Charles Schwab Corporation: 10-K Risk Factor Changes

The risk of fraud for financial institutions has significantly increased in recent years, in part because of the proliferation of new technologies and the increased sophistication and activities of organized crime and hackers, and other parties. Any of these parties may attempt to fraudulently induce employees, clients, vendors, or other third parties to disclose sensitive information that could lead to the misappropriation and use of clients’ user names, passwords or other personal information to gain access to our clients’ financial accounts. Through our clients’ accounts, fraudsters may seek to engage in unauthorized securities transactions or money movement involving, for example, wire transfers, automated clearinghouse (ACH) transactions, debit cards, and checks, as well as fraudulent or unauthorized new account openings. Such fraud may occur from the compromise of clients’ personal electronic devices, social engineering, phishing scams, or as a result of a data security breach at an unrelated company where clients’ personal information is taken and then made available to fraudsters. Any of these strategies can compromise credentials or be used to facilitate fraud. Increasing sophistication in artificial intelligence and broad public availability of such technologies, including to organizations and individuals seeking to commit fraud, has resulted in increased risk of external fraud by enhanced or novel techniques, including those involving impersonation to gain access to client accounts or convince clients to initiate fraudulent transactions. We also face risks arising from clients who intentionally engage in fraudulent or deceptive conduct. In some instances, clients may knowingly authorize or initiate transactions under false pretenses, misuse payment channels, submit fraudulent checks or ACH items, or provide misleading information to facilitate fraudulent transfers or trading activity. Schwab also faces risk of fraud by employees who misuse authorized access to critical information or systems. Such insider misconduct may involve misappropriation of Company or client assets, misuse or theft of Company or client information, insider trading, operational sabotage, circumvention of internal controls, or other actions that could harm the Company or our clients. We continue to take steps to implement new controls, strengthen capabilities in how we authenticate our clients, and enhance monitoring protocols to help prevent and detect fraud and ultimately protect our clients, but the ways that fraudulent activity is attempted are continuously evolving. Although we monitor for new types of fraud, there may be a delay in recognizing such activity. Losses reimbursed to clients under our guarantee against unauthorized account activity could have a negative impact on our business, financial condition, and results of operations. Instances of fraud might negatively impact our reputation and client confidence in the Company, in addition to any direct losses that might result from such instances.