Hacker News Reader

Comment by petilon | Hacker News Reader

If you're considering using E-Trade you may want to consider that E-Trade does not take responsibility if they are hacked. They group cybersecurity events and software malfunction under "Force Majeure" events ("acts of God"). That means if your retirement savings vanish because they are hacked you're out of luck. See https://content.etrade.com/etrade/estation/pdf/10118customer...

Fidelity and Vanguard don't have such clauses. Hope Morgan Stanley fixes this.

View on HN

Do you believe the usual insurance programmes will not help in the event of a hack?

https://us.etrade.com/l/f/asset-protection

Basically everyone has $500k insured in their trading account. Are you concerned about people with more than that, or concerned that it wouldn't cover hacking?

FDIC payouts are extremely rare. As far as I know, it only kicks in if the entire bank fails. I don’t think it covers fraud.

Having said that, I’d be surprised if E Trade were not legally required to cover losses in the event of account break ins, regardless of what their customer agreement says.

It would not be absurd for normal people to have > $500k in their retirement accounts, especially if they are close to retirement.

I am guessing you mean 500k cash. Regardless, I'm not sure if your point holds. If I have $1m in stocks, and my account is hacked, the stocks are sold, and the money funneled out, am I protected?

It says: "Force Majeure Event" shall mean any act beyond E*TRADE’s control.

I'm sure you could pay a lawyer enough to argue that their own site security is under their control.

How can this be legal? Surely they have a duty of care to their customers.

It's an interesting and unsettled area of the law. It gets even more interesting when the perpetrator behind the cybersecurity incident is a state because, some have argued, it constitutes an "act of war" which has long been considered covered by a force majeure. Though FWIW I think eTrade's stance is here is very aggressive and I'm surprised it hasn't caught the attention of regulators yet. If financial institutions can be allowed to disclaim any and all responsibility for cybersecurity then our whole system will be in serious trouble.

Reply on news.ycombinator.com