I'm sorry this happened to you, but the compromise of a brokerage account is one of the most serious problems you can encounter. These are strange times, and these new frauds may or may not be covered by SIPC. You don't want to be the test case. The brokerage house has essentially all the information in your life, and you have no way of knowing how much was leaked. I've worked in this industry, so I'm going to tell you what I would do, and it won't be pretty.

First thing you want to do, today, before the market closes for the long holiday is secure your brokerage account. The immediate step is to contact their compliance department. Don't talk to a broker, supervisor or branch manager, you want to talk to compliance. In the conversation, it's important for you to insist that their email server or her desktop had to have been hacked. Don't let them convince you otherwise. You want them to place heightened security on your account. The best stopgap is for there to be a comment on the account with a secret password which is only exchanged by voice between you and them. They may have other tricks, anything they can do to make it hard to access your account is good.

(NOT optional) Next, you want to go to any of the big online brokerages and open a new account. When you do that, you should also file ACAT forms to transfer your account. This can all be done electronically: You have to do this because the hacker may be able to do it just as easily as you can. You have to get out of the way of trouble. You may think you love your broker, that she's done special work for you. She may even be a friend or relative. None of that matters. Someone knows the back way into your brokerage account, and you will be broke if you let your heart block the exit. If you file an ACAT online today, the process will be done by this time next week, and whatever is going on at the old broker will be behind you. remember, it's their mess but it's your money. You were one signature away from the poor house. There's no upside to loyalty.


(optional) Once you're off the phone with the brokerage, file a complaint with Nasdaq. That's a very nasty thing to do, as it will go on the public record of both the broker and the firm. They will have to appear at an arbitration proceeding and defend their security procedures. It's a big commitment for you, as you will have to appear. But someone is going to be burned and this will put the problem in the spotlight.

Next, file two police reports immediately, one for the brokerage account and one for the Amex. The police are unlikely to do anything, but the report may be important later, in case of an investigation. If you don't file the reports, you will look less innocent should the question come up later.

As for American Express, they should cancel the charge and send new cards, with new numbers for BOTH you and your wife. Don't forget to change any autopay arrangements you had with the old number.

Next, run a deep virus scan of your computer. In addition to whichever standard AV package you use, download Malwarebytes and run that. I like to download a free trial of an extra virus checker and use it just for an extra deep scan. If AVAST has a free trial, that's always a good one to use.

Next, CHANGE THE PASSWORD ON YOUR E-MAIL account. I don't think your e-mail was compromised, but don't assume anything. Use a long password, upper and lower case, numbers and special characters. It's the most important password in your life, and you don't want it to be easily guessed.

Here's where it gets time consuming. You need to go through your entire list of online ID's: Banks, credit cards, brokerage, Social Security, CreditKarma, Quickenloans, the cable company, telephone, whatever. Make a list of these first. Then change your passwords,and keep them complex. Try to do them all at once. If a site allows two factor authentication, turn it on. Finally, if the site allows you to change your userid, change that. This last bit is often overlooked, but if a criminal has your ID and password and you just change the password, you've only covered half the problem.

Next, go to your bank(s) and explain what happened. Ask that your accounts be flagged for high risk authentication.

Finally, call the three credit bureaus and freeze your credit file. This will make it impossible for anyone, including you, to apply for credit without a password, which you will lock securely in your safe deposit box.

All of this is inconvenient and difficult. The alternative is that someone out there may have enough information to clean you out.