I agree with both of you that Vanguard has a responsibility to keep their customer's money secure. Vanguard holds a large chunk of my money (much more than any

I agree with both of you that Vanguard has a responsibility to keep their customer's money secure. Vanguard holds a large chunk of my money (much more than any single bank), and I'd like to know that it's secure. bpatrianakos is also right. Security has to be balanced with service. I think Vanguard's call would be okay if the security questions they ask are compartmentalized. What I mean by that is that they have separate security questions that they ask in a low-security environment (like an outgoing phone call) that they will never trust for high-security actions, such as withdrawals or password resets. Those actions should require a further level of authentication and should never be done via outgoing correspondence. We should at least confirm that the security questions aren't compartmentalized before we break out the pitchforks. However, given that Vanguard limits passwords to 10 characters with limited support for punctuation, I don't have much faith that they have any sort of compartmentalized security.