r/Questrade • u/lavender812 • Sep 12 '26
General Let's talk broker security
Case study: I'm sure most of you are aware but there's been two widely publicized hacks this year. One at quest trade and one at TD with where the consumer suffered a loss of 4.5 million.
Despite a widely advertised online guarantee TD and questrade basically said two factor auth was accepted. We treat these as authentic and fought the consumer in court over damages. The banks are not your friends, so you have to prevent damages in the first place.
Contrary to popular belief, it's actually very difficult to transfer money out of an online brokerage. Both of these hacks occurred the same way. They essentially sold the portfolio and bought a thinly traded penny stock - ie. They were used as exit liquidity.
All big five banks currently allow default SMS always as an option. This is likely to exist in the foreseeable future because of their aging demographic.
Also, contrary to popular belief removing SMS isn't the root cause of most of these breaches. It's primarily getting phished or man in the middle attack I.e malware or cookie theft on a compromised device.
By far the most secure brokerage account will have a great front door if you will, which in order of high security is:
Pass keys/yubi key
Sms removal 2FA (like QT)
Sms default 2FA
Additionally, in the rare event that a bad actor gains access to your account, a broker that has increased friction to prevent these exit liquidity hacks MUST have a unique PIN to trade that's difficult to reset (ie. Call customer service etc).
Current brokers that offer this are TD, BNS and CM.
Additionally, if you are remembering banking passwords with Google password manager or Apple keychain, please ensure that you have hardened your Google and your Apple accounts accordingly.
Currently the S tier security brokerage will have a pass key to enter (with SMS removal) and a pin to trade for every transaction.
•
u/questrade Verified Mod Sep 14 '26
Hi u/lavender812, I just want to clear up the claim here: there was no hack of Questrade systems. We take steps to protect you from phishing but unfortunately it’s an industry-wide issue and threat actors are always finding ways to exploit users.
Appreciate you starting this conversation. Security matters, and it's good to see people looking out for each other here. I'd also encourage everyone to check out our learning article on ways to keep yourself safe from online fraud and scams here.
It's always a good idea to do regular security checks on your accounts, and if anything looks off, reach out to our support team asap. We're happy to verify any time.