According to FINRA, John Patterson Corey was fined $5,000 and suspended for 15 business days for impersonating a customer in two telephone calls to his former member firm.

Corey made the calls to the firm's customer service line for the purpose of assisting his customer with transferring accounts from that firm to Corey's current member firm. On the first call, Corey could not provide answers to security questions, and the agent refused to provide him with any account information. On the second call, Corey was able to provide identifying information for the customer, and he successfully requested a copy of the customer's final account statement, which the firm sent to Corey's email address.

Although the customer had authorized Corey to assist with transferring the accounts, the customer did not authorize Corey to impersonate him. The customer did not suffer any loss and did not complain.

Impersonating a customer is a serious violation even when done with the customer's knowledge and for a legitimate purpose like facilitating an account transfer. When representatives impersonate customers, they bypass security measures designed to protect customer information and accounts from unauthorized access. If Corey could impersonate the customer to obtain account statements, someone with malicious intent could use the same technique to gain access to sensitive information or authorize unauthorized transactions.

The fact that Corey succeeded on the second call by providing the customer's identifying information demonstrates that he was able to breach the firm's security protocols through impersonation. While the customer authorized the account transfer and suffered no harm, the conduct violated important security and authentication requirements.

Investors should understand that they should never provide their personal information or security credentials to their broker for use in impersonating them, even for apparently legitimate purposes. There are proper ways to authorize account transfers and access to information that don't require impersonation.