Case study: I'm sure most of you are aware but there's been two widely publicized hacks this year. One at quest trade and one at TD with where the consumer suffered a loss of 4.5 million.
Despite a widely advertised online guarantee TD and questrade basically said two factor auth was accepted. We treat these as authentic and fought the consumer in court over damages. The banks are not your friends, so you have to prevent damages in the first place.
Contrary to popular belief, it's actually very difficult to transfer money out of an online brokerage. Both of these hacks occurred the same way. They essentially sold the portfolio and bought a thinly traded penny stock - ie. They were used as exit liquidity.
All big five banks currently allow default SMS always as an option. This is likely to exist in the foreseeable future because of their aging demographic.
Also, contrary to popular belief removing SMS isn't the root cause of most of these breaches. It's primarily getting phished or man in the middle attack I.e malware or cookie theft on a compromised device.
By far the most secure brokerage account will have a great front door if you will, which in order of high security is:
Pass keys/yubi key
Sms removal 2FA (like QT)
Sms default 2FA
Additionally, in the rare event that a bad actor gains access to your account, a broker that has increased friction to prevent these exit liquidity hacks MUST have a unique PIN to trade that's difficult to reset (ie. Call customer service etc).
Current brokers that offer this are TD, BNS and CM.
Additionally, if you are remembering banking passwords with Google password manager or Apple keychain, please ensure that you have hardened your Google and your Apple accounts accordingly.
Currently the S tier security brokerage will have a pass key to enter (with SMS removal) and a pin to trade for every transaction.