Interactive Brokers Security: YubiKeys, Passkeys, and the Transfer Lock You Need

If you hold an account with Interactive Brokers — and quite a few Objectif Chypre readers do, often to manage their investments while living abroad — there's one security setting you should turn on today, not next week. Not because IBKR is a bad broker; quite the opposite, it's arguably one of the most solid ones out there. But a fairly nasty loophole tied to the US account transfer system has recently gotten a lot of attention. Here's what it is, why you shouldn't panic, and how to shut it down in under two minutes.

What exactly is ACATS fraud?

ACATS (Automated Customer Account Transfer Service) is a US system that lets you move a portfolio from one broker to another automatically, within a few days, with no human review required. Convenient when you're the one requesting it. Much less so when someone else is impersonating you.

Here's the documented scenario: a fraudster gathers enough personal information about you (name, address, US social security number for US citizens, etc.) to open an account in your name at some small, low-security US brokerage. If they also get hold of your Interactive Brokers account number, they can trigger an ACATS transfer that empties your IBKR portfolio into that fake account — within about three days, sometimes without any prior notification.

This is low-probability. I don't want you losing sleep over it. But it's high-impact: if it happens to you, your entire portfolio could be gone. And this type of fraud really only works against US brokerages — transfers involving non-US brokers require manual checks that would give you time to notice something's wrong.

The fix: turn on Transfer Lock

The good news is Interactive Brokers offers a specific lock for exactly this situation, and it's free and quick to activate.

Here's how:

• Click the person icon, top right of your IBKR interface

• Go to Settings

• On the right side, under Security, click Transfer Lock

• Turn it on

Once enabled, no ACATS transfer can leave your account unless you personally lift the lock first. In my view, this is probably the most underrated security setting at IBKR, and also one of the most effective.

Other good habits worth adopting

• Check your statements regularly, not once a year

• Enable transfer alerts if your broker offers them

• Guard your account number like a password — it's the missing piece a fraudster needs to request a transfer

• Be suspicious of any mail or email from a brokerage you don't use — it may mean an account has been opened in your name elsewhere

What about authentication — which method should you pick?

Interactive Brokers recently rolled out passkey support, which is great news. My personal take: go for a physical key like a YubiKey rather than standard SMS or app-based MFA. I no longer have any affiliation with Yubico, but it's currently the strongest form of authentication available — well above standard MFA. The mobile app authentication is fine if you don't have a physical key, but if you have to choose, a YubiKey is, in my opinion, the safer bet (and get a second one as a backup).

What about fake bank account transfers?

Another common worry: could someone redirect money straight into a fraudulent bank account from IBKR? In practice, this is harder to pull off than ACATS fraud, since it would require both setting up a fake bank account and hacking your IBKR login along with two-factor authentication. Honestly, I'd be far more worried about your everyday bank account being hacked at your local bank — statistically, that's a more likely risk than this one.

Key takeaways

• ACATS fraud can move an entire portfolio to a fraudulent broker within 3 days, often with no prior warning

• It almost exclusively affects US brokerages

• Enabling Transfer Lock under Settings > Security fully blocks this risk

• Choose a YubiKey (and get a second one as a backup) over standard MFA for stronger authentication

• Fraudulent bank transfers are harder to execute than ACATS fraud

FAQ

Is Transfer Lock free on Interactive Brokers? Yes, it's a free security feature — though it's worth double-checking in your account interface, as IBKR may update its menus over time.

If I enable Transfer Lock, can I still transfer my account later? Yes, you simply disable the lock temporarily before initiating a voluntary transfer.

Do passkeys and YubiKeys fully replace passwords? This depends on the configuration you choose — check directly in your IBKR security settings.

Does this risk apply to IBKR accounts opened outside the US? ACATS fraud mainly targets transfers between US brokerages. If your IBKR account was opened from Cyprus or elsewhere in Europe, the risk is lower but worth confirming based on your specific IBKR entity.

Should I be worried if I already have an IBKR account? No need to panic, but enable Transfer Lock today — it takes two minutes.

Conclusion

Interactive Brokers remains, in my view, one of the most solid brokers for managing investments while living abroad. This ACATS story isn't a reason to leave the platform — it's simply a systemic loophole worth closing once and for all. Two minutes today to potentially save yourself months of hassle if you ever cross paths with the wrong person at the wrong time seems like a fairly easy trade-off.

Don't have an Interactive Brokers (IBKR) account yet? Read my article here: IBKR

Got questions about managing your investments from Cyprus or about relocating to the island? The Objectif Chypre team is here to help.

Objectif Chypre

© 2026. All rights reserved.

Terms and conditions