A new development in the evolving art of identity theft: scam artists can launder money by using your brokerage account to pump up stocks.

A recent wave of identity theft attacks at online-brokerage houses hit the industry during what is traditionally its slowest period, sticking firms with millions of dollars in expenses and raising security concerns for their do-it-yourself investor clients.

E*Trade Financial Corp. (ET) and TD Ameritrade Holding Corp. (AMTD) both disclosed during recent post-earnings conference calls that the latest quarter saw a pickup in the scams. For New York-based E*Trade, this meant an $18 million increase in losses due to fraud. Ameritrade, based in Omaha, Neb., booked $4 million in fraud-related expenses, which is higher than normal. The companies have fraud-protection guarantees, meaning they have to eat client losses.

The crimes have caught the attention of regulators and law enforcement officials, the companies said. Securities and Exchange Commission staffers met with online brokers this week to discuss security issues. And now the North American Securities Administrators Association is warning investors about the attacks, giving them tips on how to protect their brokerage accounts.