Watch for Unauthorized Trusted Contacts or View‑Only Users on Bank and Brokerage Profiles

Criminals don’t always need your password to learn a lot about your money. On many bank and brokerage accounts, adding a “trusted contact,” “view‑only user,” or “authorized viewer” can quietly give someone insight into your balances, holdings, statements, and activity—sometimes without triggering obvious alerts. This guide explains what those roles are, how criminals exploit them, and how to check and clean up your profiles to protect your financial privacy.

What Are Trusted Contacts and View‑Only Users?

Most financial institutions offer roles beyond the primary account owner. These roles can be helpful for caregivers, spouses, accountants, or advisors—but they also create potential blind spots.

• Trusted contact (brokerage/wealth accounts): A person your firm can reach if they suspect fraud or can’t contact you. Legitimate use: a backup point of contact. Risk: some firms show limited account details to the trusted contact or allow them to confirm activity verbally.
• View‑only user / read‑only access: A login that can see balances, statements, holdings, and sometimes transactions, but cannot move money. Legitimate use: an accountant or family member who needs visibility. Risk: exposure of sensitive financial data that can be used for targeted scams or social engineering.
• Authorized user / delegated access: In banking, this can include credit card authorized users or delegates for business accounts. Permissions vary—from read‑only to limited actions like downloading statements.

Even without transfer abilities, these roles can reveal enough information for identity‑theft attempts, phishing, tax fraud, and social engineering (for example, quoting real balances or specific holdings to gain your trust).

Why These Roles Matter for Privacy and Security

• Reconnaissance for fraud: A view‑only user can study patterns and spot the best time to strike (e.g., right after a large deposit or around a rollover).
• Targeted scams: Seeing your holdings, account numbers’ last digits, or statement cycles helps criminals craft convincing messages.
• Account recovery manipulation: A trusted contact can be leveraged in social‑engineering scenarios to influence support decisions or confirm “legitimacy.”
• Tax and identity exposure: Statements often include SSN fragments, addresses, and employer plans—useful for identity theft.
• Household privacy risks: Unintended access by relatives, ex‑partners, or former advisors may linger long after the original need ends.

Common Signs Someone Added Access Without Your Knowledge

• New email alerts you don’t recognize: Notifications for “profile change,” “new user added,” or “contact updated.”
• Missing or reduced alerts: Fraudsters sometimes toggle your notification settings to keep changes quiet.
• Support interactions you didn’t initiate: Phone calls or tickets opened on your account.
• Paper statements suddenly enabled or address changes: Shifting delivery can hide activity from you.
• Unexpected brokerage compliance calls: Some firms call when a trusted contact is added; note any calls you don’t recall authorizing.

How Criminals Add Unauthorized Viewers

• Phishing and credential reuse: If your login is stolen, the intruder can add a read‑only user quietly.
• Weak email security: Attackers who control your email can confirm new-user invitations and complete setup links.
• Manipulating support: Social engineering with partial personal details (from data brokers or prior breaches) to add a “professional advisor.”
• Piggybacking on real relationships: A past accountant or advisor keeps access after you switch providers.

Where to Check in Your Bank and Brokerage Accounts

Every institution labels these settings differently. Look for sections named:

• Profile & Settings → Authorized Users, Delegated Access, Account Sharing, Account Access, Trusted Contacts, Shared Accounts
• Security → Login & Access, Linked Accounts, Third‑Party Access, Connected Apps
• Documents → Statement Delivery Recipients, Email Recipients
• Contact Details → Emergency or Trusted Contact

On brokerages, also check each individual account (taxable, IRA, 401(k) rollover, HSA brokerage windows), because permissions may be set per account rather than globally.

Step‑by‑Step: Audit and Clean Up Access

1. Secure your email first. Change your primary email account password, enable strong multi‑factor authentication (app or hardware key), and review recent logins and forwarding rules. Many access invites route through email.
2. Change your bank/brokerage password and enable MFA. Use unique passwords per institution and an authenticator app or hardware key.
3. Download your current settings. Take screenshots or export a PDF of authorized users, trusted contacts, delivery settings, and connected apps for a dated record.
4. Review trusted contacts. Confirm name, phone, and email. Remove anyone you don’t recognize or no longer want. If removal requires support, ask to “revoke any and all trusted contacts on file.”
5. Review view‑only and delegated users. Remove unfamiliar logins immediately. For familiar names, verify they still need access and limit to the minimum scope.
6. Check statement and alert recipients. Ensure statements, tax forms, and alerts only go to you. Remove extra recipients and update addresses.
7. Inspect connected apps and data feeds. Revoke third‑party connections you no longer use (e.g., budgeting apps, portfolio trackers). Reconnect only those you trust and need.
8. Turn on high‑signal alerts. Enable notifications for login from new devices/locations, profile changes, new payees, new users added, and changes to MFA or contact info.
9. Call support for an access-history review. Ask for a log of when trusted contacts or authorized users were added, by whom, and via what channel (web, phone, branch). Request they note your file to require additional verification for any future access changes.
10. Re‑issue fresh credentials to legitimate helpers. If an accountant or advisor still needs access, remove the old role and re‑invite with least‑privilege permissions and an expiration date if available.

Least‑Privilege Setup: Keep What You Need, Nothing More

• Scope: Limit access to specific accounts, not “all household accounts.”
• Visibility: Hide full account numbers where possible; allow balances only if statements aren’t required.
• Duration: Set access to expire automatically after tax season or a specific project.
• Notifications: Opt in to alerts whenever any user is added, modified, or removed.
• Verification phrase or PIN: Add a support‑only passphrase that must be quoted for access changes.

What to Do If You Find an Unauthorized User

1. Revoke immediately. Remove the user or contact, then change your password and regenerate any app passwords or API tokens.
2. Escalate to the fraud or security team. Request an investigation ticket and ask them to freeze access changes until resolved.
3. Get copies of the audit trail. Ask for timestamps, IP logs, call recordings (if applicable), and the method used to add the user.
4. Review money-movement settings. Confirm payees, wires, and ACH links haven’t been added. Lock down external transfers if possible.
5. Scan other institutions. Repeat your audit across all banks, brokerages, retirement platforms, and card issuers—attackers rarely stop at one.
6. File reports if identity misuse is suspected. Consider filing an FTC Identity Theft report and placing fraud alerts or credit freezes as needed.

How This Fits Into Broader Privacy Hygiene

• Reduce exposed personal data: Remove your information from data brokers so attackers have fewer details to impersonate you.
• Harden primary accounts: Protect the email and phone numbers tied to your financial logins; consider a separate email alias dedicated only to banks and brokerages.
• Monitor for changes: Ongoing monitoring of your financial identity can help you spot unusual activity early, including new accounts or hard inquiries that you didn’t initiate. A dedicated credit and identity monitoring tool can centralize alerts across bureaus and accounts. If you want a single place to watch credit changes and identity‑related signals, see SmartCredit for privacy, credit monitoring, and identity protection.

Frequently Asked Questions

Can a trusted contact move my money?

Typically no. A trusted contact is meant for outreach during suspected fraud or incapacity. However, policy varies. Some institutions may allow limited confirmations that can influence decisions. Treat any contact role as sensitive and verify exactly what it permits.

Will removing a view‑only user alert them?

Some systems send an automated message to the removed user; others do not. Assume they may notice. If you suspect criminal access, coordinate with your institution’s fraud team before removal so they can capture evidence.

Do joint accounts change this?

Joint owners can often add users or adjust settings. Align with your co‑owner on a least‑privilege policy and enable alerts to both owners for any access changes.

What about my advisor or accountant?

Professionals often need temporary visibility. Use the narrowest permissions, restrict to the exact accounts they service, and set automatic expiration dates. Re‑authorize annually rather than leaving perpetual access.

How often should I audit access?

At minimum: during tax season, after any life change (move, new job, divorce), and after any security alert. Quarterly is a practical cadence for most households.

Pro Tips to Prevent Silent Access Changes

• Use hardware‑based MFA where supported. It’s harder to phish or SIM‑swap.
• Add a high‑friction note to your account. Ask the institution to require in‑person or notarized verification for adding new users, when feasible.
• Segment your devices and networks. Avoid logging into financial accounts on shared or work devices. Keep browser profiles separate to reduce token hijacking risks.
• Lock down recovery options. Remove old phone numbers and backup emails; use recovery codes and store them offline.
• Name your users descriptively. If you do add a helper, label them with purpose and expiration (e.g., “CPA‑2026‑Apr‑15”) to prompt annual reviews.

Conclusion

Unauthorized trusted contacts and view‑only users are subtle but serious privacy risks. A single read‑only login can expose balances, statements, and personal details that fuel highly convincing fraud. Make access reviews part of your routine: secure your email, enable strong MFA, audit every institution for trusted contacts and delegated users, and remove anything you don’t need. Use least‑privilege rules and clear expiration dates for legitimate helpers, and maintain high‑signal alerts for any profile or access changes. The time you invest in this audit repays itself the moment a suspicious addition is blocked or quickly reversed.