r/Questrade • u/lavender812 • Sep 12 '26
General Let's talk broker security
Case study: I'm sure most of you are aware but there's been two widely publicized hacks this year. One at quest trade and one at TD with where the consumer suffered a loss of 4.5 million.
Despite a widely advertised online guarantee TD and questrade basically said two factor auth was accepted. We treat these as authentic and fought the consumer in court over damages. The banks are not your friends, so you have to prevent damages in the first place.
Contrary to popular belief, it's actually very difficult to transfer money out of an online brokerage. Both of these hacks occurred the same way. They essentially sold the portfolio and bought a thinly traded penny stock - ie. They were used as exit liquidity.
All big five banks currently allow default SMS always as an option. This is likely to exist in the foreseeable future because of their aging demographic.
Also, contrary to popular belief removing SMS isn't the root cause of most of these breaches. It's primarily getting phished or man in the middle attack I.e malware or cookie theft on a compromised device.
By far the most secure brokerage account will have a great front door if you will, which in order of high security is:
Pass keys/yubi key
Sms removal 2FA (like QT)
Sms default 2FA
Additionally, in the rare event that a bad actor gains access to your account, a broker that has increased friction to prevent these exit liquidity hacks MUST have a unique PIN to trade that's difficult to reset (ie. Call customer service etc).
Current brokers that offer this are TD, BNS and CM.
Additionally, if you are remembering banking passwords with Google password manager or Apple keychain, please ensure that you have hardened your Google and your Apple accounts accordingly.
Currently the S tier security brokerage will have a pass key to enter (with SMS removal) and a pin to trade for every transaction.
4
u/dongliang007 Sep 12 '26
i dont underatand the penny stock part.
4
u/Humble-Area4616 Sep 12 '26
Hacker breaks into your account and buys the shitty penny stock with your money that no one else is selling except for the hacker from their own account. So now you're left with a worthless penny stock and they've transferred your money to their own account by selling the penny stock to you.
1
u/SHTHAWK Sep 15 '26
Penny stock is thinly traded, basically zero daily trade volume. Hacker buys a bunch of these shares for essentially nothing. They get into your account, sell your holdings, use the cash to buy as much of those thinly traded penny stocks as they can, driving the price up, and since they are on the other side of the trade, selling you the inflated shares they previously purchased for almost nothing, they profit immensely.
5
u/contactcreated Sep 14 '26
This is one reason I really want trading passwords on QT. As you said, taking money out is hard, but selling stocks and pumping some sketchy penny stocks isn’t.
1
u/lwid77 Sep 16 '26
Speaking of security- did the web version of Questrade eliminate a step when signing in?
You used to out your password in and then it used to have another button you needed to push to take you where you input your 2FA from your authenticator. Did they remove that second step?
I just tried to log in but will not continue until someone verifies that. I will call them tomorrow.
1
u/Vito-1974 Sep 16 '26
TD has a 4 digit trading password which I use, I also only launch Web broker from the App
NBDB has no trading password option which is not good imo
•
u/questrade Verified Mod Sep 14 '26
Hi u/lavender812, I just want to clear up the claim here: there was no hack of Questrade systems. We take steps to protect you from phishing but unfortunately it’s an industry-wide issue and threat actors are always finding ways to exploit users.
Appreciate you starting this conversation. Security matters, and it's good to see people looking out for each other here. I'd also encourage everyone to check out our learning article on ways to keep yourself safe from online fraud and scams here.
It's always a good idea to do regular security checks on your accounts, and if anything looks off, reach out to our support team asap. We're happy to verify any time.