If you have an investor reach out because they recently had their email compromised, identity stolen, or your firm thinks there may be some suspicious activity, then follow the steps below.
Step 1: Remove the Primary Contact from ALL investing Accounts
Go to the Contacts section > Click on the Contact in question. On the right side of the screen, you will see a section called "Accounts". Click into each Account by clicking on the Account Name.
Step 2: Remove the Primary Contact
Click on the Edit icon, next to the Primary Contact.
Step 3: Replace the Primary Contact with None ( No Primary Contact).
Note: If you have a lot of investors, simply start typing "None" into the text box, and the drop-down will filter to help find this "contact".
This step removes the contact and removes the association with the compromised Contact and this investing Account. The investing Account is where the banking information is stored. Which means, the compromised Contact can no longer access this investing Account; they can't add a different bank account to receive funds.
Additionally, there will be a pop-up that will mention that you will lose the bank account on file. This is ideal, since you may not know if the bank account on file has been edited by the bad actor that compromised the investor's login.
Note: You will not want to "Maintain linked bank account" since it may have been compromised as well. Leave the checkbox unchecked and hit Save Changes. This will remove the bank account and the potentially compromised Contact.
Once the Contact has been unlinked from the Account, they no longer have access to the investing Account. Ultimately, will not be able to edit the banking details where funds are distributed.
Here is a view from our compromised Contact's view on the investor portal. As you can see, there are no linked Accounts.
Next Steps:
Sponsor Steps
To prevent the investor's login account from being compromised again, we would advise starting over with a new contact and deleting the old one.
Investor Steps
To help prevent the investor account from being compromised again, we would advise having the investor set up 2FA