Phishing and Impersonation Scams Targeting Traders

Traders are attractive targets because they hold funds in online accounts and are used to acting quickly. Scammers exploit exactly that. Most attacks succeed not through clever hacking but through a convincing message, a rushed click and a login typed into the wrong page.

The usual disguises

Impersonation scams copy something you already trust and ask you to act. The copied thing may be your broker, a regulator, a famous investor, a support agent, or even a friend whose account was taken over.

The red flags that repeat

• Urgency: your account will be closed in an hour, a trade is about to expire, or an offer ends today.
• A request for something your broker would never ask: your password, a full authentication code, remote access to your computer, or a payment to an unfamiliar account.
• A link instead of a path: genuine firms generally accept that you can log in by typing their address yourself.
• Slight domain oddities: an extra word, a swapped letter, an unusual ending, or a subdomain that hides the real address.
• Unsolicited contact followed by a move to a private messaging app.
• Promises of fixed or very high returns.

None of these proves a message is fake on its own, but two or three together should make you stop. The best response to urgency is delay.

An illustrative case

This is an invented example showing a typical pattern. A trader receives an email titled 'Unusual login detected' with a button reading 'Secure my account'. The sender's name matches the broker, and the page the button opens has the right logo and layout. The address is the broker's name followed by a hyphen and the word 'secure' rather than the real domain. The trader enters the password and, when the page asks for the code from the authenticator app, enters that as well. Within minutes the attacker uses both to log in on the real site and request a withdrawal or change the payout details.

Two simple habits would have prevented this: opening the broker's site by typing the address or using a saved bookmark, and treating any request for a live code as suspicious, since a code protects against exactly this attack only if you never share it.

Habits that harden your accounts

Good security is mostly a set of boring defaults that work even when you are tired or distracted.

• Use a password manager and a unique, long password for every financial account.
• Turn on two-factor authentication using an authenticator app or hardware key where possible, rather than text messages, which can be diverted through SIM swapping.
• Keep a separate email address for financial accounts, with its own strong protection.
• Use withdrawal whitelists or confirmation settings if the broker offers them.
• Keep your operating system, browser and trading software updated, and avoid installing unknown remote-access tools.
• Never trade or log in on shared or public computers and untrusted Wi-Fi.

Scams that borrow a regulator's name

A common trick is to quote a real licence number belonging to a genuine firm and run a fake site with a similar name. Checking the number on the regulator's register is not enough unless the website address also matches the one listed there. Regulators publish warning lists of clone firms, and searching the domain name there can reveal a fake. Our guide to verifying a broker licence walks through that check.

If money has already moved

Speed matters. Contact your bank or payment provider at once and ask whether the transfer can be recalled or flagged. Tell the broker if the account was involved, preserve every message, screenshot and transaction ID, and report the incident to the police or national fraud service in your country. Be cautious about anyone who contacts you afterwards offering to retrieve the funds; that is usually the second stage of the same scam.