Fraud Education and Account Security | SoFi
SoFi fraud prevention
starts here.
Report suspicious activity. Learn how we help your money stay safe and privacy stay secure.
Report suspicious activity.
Imposter scams are on the rise. But you’ve got SoFi on your side. Remember, we’ll never call you to request personal info or one-time passwords.
Concerned you’re a victim? Here’s what to do.
Contact us with concerns.
If something seems suspicious or you have security questions, call us at 855-456-7634 (opt 8) or chat with us online.
Freeze your card.
If you have any concerns, you can freeze your card in the mobile app. Unfreeze it at any time. Learn more.
SoFi security checklist.
Let’s work together to help keep you safe.
Two-factor authentication.
Add an extra layer of security in addition to your password. Choose from text, voice calls, or an authenticator app.
Settings > Security > Two-factor authentication
Time-based one-time password (TOTP).
Authenticator apps build these temporary codes as an extra security layer at login.
Settings > Security > Two-factor authentication > Authenticator app
Call verification.
Get an alert when SoFi calls you, so you know it’s legit.
Freeze card.
Temporarily freeze misplaced cards to help prevent unauthorized charges. Easily unfreeze anytime.
Banking >
Banking >
Suspicious logins.
Get alerts for new or unusual login attempts, so you can change your password or freeze your card if needed.
Monitor activity.
You can easily review your login history in the app to spot any suspicious activity.
Settings > Security > Login history
Spot possible identity theft with these red flags.
We’re helping you watch out because safety and security concerns go beyond your SoFi account.
If you see transactions you don’t recognize on any card or account, act quickly. Hackers may have your info. Contact your bank or institution right away.
‘,
title: ‘Unauthorized account activity.’
},
{
ctaIsButton: true,
ctaLink: ”,
ctaText: ”,
hasCta: true,
imgSrc: ‘https://d32ijn7u0aqfv4.cloudfront.net/wp/wp-content/uploads/raw/BR25-1818600_Fraud-Education-Hub_Listicle-2_All.webp’,
text: ‘
Credit report concerns.
If you see accounts on your credit report that you don’t recognize—or you’re unexpectedly denied credit—consider a credit freeze at Equifax, Experian, and TransUnion.
‘,
title: ‘Credit report concerns.’
},
{
ctaIsButton: true,
ctaLink: ”,
ctaText: ”,
hasCta: false,
imgSrc: ‘https://d32ijn7u0aqfv4.cloudfront.net/wp/wp-content/uploads/raw/BR25-1818600_Fraud-Education-Hub_Listicle-3_All.webp’,
text: ‘
Surprise collections notice.
If someone tries to collect on a debt or tax payment from you that you don’t owe, first be sure the collector is legit. Then work with them to figure out the source of the fraud.
‘,
title: ‘Surprise collections notice.’
},
{
ctaIsButton: true,
ctaLink: ”,
ctaText: ”,
hasCta: false,
imgSrc: ‘https://d32ijn7u0aqfv4.cloudfront.net/wp/wp-content/uploads/raw/BR25-1818600_Fraud-Education-Hub_Listicle-4_All.webp’,
text: ‘
Unauthorized access.
If a device you don’t recognize is accessing any of your accounts, consider revising your password immediately or adding extra security like two-factor authentication.
‘,
title: ‘Unauthorized access.’
}
]}
/>
Security questions and answers.
Did SoFi send this text message?
At SoFi, we understand the importance of direct and effortless communication with our valued customers. That’s why we utilize short-codes, those concise 5- or 6-digit numbers you see, to enhance your experience when receiving communications via SMS.
Depending on the type of message, you may receive a SoFi SMS from one of the following numbers (message and data rates may apply):
95178 (Fraud and Account Security)
697634 (One-Time Passcode)
63617 (Customer Service)
Your security is our priority, and we will never ask for sensitive information like passwords or account numbers via text. If you’re not sure the text message is safe—do not click on any links and please contact SoFi immediately if you notice any unauthorized activity in your account.
How is SoFi working to keep my information safe?
SoFi takes the privacy and security of its members’ financial and personal information very seriously. We maintain industry-standard administrative, technical, and physical safeguards designed to protect your information’s confidentiality and integrity. Our systems and security controls are reviewed by third parties against security standards such as SSAE18, SOC2, and PCI DSS, and rigorous third-party penetration testing is done at least annually.
If there is a suspected password compromise by a third-party service, SoFi requires you to reset your password upon your next login. You can only bypass this process one time before you will have to reset your password in order to gain access to your account.
Is biometric login like Face ID the same thing as two-factor authentication?
No. Some mobile devices offer biometric login, which uses a physical characteristic belonging only to you (like your fingerprint or your face) to log you into your phone and into specific apps that you authorize. Biometric login is a convenient and safe way to log in, but it’s still only acting as a single “factor” to access your account and can only protect you if you’re using that same device where you have enabled a biometric login.
Even if you use something like Face ID on your mobile device, it’s still important to set up a second factor as an added layer of protection. The second factor helps protect your account in case someone other than you tries to access your account, or if you want to access your account from multiple devices.
Did SoFi send this email?
SoFi takes the privacy and security of its members’ financial and personal information very seriously. We maintain industry-standard administrative, technical, and physical safeguards designed to protect your information’s confidentiality and integrity.
Depending on the type of email sent, you may receive SoFi emails from one of the following domain names:
• sofi.com
• r.sofi.com
• daily.sofi.com
• mail.sp.sofi.com
• op.sp.sofi.com
• m.sofi.org
• o.sofi.org
• notify.sofitravel.com
SoFi also uses third-party services to send emails, with domains including:
• qemailserver.com
• investordelivery.com
• proxyvote.com
• apexfintechdocuments.com
If you’re not sure the email is safe—do not click on any links and please forward the email to: [email protected] so that our team can investigate.
As a reminder, SoFi will never ask for your account password or personal information via email.
I received a 2FA code that I did not request. Is my account secure?
We keep the security of your account at top priority, this is exactly why we use two-factor authentication.
Please note, if you have any third-party sites linked to your account such as Mint/Intuit/YNAB, they can cause a two-factor message to be generated when the site attempts to sync your account information.
As a security measure, we recommend you change your password and review your account for any inconsistencies. If you notice any unauthorized activity please start a live chat with one of our agents so that we can take further steps to protect your account.
Please note you will be prompted to log in.
Can I use email for two-factor authentication (2FA)?
SoFi Members who have SMS or voice call as their primary 2FA method can choose email as a secondary option. However, email can no longer be set as the primary 2FA method on your SoFi account.
Please note:
• You will not have the option of 2FA via email if SoFi has detected a recent password change (ie. in the last 72 hours).
• This feature is available in IOS, the Android app, Web and Mobile Web.
Please see the steps below to choose email as a secondary 2FA option:
1. Log in to your SoFi account.
2. Click on ‘Send to my email.’
3. The code will be sent to the email on file.
4. Once received enter it in the ‘One-time password’ field and click ‘Verify code.’
Can I change the way I receive my verification code?
Yes! You can receive login verification codes as your two-factor authentication method through SMS, voice calls, or by using an authenticator app. To manage these options, visit your security settings in your profile, and select “Two-factor authentication” to get started.
What is an authenticator app?
Authenticator apps generate a time-based one-time password (TOTP) as a verification source. SoFi supports apps like Google Authenticator, Microsoft Authenticator, LastPass, Okta, Authy, and others, which allow our members a more-secure mechanism to protect their accounts. This option is currently only available via the online website.
What is two-factor authentication (2FA)?
Two-factor authentication (2FA) is a method for helping to keep online accounts more secure by enforcing the use of two of these types of “factors”:
1. Something you know (like your password)
2. Something you have (like your mobile phone)
3. Something you are (like your fingerprint)
Two-factor or multi-factor authentication is a common and recommended practice for protecting important accounts such as those associated with financial services.
2FA strengthens an account’s security because the second factor acts as an additional “gate.” This extra gate helps your account security by reasonably verifying that you are who you say you are after you submit your correct email address and login password.
Why am I unable to update my email address?
Member email addresses cannot be used on more than one account at a time. If you received an error message that the email you attempted to change is already in use, you can:
1. Log into the other account where the email address is used and change it to a different email address that you own.
2. If you aren’t able to log in, or are unaware of another account where the email address might be in use, please call us at 855-456-7634 so that we can assist you.
I received a text, is it really from SoFi?
SoFi uses secure SMS text-based messages, in some cases, to get direct, quick communication to our applicants and members. If you would rather not receive text messages, please log into your SoFi account and under Account Settings you can update your Communication Preferences.
You can also cancel any push notifications via text by updating your Notification Preferences page.
If you still have concerns a SoFi agent is able to confirm if a message was sent or not, feel free to contact us at (855) 456-SOFI (7634).
I am setting up 2FA, but I am not getting the text with the code.
Oh no! We’re sorry to hear this. If it’s been more than five minutes since you made the request:
1. Double-check that your correct mobile phone number or email is listed
2. Ensure that you have a stable WiFi connection or cell phone service
3. Try selecting a different 2FA method
1. Example: If you used phone 2FA, try sending the code to your email
If you still do not receive the code and are unable to log into your account, please call us at (855) 456-7634 so that we can help.
I Got a New Device and Can’t Use My Usual 2FA — Is There Another Way to Log In?
Yes, we offer Identity Verification right in the App, Website or Mobile browser! Please follow the step-by-step experience below to reset Two-Factor Authentication (2FA):
1. Login to SoFi with your email address and password.
2. Next, you’ll be prompted to select a new 2FA method: phone, email or Verify with ID instead.
3. Select Verify with ID instead, you’ll be prompted to:
1. Take a picture of your ID (front and back).
2. Take a selfie.
4. Once complete you’ll be prompted to change your 2FA method.
5. Congrats, you have successfully gained access to your account!
Does SoFi support two-factor authentication (2FA) apps?
Yes! SoFi supports Authenticator apps such as Google Authenticator, Microsoft Authenticator, LastPass, Okta, Authy and others, giving you additional security options to protect your account.
If you would like to use this option, please go to your two-factor authentication settings in your profile or web or the mobile app.
How do I update the two-factor authentication (2FA) method on my account?
This article covers how to update your 2FA method (text, email, or phone call) through the mobile app or a desktop web browser. Click on the instructions below for step-by-step information!
Mobile App Instructions –
}
expand={
}
/>
1. Click the Profile icon in the top left corner and select “Settings”
2. Click Security
3. Click Two-Factor Authentication
4. Select your preferred Two-Factor Authentication method and follow any confirmation steps to successfully update your preferred method!
Desktop Instructions –
}
expand={
}
/>
1. Log into your account at SoFi.com.
2. Click on your name in the top right corner, and select “My Profile”
3. Under “Settings”, click on “Two-Factor Authentication”
4. Select your preferred Two-Factor Authentication method and follow any confirmation steps to successfully update your preferred method!
If you do NOT receive your 2FA code within 5 minutes of making the request:
1. Double-check your selected 2FA method and contact information
2. Ensure that you have a stable WiFi connection or cell phone service
3. Try selecting a different 2FA method.
Still not receiving your code? Give us a call at 1 (855) 456-7634
Learn more about fraud prevention.
{/* Collapsible content comes first */}
{/* Sticky Container */}
expand={}
/>
Learn more about fraud prevention.
Read more
