Thanks for this. That is a great top about using your password manager to fill in entries. I try to never click on links in emails or texts as a first line of defense and call or go to the web page directly to see if the request is valid. At work, they send monthly fake phishing emails to keep awareness high and they let you know if you were fooled. It is good reinforcement.
On August 13 someone placed a massive, margin-funded market buy order of a crypto alt coin in my Robinhood account. The purchase represented 25% of my account value.
Robinhood’s internal fraud review process did not detect foreign logins, hence they did not classify the transaction as a fraud event (which covers transactions Robinhood considers “fraudulent or erroneous”). Their formal conclusion employs standardized language: the review “confirmed there was no unauthorized activity.”
My whereabouts at the time the trade was placed are well documented, and my prompt report of the incident an hour later (before any material price change had occurred) likewise indicate that I didn’t authorize the trade.
Robinhood says there was no additional step-up verification required because the device was trusted and the IP location aligns with my location. They did flag a VPN connection that could have been used to disguise a hacker’s identity and location. I flagged a suspicious login 4 hours after the trade was executed, with an IP address location more than 300 miles from me.
In my view, and consistent with regulatory guidance, Robinhood’s front-end security failure is responsible for the mess we are now in, including post-event forensic evidentiary uncertainty. It’s in the nature of sophisticated fraud that it’s not easy to detect.
FINRA and other guidance does not require that an extraordinary transaction — one that is radically inconsistent with the account holder’s trading activity, portfolio composition (100% non-crypto in my case), typical order sizes/types, selective use of leverage, etc — trigger a step-up verification before the order can be executed. This appears to be a policy gap in need of addressing.
I can’t say why someone would purchase a boatload of crypto in another’s account. Was there a planned follow-up attack or thwarted withdrawal attempt? Was this a form of market manipulation? Hacker showing off or flexing their skills?
I do not know. But perhaps this case study is useful for your reference.
It's a good thing you caught the hack early and prevented any potential draining of your account. In terms of illiquidity, an altcoin is just like the 0DTE BYND options that drained Ms. Yeung's brokerage account, and this could've ended much worse if you hadn't taken action early.
It's clear that regulations have not kept up with the sophistication and advancement of hacking and that regulators need to catch up. It's hard to say exactly what the hacker was planning but whatever it was, it definitely wasn't good.
Asking for 2FA on seeing odd trading behavior is an excellent idea. One might even allow users a degree of customization on what should trigger 2FA.
IBKR has a huge incentive to not have its customers fleeced. The commission earned would be irrelevant to such a well run firm. Their only concern would be to not inconvenience legitimate customer trading.
IIRC you used to have to explicitly enable options trading on many brokerage accounts. Maybe that horse has left the barn but it seems like a reasonable thing to do or vendor default.
It CAN happen to you, no matter how careful you are.
Yesterday I got an "invitation" from "Paperless Post." It was someone I knew, and It WAS plausible that he'd invite me to something.
Nonetheless, it was a scam. He said it got him, too. I should have alerted when it asked me to log in to gmail, and I was already logged in.
When you hover over a link, the browser will show where it's going, at the bottom. This would have saved John Podesta from exposing all of Hillary's emails.
If I could give 1,000 likes from a single account, I would. This is an incredibly useful article. The way the attackers extracted the money was particularly surprising - very sophisticated.
And I couldn’t agree more with the article’s main takeaway: use passkeys. God, I couldn’t agree more. So far, it feels like nothing more secure than passkeys has been invented. Please, use this technology!
Good PSA, thanks. As you point out, a password manager will not autofill if the URL is wrong, and will warn you if you're trying to paste credentials into the wrong site, which would have saved the victim in this case. What a sucky sucky thing to have happen to you, I would scream and cry if it did to me.
The hack was truly horrible, and everyone needs to know about it to ensure it doesn't happen to them.
While it's true that password managers won't autofill on the phishing site, the catch is that password managers generally do not show an explicit warning if credentials are manually copied and pasted into a phishing page, so the safeguard only works if people stop when autofill fails.
If autofill does not appear, we recommend closing the page and reaching the brokerage through a saved bookmark or accessing through the mobile app instead.
I'm not sure about the mobile app suggestion. It solves the phishing issue, but it introduces the risk of your phone getting stolen, maybe at gunpoint, maybe unlocked, and thieves just opening the app & trading or transferring right there.
What's even more dangerous, a lot of places, even banks and brokers, allow you to recover your password using 2fa. And guess what, it's absolutely easy to get someone to give "some numbers from a message" to a stranger, rather than their password.
"Follow the money: This is not a technical limitation. Brokers make way more money from trading in options than stocks and ETFs, whether they charge payment for order flow (PFOF) or commissions."
This article should be mandatory reading for everyone! Very well written. 2FA is more useless than I thought.
Thanks for this. That is a great top about using your password manager to fill in entries. I try to never click on links in emails or texts as a first line of defense and call or go to the web page directly to see if the request is valid. At work, they send monthly fake phishing emails to keep awareness high and they let you know if you were fooled. It is good reinforcement.
On August 13 someone placed a massive, margin-funded market buy order of a crypto alt coin in my Robinhood account. The purchase represented 25% of my account value.
Robinhood’s internal fraud review process did not detect foreign logins, hence they did not classify the transaction as a fraud event (which covers transactions Robinhood considers “fraudulent or erroneous”). Their formal conclusion employs standardized language: the review “confirmed there was no unauthorized activity.”
My whereabouts at the time the trade was placed are well documented, and my prompt report of the incident an hour later (before any material price change had occurred) likewise indicate that I didn’t authorize the trade.
Robinhood says there was no additional step-up verification required because the device was trusted and the IP location aligns with my location. They did flag a VPN connection that could have been used to disguise a hacker’s identity and location. I flagged a suspicious login 4 hours after the trade was executed, with an IP address location more than 300 miles from me.
In my view, and consistent with regulatory guidance, Robinhood’s front-end security failure is responsible for the mess we are now in, including post-event forensic evidentiary uncertainty. It’s in the nature of sophisticated fraud that it’s not easy to detect.
FINRA and other guidance does not require that an extraordinary transaction — one that is radically inconsistent with the account holder’s trading activity, portfolio composition (100% non-crypto in my case), typical order sizes/types, selective use of leverage, etc — trigger a step-up verification before the order can be executed. This appears to be a policy gap in need of addressing.
I can’t say why someone would purchase a boatload of crypto in another’s account. Was there a planned follow-up attack or thwarted withdrawal attempt? Was this a form of market manipulation? Hacker showing off or flexing their skills?
I do not know. But perhaps this case study is useful for your reference.
Thanks for the excellent discussion.
Thank you for sharing your experience.
It's a good thing you caught the hack early and prevented any potential draining of your account. In terms of illiquidity, an altcoin is just like the 0DTE BYND options that drained Ms. Yeung's brokerage account, and this could've ended much worse if you hadn't taken action early.
It's clear that regulations have not kept up with the sophistication and advancement of hacking and that regulators need to catch up. It's hard to say exactly what the hacker was planning but whatever it was, it definitely wasn't good.
Asking for 2FA on seeing odd trading behavior is an excellent idea. One might even allow users a degree of customization on what should trigger 2FA.
IBKR has a huge incentive to not have its customers fleeced. The commission earned would be irrelevant to such a well run firm. Their only concern would be to not inconvenience legitimate customer trading.
Hopefully, you e shared this idea with them.
IIRC you used to have to explicitly enable options trading on many brokerage accounts. Maybe that horse has left the barn but it seems like a reasonable thing to do or vendor default.
the number of major financial institutions that make passkeys easy to setup, understand, and use, has been zero in my ~half dozen accounts.
any that use them have so far provided no explanation of the entire 2fa options and process required.
It CAN happen to you, no matter how careful you are.
Yesterday I got an "invitation" from "Paperless Post." It was someone I knew, and It WAS plausible that he'd invite me to something.
Nonetheless, it was a scam. He said it got him, too. I should have alerted when it asked me to log in to gmail, and I was already logged in.
When you hover over a link, the browser will show where it's going, at the bottom. This would have saved John Podesta from exposing all of Hillary's emails.
Never, ever click on a login link sent to you via text or email. Go to the website yourself. That also would have stopped this.
Exactly. 2FA has also become meaningless for protecting against phishing.
Yes
If I could give 1,000 likes from a single account, I would. This is an incredibly useful article. The way the attackers extracted the money was particularly surprising - very sophisticated.
And I couldn’t agree more with the article’s main takeaway: use passkeys. God, I couldn’t agree more. So far, it feels like nothing more secure than passkeys has been invented. Please, use this technology!
Good PSA, thanks. As you point out, a password manager will not autofill if the URL is wrong, and will warn you if you're trying to paste credentials into the wrong site, which would have saved the victim in this case. What a sucky sucky thing to have happen to you, I would scream and cry if it did to me.
The hack was truly horrible, and everyone needs to know about it to ensure it doesn't happen to them.
While it's true that password managers won't autofill on the phishing site, the catch is that password managers generally do not show an explicit warning if credentials are manually copied and pasted into a phishing page, so the safeguard only works if people stop when autofill fails.
If autofill does not appear, we recommend closing the page and reaching the brokerage through a saved bookmark or accessing through the mobile app instead.
I'm not sure about the mobile app suggestion. It solves the phishing issue, but it introduces the risk of your phone getting stolen, maybe at gunpoint, maybe unlocked, and thieves just opening the app & trading or transferring right there.
AKA the $5 wrench attack https://xkcd.com/538/
What's even more dangerous, a lot of places, even banks and brokers, allow you to recover your password using 2fa. And guess what, it's absolutely easy to get someone to give "some numbers from a message" to a stranger, rather than their password.
Many of the largest US brokers still not using passkeys...why?
really getting ridiculous - with AI everything will be unsafe and no one seems to care
Looks like a perfect place to deploy AI - why don't they?
You're exactly right. Quote from article:
"Follow the money: This is not a technical limitation. Brokers make way more money from trading in options than stocks and ETFs, whether they charge payment for order flow (PFOF) or commissions."