If you think someone else has accessed your Selfwealth account, act straight away. Secure your login using the steps below and let us know, so a Customer Advocate can review your account and restrict it if needed.
Signs your account may be compromised
- You receive an email saying your password, login email, mobile number or multi-factor authentication (MFA) settings were changed, and you didn’t make the change.
- You receive a login code you didn’t request. A login code is only sent after the correct password is entered, so this usually means someone else knows your password.
- You see orders, trade confirmations, contract notes or cash movements you don’t recognise.
- Your password has stopped working and you didn’t change it.
- You entered your Selfwealth details after following a link in an email or SMS, and you’re not sure it was genuine.
- You receive a notice from CHESS or a share registry about a change you didn’t make.
- Your email account, phone or computer has been hacked, lost or stolen.
A password reset code you didn’t request is less serious. It means someone entered your email address on the login screen, not that they have your password. Don’t share the code with anyone.
What to do straight away
- Change your Selfwealth password. On the login screen, select Forgot password?, enter your email address, then enter the 6-digit code we email you. Choose a new password with at least 8 characters, including an uppercase letter, a lowercase letter, a number and a special character. Use a password you don’t use anywhere else.
- Secure your email account. Change your email password, turn on MFA for your email, and check for forwarding rules you didn’t set up. Password reset codes are sent to your email. If you haven’t set up an authenticator app or SMS passcode, your login codes are sent there too.
- Turn on MFA with an authenticator app. This is the most secure option. See What multi-factor authentication (MFA) options are available to keep my Selfwealth account secure?
- Let us know. A Customer Advocate will review your account and can restrict it while we investigate. The sooner we know, the more we can do, especially if a withdrawal has been requested.
- Check your details and activity. Look at your login email, mobile number, nominated bank account, recent orders and cash movements. Tell us about anything you don’t recognise.
- Check your device. Install any pending updates and run a security scan before you log in again.
I can’t log in. Has my account been compromised?
Most login problems are not security problems. Try these first:
- Forgotten or rejected password: select Forgot password? on the login screen and follow step 1 above.
- “Something went wrong! Please try again.”: check the email address is correct. If the wrong email is saved on the login screen, select Not you? and enter it again.
- Code not arriving, or “Invalid code. Please try again”: use the most recent code and check your spam folder. You can request a new code after 30 seconds. For authenticator codes, set your phone’s date and time to automatic.
- New or lost phone: on the authenticator screen, select Log in with a recovery code. Each code works once. If you don’t have your recovery codes, a Customer Advocate can reset your MFA once they’ve verified your identity.
- No access to your login email: see How do I update my primary email address?
- Browser or app problems: clear your browser cache and cookies, try a different browser, turn off any VPN or browser extensions, and update the Selfwealth app to the latest version.
- Wrong site: the Selfwealth Adviser Platform has its own login. Clients log in through the Selfwealth website or app.
- Account closed: accounts with no holdings, cash or trading activity can be closed after 12 months. See Why has my account or portfolio been automatically closed?
Treat it as a security problem, stop retrying and let us know if:
- your password stopped working and you didn’t change it
- your password reset code never arrives, even in spam
- your MFA method or mobile number is different from the one you set up
- you received an email about a change to your account that you didn’t make.
What we’ll do when you report it
- Review recent activity on your account.
- Where needed, place a temporary restriction on trading and withdrawals while we investigate.
- Verify your identity before we restore access or change any details. This is usually done with biometric verification: we send a secure link to your registered mobile, and you scan your photo ID and take a selfie. If that isn’t possible, we’ll arrange another way to verify you. For joint accounts, each account holder may need to be verified.
- Help you update your login email, password and MFA.
Suspicious emails, SMS messages or calls
- We will never ask for your password, your MFA or verification codes, or your recovery codes.
- We will never ask you to continue a conversation on WhatsApp or another messaging app.
- We only send a biometric verification link after you’ve been speaking with a Customer Advocate about a request. If one arrives unexpectedly, don’t open it.
- Don’t select links or open attachments in a message you’re unsure about. Go to Selfwealth by typing the address into your browser or opening the app.
- Forward suspicious emails to support@selfwealth.com.au so we can investigate.
- If you selected a link or entered your details, follow the steps under “What to do straight away”.
Report it and get more support
- ReportCyber: report cybercrime at cyber.gov.au/report
- Australian Cyber Security Hotline: 1300 CYBER1 (1300 292 371), available 24/7
- Scamwatch: report scams at scamwatch.gov.au
- IDCARE: free support if your identity has been compromised, 1800 595 160
- Your bank: contact them if your nominated bank account or cards may also be affected
- Share registries: check your holdings and contact the registry about any change you didn’t make
How to reach us
- Live chat on the Selfwealth website or app, available 24 hours a day, five days a week
- Phone: 1800 577 502, Monday to Friday, 10am to 6pm Melbourne time
- Email: support@selfwealth.com.au
Never send us your password.