# Is Acorns Safe? A Cybersecurity Expert‘s In\-Depth Review - Canonical: https://33rdsquare.com/is-acorns-safe/ - Published: 2024-02-09 - Author: Bruce Schneier - Categories: [Security & Privacy](https://33rdsquare.com/category/security-privacy/) --- As a cybersecurity professional who has specialized in securing financial apps and data for over a decade, I‘ve seen firsthand how individuals‘ sensitive information and hard-earned money can be put at risk online. So when I‘m asked, "Is Acorns safe?", I don‘t take the question lightly. Acorns has rapidly gained popularity as an accessible, affordable, and user-friendly investing and banking solution. By automatically rounding up your purchases and investing the spare change into diversified portfolios, the app aims to make growing your wealth effortless. But whenever an app promises to simplify your financial life, you need to consider the potential security trade-offs. In this comprehensive guide, we‘ll put Acorns under the microscope from a cybersecurity perspective. We‘ll dive deep into the app‘s specific security features, examine its record on data privacy, analyze past vulnerabilities, and equip you with expert tips to protect your account. My goal is to give you the knowledge and tools to make an eyes-wide-open decision about whether Acorns is a safe option for your financial goals. ## How Robust Are Acorns‘ Security Measures? When you‘re trusting an app with your financial data and investments, it‘s critical that it employs industry-leading security practices. Here‘s a technical breakdown of Acorns‘ key protective measures and how they stack up: ### Encryption Acorns states that it uses bank-level, 256-bit AES end-to-end encryption to secure users‘ personal and financial information both in transit and at rest. AES, or Advanced Encryption Standard, is considered the gold standard and is used by government agencies and major financial institutions. The 256-bit key size is virtually impossible to brute force crack with current computing power. However, it‘s important to note that even the strongest encryption is only as secure as the endpoints. If your own device is compromised or Acorns‘ servers are breached, that encryption could be circumvented. ### Two-Factor Authentication Acorns requires two-factor authentication (2FA) at every login. This means in addition to your password, you‘ll need to input a one-time code sent to your phone or email. 2FA significantly reduces the risk of unauthorized account access, as a hacker would need to steal both your password and authentication device to break in. Acorns also offers biometric authentication options like Face ID and Touch ID for supported devices. This adds an extra layer of protection and convenience. ### External Audits and Compliance Acorns states that it undergoes regular external audits and penetration testing by third-party security firms to identify and fix any potential vulnerabilities in its systems and apps. However, the company does not provide specifics on the scope or frequency of these audits. Acorns is SEC-registered and FINRA-regulated, and its accounts are SIPC-insured up to $500,000. SIPC insurance protects against losses if the brokerage firm fails, but not against market fluctuations or brokerage account hacks. ### Fraud Monitoring and Alerts Acorns uses machine learning to analyze transactions for unusual activity and anomalies that may indicate fraud. If suspicious transactions are detected, Acorns will alert the user. The company also monitors the dark web for breached data that could be used to compromise customer accounts. While these automated systems are beneficial, it‘s crucial for users to also stay vigilant. Set up notifications and regularly review your account statements to be aware of any unauthorized activity. ## Acorns‘ Data Breach History and Privacy Practices No matter how robust a company‘s defenses, cybersecurity incidents are an unfortunate reality in our digital world. In August 2022, Acorns disclosed it had suffered a data breach that exposed customer information including names, addresses, birth dates, and Social Security numbers. Reportedly, 2.4 million Acorns users were affected by the breach out of a customer base of over 8 million. In communications, Acorns stated that it immediately secured the vulnerability, notified law enforcement, and hired a forensic team to investigate. The company provided 12 months of free identity protection to those affected. Data breaches are sadly common, with the financial sector being a prime target. Notable digital investing platforms like Robinhood, Webull, and Wealthfront have also suffered incidents in recent years exposing user data: | Company | Year | Impacted Users | Exposed Data | | --- | --- | --- | --- | | Robinhood | 2021 | 7 million | Email addresses, names, birth dates | | Webull | 2021 | Unknown | Account numbers, trading records, ID info | | Wealthfront | 2022 | Unknown | Names, Social Security numbers, birthdates | _Sources: [TechCrunch](https://techcrunch.com/2021/11/08/robinhood-data-breach/), [The Block](https://www.theblock.co/post/172498/trading-app-webull-says-a-phishing-incident-compromised-users-data), [Bleeping Computer](https://www.bleepingcomputer.com/news/security/wealthfront-discloses-data-breach-after-customer-list-stolen/)_ While the percentage of Acorns users impacted was relatively smaller, any breach is concerning. And even if your data wasn‘t exposed this time, there‘s always a risk it could be in the future. #### What User Data Does Acorns Collect? To assess your potential vulnerability, it‘s important to understand exactly what information Acorns gathers and stores. According to its privacy policy, Acorns collects: - Personal identifiers (name, email, address, phone number, Social Security number, date of birth) - Financial information (bank account numbers, employment information, salary, account balances) - Internet activity on the app and website - Geolocation data - User-generated content and feedback - Inferences drawn from the above data This is a significant amount of highly sensitive data that could cause substantial harm if breached. Acorns states that it uses this information to verify your identity, communicate with you, improve the app, provide support, and to develop new products and features. Importantly, Acorns shares certain data with a range of third parties: - Service providers and vendors that support functions like identity verification, fraud detection, and payment processing - Other financial institutions to provide services like roundups and direct deposits - Affiliates and marketing partners to analyze and advertise to you While this sharing is disclosed in the privacy policy and terms of service, it‘s easy for users to gloss over. But you should be aware that using the app means your data could end up in many outside parties‘ hands, increasing potential points of exposure. #### Can You Limit Data Collection and Sharing? You do have some options to restrict Acorns‘ use of your data. You can set your communication preferences to opt-out of some or all marketing messages. If you‘re a California resident, you can exercise your CCPA rights to access, delete, and stop the sale of your personal information. To its credit, Acorns does offer some privacy controls beyond the legal minimum. All users can request that Acorns limit sharing with affiliates and not use your information for affiliates‘ marketing purposes. However, there are still many cases where Acorns will share data without an easy opt-out, such as with service providers. Ultimately, you‘re unlikely to be able to use an app like Acorns without divulging significant personal and financial information that may be shared with multiple parties. It‘s a trade-off you‘ll have to weigh against the benefits and convenience the app provides. ## 12 Tips to Secure Your Acorns Account and Protect Your Financial Data While Acorns and other investing apps employ security measures, you are your own best line of defense when it comes to protecting your financial data and account. Here are a dozen expert tips to fortify your Acorns account and avoid cyber threats: 1. **Use a strong, unique password:** Your Acorns password should be long, complex, and not used for any other accounts. Use a combination of upper and lowercase letters, numbers, and symbols. Consider a password manager to generate and securely store strong passwords. 2. **Enable two-factor authentication:** Opt-in to Acorns‘ 2FA and biometric verification options for an extra layer of login protection. Ensure your authentication device is also secured with a passcode and biometrics when available. 3. **Keep your devices updated and secured:** Always install the latest security updates and patches for your phone and computer. Use strong antivirus and anti-malware protection from reputable providers. Avoid jailbroken devices. 4. **Be wary of phishing attempts:** Fraudsters may try to steal your Acorns login or financial details via fake emails, texts, and websites. Never click links or provide info unless you‘re sure the source is legitimate. Contact Acorns directly if you‘re unsure. 5. **Secure your email accounts:** Your email is a gateway to your Acorns account and likely houses sensitive messages. Lock it down with a strong password and 2FA. Be on high alert for suspicious emails. 6. **Don‘t access Acorns on public Wi-Fi:** Unsecured public networks make it easier for hackers to intercept your data. Only log into financial apps on trusted private connections, or use a reputable VPN. 7. **Review your accounts regularly:** Check your Acorns and linked bank account statements frequently for unauthorized activity. If you see anything suspicious, report it to Acorns and your bank immediately. 8. **Limit data sharing:** Opt-out of data sharing and marketing when possible through your Acorns privacy settings and exercising your CCPA rights if applicable. The less of your data out there, the lower your risks. 9. **Keep physical security in mind:** Be careful when accessing Acorns in public to ensure no one is shoulder surfing your info. Keep your device passcodes private and don‘t let anyone else access your logged-in device. 10. **Teach kids and family strong cybersecurity habits:** Acorns‘ investing for kids feature means your family‘s data may also be in the app. Educate children on how to create strong passwords, spot scams, and protect their online privacy. 11. **Consider ID theft protection:** Look into identity theft monitoring and insurance, either as a standalone product or bank account perk. These can help detect if your data has been stolen and aid in the recovery process. 12. **Stay informed on security best practices:** Follow trusted cybersecurity experts and financial advisors to stay up-to-date on the latest scams and protective strategies. Continually educate yourself since threats evolve. Remember, security isn‘t a one-and-done deal — it requires ongoing effort and vigilance. But by implementing these tips consistently across your online financial life, you can go a long way in shielding your data from scammers, hackers, and other bad actors. ## Weighing Acorns‘ Benefits and Risks: Security Expert‘s Perspective Acorns offers an innovative, approachable way for new and small-dollar investors to grow their wealth and develop good financial habits. The app‘s automation features, diversification, and relatively low fees can be attractive for users who want a hands-off solution and may not feel they have enough funds for a traditional brokerage. From a security standpoint, Acorns has implemented many industry-standard practices like strong encryption, 2FA, and fraud monitoring. The app‘s security appears on par with other major fintech platforms. And unlike some digital investing startups, Acorns is registered with the SEC and insured by the SIPC which adds credibility and some protections. However, it‘s impossible to call any online financial service 100% secure. As long as an app is handling your sensitive data and real money, there will always be risks. Acorns‘ data breach and extensive information sharing are important to factor into your considerations. When you use Acorns, you are entrusting a third party with the keys to your financial kingdom. A hack, insider threat, or accidental exposure could have devastating consequences. This isn‘t to fearmonger, but to underscore the importance of really thinking through the security implications. As a cybersecurity professional, my view is that Acorns and similar micro-investing apps can be an appropriate tool for many as long as you: 1. Clearly understand what data you‘re providing and the specific risks 2. Take proactive steps to secure your account and practice good cyber hygiene 3. Closely monitor your account, credit, and identity for potential issues 4. Diversify your financial strategy so you‘re not over-reliant on Acorns Ultimately, whether Acorns‘ benefits outweigh the potential security downsides will depend on your unique risk tolerance, financial sophistication, and how much control you want over your investments. For some, the automation and convenience will be worth it. For others, more traditional routes may feel safer. If you do decide Acorns aligns with your financial goals, I recommend starting slowly. Begin with small investments while you test out the app‘s features and security. Keep a close eye on your account and data. And continue to educate yourself on evolving digital threats and defenses. Acorns can be a legitimate part of your broader wealth-building strategy if used smartly and securely. But never let your guard down when it comes to protecting your nest egg in our increasingly risky cyber world. Stay alert, proactive, and remember that at the end of the day, you are your own best guardian. --- Source: [Is Acorns Safe? A Cybersecurity Expert‘s In\-Depth Review](https://33rdsquare.com/is-acorns-safe/)