Archives for December 2011

Despite the Treasury’s obvious dislike for the small investor, Series I Savings Bonds still offer a relatively good interest rate. As of January 1st, 2012, you will no longer be able to buy paper savings bonds other than a small window using your tax refund. The only option left is buying electronic savings bonds via TreasuryDirect.gov. This brings me to the following reader question:

Was just reading Mel Lindauer’s comments in the Bogleheads forum about I-Bonds and the trouble with Treasury Direct. Seems a great many folks hate the system to the point that they would rather not use it. 2012 is/was to be the year that I first began purchased I-Bonds, having finally got to the point of maxing out all other tax deferred and tax free methods. Now I am not so sure…what is your experience with TD?

First, let’s get to what I see as the main reason why most people choose not to use the online service at TreasuryDirect (TD). TD is not a bank and does not fall under Regulation E and the Electronic Fund Transfer Act that establishes consumer protections for loss or theft of money from your account.

If your paper savings bonds are stolen or lost, the Treasury has a process in place to reclaim your bonds. However, if somehow your electronic savings bonds were stolen, you would stuck with the loss with no liability from TD. It doesn’t seem to make sense, but it’s true.

So what do you do? The easiest thing to do is not use TreasuryDirect. But it remains a good investment, so in my case I looked into what security measures were in place to prevent such theft. In November 2011, TD instituted some security changes to their login process. What would a thief have to do in order to cash in your savings bonds?

1. They need your account number, which is more like Z-12345678 as opposed to johnsmith.
2. When you login with a new computer, a one-time passcode will be sent to your e-mail address. So, they would need to have access to your e-mail address as well. You can choose to register your computer for future visits if you like, but it would seem safer not to do so. I don’t log into TD very often so my cookie expires anyway by the time I log in again. This means a unique code is sent every single time I log in.
3. They would also need your account password. I would hope your e-mail password and your TreasuryDirect password are different. In any case, it’s harder for viruses or keylogger programs to record your password because you must enter it using a virtual keyboard (unless you circumvent it by disabling Javascript).
4. Now, at this point they have online access to your account and can see your balances. But to cash out a bond, first you must answer a security question (mom’s maiden name, etc.). More importantly, you can only cash out a bond to a linked bank account. So the thief would need access to your bank account (…which is protected by Regulation E mentioned above!)
5. Alternately, they would need to send in a paper form adding an alternate bank account under their control. However, the name on the bank account must match the name on the TD account, and the form requires a Medallion Signature Guarantee where a third party checks official ID for identity verification. The TD website itself has improved over the years so that any small change (bank addition, profile change) results in a e-mail notice.

Personally, I deemed it exceedingly unlikely for an actual theft to occur and made the decision to go ahead and use the website. My holdings there are significant, but under 5% of total net worth. I know that others have also had technical issues with accessing their account, but I have not experienced anything like that. In the end, TreasuryDirect definitely has its flaws, and I would not fault someone for not using it as a result. You have to weight the risks and benefits for yourself.