Account Security

Every risk this academy has covered is capped by something — stops, sizing, margins, circuit breakers. Account compromise is the exception: an attacker with your credentials can generate losses limited only by your account's buying power, through trades designed to transfer value, not make it (the classic pattern: your account buys worthless illiquid options at absurd prices from the attacker's account — your Market Structure school's thin-book mechanics, weaponized; funds are also often protected by withdrawal-to-registered-bank rules, which is exactly why attackers steal through trades instead of transfers). The defense is unglamorous, nearly free, and one hour long.

The real attack paths — in order of actual frequency: (1) Phishing — a message impersonating your broker ("margin shortfall! verify immediately") links to a pixel-perfect fake login page; you type your credentials into the attacker's form. No hacking occurred; you were asked, urgently, and urgency is the tell — legitimate brokers don't demand credentials through links (this is the Behavioural Finance school's System 1 hijack, run by professionals: fear + deadline = clicked). (2) Credential reuse — your trading password matches some shopping site's; that site leaks; automated scripts try the combination everywhere. You were breached by proxy. (3) Third-party credential sharing — the "algo service" or "account handler" that asked for your login (Chapter 10 flagged it; here's the naming: anyone asking for your credentials is asking to become you, with your money and your legal liability — SEBI's framework exists partly because this pattern kept emptying accounts). (4) Device compromise — malware, shady APKs, and the operational sloppiness of trading from shared or rooted devices.

The one-hour hardening — six moves, ranked by return: (1) TOTP two-factor authentication — decode: 2FA means login requires a second proof beyond the password; TOTP (time-based one-time password — the six-digit code from an authenticator app, regenerating every 30 seconds) is the strong version, and Indian brokers support it directly. Prefer it over SMS codes (SIM-swap attacks — an attacker socially engineers your telecom into porting your number — defeat SMS but not app-based TOTP). This single move defeats the majority of credential theft even after your password leaks. (2) A unique, long password for the broker + a password manager — kills the credential-reuse path outright; the manager makes unique-everywhere practical instead of heroic. (3) The zero-sharing rule, absolute — no credentials to any service, person, or platform, ever; official APIs (Chapter 10) exist precisely so authorized software access never requires your login. (4) The bookmark habit — never log in through links from messages or search ads (fake broker ads on search engines are a real, recurring pattern); always through your own saved bookmark or the official app. This one habit makes phishing structurally irrelevant to you. (5) Notification tripwires — enable every login/order/trade alert your broker offers, routed to the clean channel from Chapter 6: compromise detected in minutes instead of at month-end. (6) Device hygiene minimum — broker apps from official stores only, OS updates current, no trading from rooted/shared devices, and your email account (the recovery path to everything else) hardened with the same TOTP standard — the email is the master key most people leave under the mat.

If compromise happens — the pre-written response: freeze first (brokers have kill procedures — call-and-trade line from Chapter 2's drill doubles as your emergency number), change credentials from a clean device, review orders and raise disputes immediately (exchanges and brokers have complaint timelines where speed matters), then report (broker in writing, cybercrime portal). Write these four steps into the same QbarTrade standing note as your outage playbook — same principle from the same school: response plans written in calm, because you won't be calm.