve SoFi Money cash-management accounts from December 2018 to April 2019: applicants whose third-party vendor score met SoFi's threshold were approved automatically without anyone reading the vendor's report of red flags, such as invalid Social Security numbers. Fraudsters using stolen or fictitious identities opened about 800 accounts, transferred about $8.6 million from customers at other institutions without authorisation and withdrew about $2.5 million; all injured parties were reimbursed. In a May 2024 AWC, SoFi Securities was censured and fined $1.1 million without admitting or denying the findings. SoFi had self-reported the fraud. FINRA described an automated process, not described as AI.
Record last reviewed Oct 21, 2026 · Markdown
Date
Institution
Country
United States
AI system
Largely automated account-approval process that auto-approved applicants meeting a vendor identity-score threshold
AI?
Automated system not described as AI
The system was automated, but neither the institution nor a regulator described it as AI; it is listed because it is routinely discussed as an AI failure.
Category
Status
Settled
Severity
3 of 5
Impact
About $8.6 million transferred without authorisation; about $2.5 million withdrawn; $1.1 million fine · ≈ $1.1 million · About 800 fraudulent SoFi Money accounts; customers of other financial institutions whose accounts were drained were reimbursed
What happened?
SoFi began offering SoFi Money, a brokerage cash-management account with check writing and debit cards, in 2018, opening it to a waitlist in December 2018 and to the general public in February 2019. FINRA found that from December 2018 through April 2019 SoFi "used a largely automated process to approve the opening of SoFi Money accounts that was not reasonably designed to verify the customers' identity" and was therefore vulnerable to fraud by third parties using fictitious or stolen identities.[1][2]
A third-party vendor scored each applicant and produced a report of identified risks. If the score met SoFi's threshold and other commercial tools supported the applicant's identity, SoFi "automatically approved the account without reviewing the vendor's report". Applications were approved this way despite red flags including conflicting addresses or phone numbers, addresses or phone numbers shared with unrelated accounts, no credit history, IP addresses more than 100 miles from the stated residence, and invalid Social Security numbers or numbers linked to other people, including deceased individuals. The system also did not detect applicants who had previously attempted fraud on other SoFi products, although consultants had recommended such screening before launch.[1]
Using stolen or fictitious identities, applicants opened about 800 SoFi Money accounts, linked them to external bank accounts they had fraudulently accessed, transferred about $8.6 million into SoFi Money and withdrew about $2.5 million through ACH transfers, ATM withdrawals and debit-card purchases. FINRA also found SoFi's identity theft prevention program deficient: SoFi Money was not listed as a covered account until April 2019, and fraud alerts that policy required to be reviewed within 48 to 72 hours took an average of 63 days, and up to 132 days, to review.[1][3]
The matter began when SoFi self-reported the unauthorised transfers to FINRA. From April 2019 SoFi upgraded its fraud identification tool, changed its customer verification logic to decline certain applicants, increased fraud-review staff and hired consultants to clear the alert backlog, according to the AWC.[1][4]
When did it happen?
- Dec 2018
SoFi opens SoFi Money to members of the public on its waitlist; the period of FINRA's findings begins.[1]
- Feb 2019
SoFi Money opens to the general public; fraud alerts surge.[1]
- Apr 2019
SoFi upgrades its fraud identification tool, changes its verification logic and adds SoFi Money to its identity theft prevention program.[1]
- Jun 2022
SoFi, a bank holding company since February 2022, stops offering SoFi Money to new customers with limited exceptions.[1]
- May 2, 2024
FINRA issues the AWC: SoFi Securities is censured and fined $1.1 million.[1][2]
What was the impact?
- Financial: About $8.6 million transferred without authorisation; about $2.5 million withdrawn; $1.1 million fine · ≈ $1.1 million[1][2]
- Customers: About 800 fraudulent SoFi Money accounts; customers of other financial institutions whose accounts were drained were reimbursed[1][2]
Severity 3 of 5: A regulatory finding with material harm: a FINRA censure and $1.1 million fine after about 800 fraudulent accounts were used to move about $8.6 million without authorisation, of which about $2.5 million was withdrawn; all injured parties were reimbursed.
How did SoFi Securities LLC (SoFi Technologies) respond?
A SoFi spokesperson said the firm was "pleased to have resolved this matter, which relates to events from 2018 to 2019." SoFi Securities consented to the findings without admitting or denying them; it had self-reported the fraudulent transfers to FINRA and reimbursed all injured parties, according to the AWC.[1][3][4]
What was the outcome, and did regulators act?
FINRA censured SoFi Securities and fined it $1.1 million for violating FINRA Rules 3310(b) and 2010 and Rule 201 of Regulation S-ID. SoFi Money had already been closed to new customers, with limited exceptions, in June 2022.[1][2]
Why was SoFi fined by FINRA in 2024?
FINRA found that SoFi Securities' largely automated approval process for SoFi Money accounts let applicants through whenever a vendor identity score met SoFi's threshold, without reading the vendor's red-flag report. Fraudsters opened about 800 accounts that way, and SoFi was censured and fined $1.1 million in May 2024.
Was any money lost in the SoFi Money fraud?
According to FINRA, about $8.6 million was moved without authorisation from customers' accounts at other institutions into fraudulent SoFi Money accounts, and about $2.5 million was withdrawn before it could be stopped. FINRA said all injured parties have been reimbursed.
Was SoFi's account-opening system AI?
FINRA did not describe it as AI. The AWC describes a vendor score, a fixed approval threshold and automatic approval when the threshold was met, which is a rules-based automated process. This record is therefore classed as automation rather than an AI system.
What did SoFi change after the fraud?
According to the AWC, from April 2019 SoFi upgraded its fraud identification tool, changed its verification logic to decline certain applicants automatically, added staff and consultants to review fraud alerts, reviewed thousands of high-risk accounts and self-reported to FINRA. It stopped offering SoFi Money to new customers in June 2022.
- Letter of Acceptance, Waiver, and Consent No. 2019062705801 (SoFi Securities LLC) official
- Disciplinary and Other FINRA Actions, July 2024 (SoFi Securities LLC) official
- FINRA Fines SoFi $1.1M For Customer ID, Identity Theft Oversight news
- SoFi Settles With Finra In $1.1M Penalty Over Thieves' Use Of Accounts news
When AI goes wrong at a bank, the next morning's brief says so.
when one of these regulators moves, the next morning's brief says so · six sourced stories · 7 am PT · free
plus every regulation, bank and agent page update, the morning after · leave any morning