Clarytrade research
Broker account security: what a withdrawal actually needs
If somebody has your password, what stops them taking your money out? We read the answer on 22 brokers' own help centres and client agreements. 12 of them put something on the withdrawal request itself. 10 protect the login, or document nothing at all.
Two-factor authentication is the phrase every broker uses. It hides a distinction that matters more than the phrase: does the second factor guard the login, or does it guard the withdrawal? A code at login stops a stranger getting in. It does nothing once they are in, and nothing at all if they arrive through a password reset or a copied session. A code on the withdrawal request itself is the control that survives a stolen password.
We asked seven questions of each broker's own material and recorded only what it says. Where a help centre is silent, the row says “not documented” rather than guessing. Where an unfavourable finding could be a researcher missing a regional page, a second researcher was told to refute it; the ones that survived are marked. Most came back narrowed to one entity or one product. Three were partly overturned by the broker's own app rather than its help centre. That is why this page is entity-scoped and product-scoped throughout, and why “documented” means the help centre unless a row says otherwise.
The short version: at Blueberry Markets, Exness, Fusion Markets, FXTM, LiteFinance, PU Prime, RoboForex, StarTrader, Tickmill, Vantage Markets, VT Markets, a rotating code is required on the withdrawal request, at least once the client has switched it on. At Axi, Capital.com, eToro, FP Markets, IC Markets, IG, ThinkMarkets, XM, XTB, the broker's own documentation covers the login and says nothing about the withdrawal. Axi and XTB make the second factor compulsory and still leave the withdrawal itself undocumented.
Key numbers
The September 2026 snapshot (last read 9 Sept 2026)
Computed from the records below. Counts describe what each broker documents, not what a funded account was tested to do.
22
brokers read on their own sites
11
require a rotating code on the withdrawal itself
9
protect the login and document nothing at withdrawal
1
document neither the scope of 2FA nor a withdrawal step
4
make two-factor authentication compulsory
6
lock withdrawals after a password or contact change
The table
Broker by broker, strongest documented control first
One row per broker. The gate column is what their own material puts between a logged-in session and a payout. Click a broker for its scan page; the source link opens the page the quote was read on.
| Broker | 2FA | On the withdrawal | What a withdrawal needs, per their docs | After a credential change | Read |
|---|---|---|---|---|---|
| Blueberry Markets Authenticator app only · Backup codes | Optional | Second factor | A one-time password on the withdrawal request, delivery method chosen at the time; the MFA FAQ says MFA secures logins and critical actions. | None documented | single read 7 Sept 2026 source |
| Exness Email code (default) · SMS · Authenticator app · Exness Trade push · Passkey | Mandatory | Second factor | Confirmation with the account's active security type on every withdrawal; password recovery is gated by the same factor. | Withdrawals disabled for 24 hours after a security-type change by face scan; up to 24 hours after other security-type changes. | single read 4 Sept 2026 source |
| Fusion Markets Authenticator app · SMS (some regions) | Mandatory | Second factor | A 2FA code on every withdrawal; crypto withdrawals need email confirmation as well. | None documented | single read 5 Sept 2026 source |
| FXTM Authenticator app (in the FXTM app's settings) · Passkey · Emailed one-time code at login · Static 5-digit security code (withdrawals) | Optional | Second factor | With the app's multi-factor setting on, an authenticator code on withdrawal, in FXTM's own words 'adds extra protection only when you withdraw'; otherwise the static 5-digit security code, 'you may be asked'. A first withdrawal to a new crypto address also needs wallet binding and a phone call from FXTM. Second read: The help centre has no two-factor article at all, but FXTM's own trading app at trade.fxtm.com ships an optional multi-factor setting (authenticator app or passkey) whose own description scopes it to withdrawals, plus a mandatory four-digit code emailed at login. All of it was read from the app's published interface strings; none of it is documented outside the app, and we could not confirm every client sees the toggle without logging in. | 4 hours after a password or security-code change. | second read 4 Sept 2026 source |
| LiteFinance Authenticator app · SMS · Email (any combination) | Optional | Second factor | An SMS confirmation code to the verified phone number, described in LiteFinance's own security guide and Vietnamese FAQ; the English FAQ describes 2FA for login only. Second read: The withdrawal SMS code appears in LiteFinance's security guide on litefinance.org, litefinance.com and liteforex.eu and in its Vietnamese FAQ, but nowhere in the English help centre. Changing the verified number requires a proof-of-ownership document and an ID selfie, which is why an email reset alone does not reach the code. | None documented | second read 4 Sept 2026 source |
| PU Prime Authenticator app · Email code · Funds password (app, internal transfers) | Optional | Second factor | An email code, then an authenticator-app code, on the documented e-wallet withdrawal flow. | T+1 day after a password change; 48 hours after an email or authenticator change. | single read 4 Sept 2026 source |
| RoboForex Authenticator app · SMS · Email code · Backup codes (sign-in only) | Optional | Second factor | A confirmation code by SMS, email or app plus the separate trading-account or wallet password; backup codes are explicitly not valid for withdrawals. | None documented | single read 4 Sept 2026 source |
| StarTrader Authenticator app · Email code · SMS OTP (app) · Passkey · Funds password | Optional | Second factor | With 2FA on, an authenticator code on every withdrawal request; crypto and e-wallet payouts require it; card and bank withdrawals without 2FA show no code step. | T+1 business day after a login-password change. | single read 7 Sept 2026 source |
| Tickmill Email code · SMS · Authenticator app · Recovery codes | Optional | Second factor | In the Client Area, two-step verification can be switched on separately for login, withdrawals and password changes; with the withdrawal toggle on, each request must be confirmed with a code. With it off, the portal warns that 2FA is not enabled for withdrawals and lets the client accept the risk. None of this is in the public FAQ, which says only that 2FA can be enabled. Second read: Tickmill's own Client Area bundle, shared by its Seychelles, Labuan, EU and UK entities, names three methods (email, SMS, authenticator app), offers a per-action toggle for login, withdrawals and password changes, trusts a device for thirty days, and shows a warning with an 'Accept the risk' button when a withdrawal is requested with the withdrawal factor off. The public site, the app-store listings and the client agreements mention 2FA in one sentence and name no method. | None documented | second read 7 Sept 2026 source |
| Vantage Markets Authenticator app · Email code (to enable, and as fallback) | Optional | Second factor | An authenticator-app code to finalise a funding-account withdrawal; enabling the authenticator is what unlocks crypto and e-wallet withdrawals. | 48 hours after an email, phone or authenticator change; 24 hours after a password change; plus T+1 / T+2 withdrawal requirements. | single read 4 Sept 2026 source |
| VT Markets Authenticator app · Email OTP · SMS OTP · Passkey / biometrics (app) · Funds password (app) | Optional | Second factor | An authenticator-app code on the withdrawal request once 2FA is bound; crypto and e-wallet withdrawals require 2FA since 21 May 2024; the app also asks for a funds password on every withdrawal. | 48 hours after a phone, email or 2FA change; 24 hours after a password change or reset. | single read 7 Sept 2026 source |
| Pepperstone Authenticator app | Optional | Email link | An 'Accept Withdrawal' email link to be actioned within one hour, or an authenticator-app code instead if 2FA is enabled. Second read: Confirmed: the email link and the authenticator code are alternatives, not layers, and the client-area password itself resets by an emailed link, so an inbox-only attacker can complete the whole flow on an account without 2FA. The limiting factor is that Pepperstone pays out only to a bank account or card already linked to the account in the client's own or joint name, so the exposure is an unauthorised payout to the client's own verified funding source, not a transfer to a third party. | None documented | second read 4 Sept 2026 source |
| Axi Authenticator app · SMS · Voice call | Mandatory | Login only | None documented: MFA is required at sign-up, login and when adding a wallet; the card-withdrawal steps show no code; a code is sent only when changing the crypto return address. Second read: Axi's help centre documents a withdrawal-time one-time password only for Local Money Transfer withdrawals in Thailand, and even there it is required once per session and skipped while the ten-hour login MFA session is still active. Every other documented withdrawal method and region shows no code beyond being logged in. | None documented | second read 5 Sept 2026 source |
| Capital.com Authenticator app · Live-selfie check (alternative) · SMS (named in a troubleshooting article) | Optional | Login only | None documented: the withdrawal how-to (Account > Payments > Withdraw) shows no code or prompt; the only other documented 2FA gate is API-key generation. Second read: All 472 help-centre articles across both of Capital.com's help sites and the UK, Australian, CySEC and Seychelles client agreements were searched: for card, bank, wire and e-wallet withdrawals, every rail available to UK, EU and Australian clients, nothing is asked at withdrawal beyond the session. The one exception is crypto withdrawals, offered only under the Bahamas entity in listed countries, where the web platform refuses to proceed until 2FA is on and then demands a six-digit code. On resets: the forgot-password flow is email-only, an enabled factor survives it and is still demanded at the next login, and removing 2FA without the code requires an image of the client holding their ID, all in Capital.com's own words. | None documented | second read 7 Sept 2026 source |
| eToro SMS code · Phone-call code · Push to a trusted device | Optional | Login only | None documented for cash: the withdrawal steps are amount, payment method, submit. The eToro Money crypto wallet is the exception, with an SMS code on every outbound send. Second read: eToro Money crypto wallet: 2FA is mandatory for the app and an SMS code is required on every outbound crypto send. Cash withdrawals from the investment account and the eToro Money currency account describe no code. | None documented | second read 5 Sept 2026 source |
| FP Markets SMS code (4-digit, shown in a 2020 tutorial video) | Optional | Login only | None documented: the withdrawal FAQ is log in, Funding > Withdraw, amount, submit; the email FP Markets sends is a notification after processing. The only explanation of 2FA anywhere on its sites is a 2020 video showing an optional SMS code at Client Portal login. Second read: 2FA is mentioned in one-line FAQ answers on the Australian, global and EU sites, always as recommended and never with a method named. The only place it is explained is a 2020 'Enabling Two-Factor authentication' tutorial video, which shows an optional four-digit SMS code at Client Portal login. Nothing on any FP Markets site describes a withdrawal-stage step. | None documented | second read 4 Sept 2026 source |
| IC Markets Authenticator app · SMS · Backup codes | Optional | Login only | The Global, Seychelles, Bahamas and EU withdrawal pages describe no code or confirmation; the Australian entity's page says every withdrawal needs a 'Confirm Withdrawal' click in an email. Second read: The Australian entity, International Capital Markets Pty Ltd, documents an email confirmation link on every withdrawal on its own withdrawal page. No IC Markets entity documents a code or 2FA prompt at withdrawal. The Australian help centre says the login code is asked for on untrusted devices and skipped once a device is trusted. | None documented | second read 4 Sept 2026 source |
| IG Authenticator app only | Optional | Login only | None documented for the UK, EU, Australian, Singapore, Swiss and international entities: the withdrawal pages describe no code or approval; destination control is same-route return plus bank-statement checks. Second read: Two exceptions on IG's own material: IG Securities (Japan) requires a separate mandatory withdrawal password on every request and offers a TOTP prompt on withdrawals; IG Crypto (UK) requires 2FA before any crypto transfer to an external wallet. Cash withdrawals elsewhere are code-free. 2FA is mandatory for the Singapore entity, optional elsewhere. | None documented | second read 5 Sept 2026 source |
| ThinkMarkets Authenticator app · SMS or WhatsApp code (crypto withdrawals, per the portal's own strings) | Optional | Login only | Fiat withdrawals: a review screen and no code, per ThinkPortal's own interface strings. Crypto withdrawals: an authenticator code if 2FA is on, otherwise a six-digit code by SMS or WhatsApp. None of it appears in the help centre. Second read: ThinkPortal's public interface strings carry a 'Verify your withdrawal' step for crypto withdrawals: a Google Authenticator code when 2FA is enabled, otherwise a six-digit one-time code by SMS or WhatsApp, unless withdrawal codes are switched off for the client's country. Fiat withdrawals, which must return to the original deposit method, have a review screen and no code. All 498 help-centre articles were searched; none describes any of this. | None documented | second read 5 Sept 2026 source |
| XM Authenticator app or email code (one at a time) | Optional | Login only | None documented: twenty-three Deposits & Withdrawals answers and the UK and Australian client agreements describe no code or confirmation at withdrawal; the only withdrawal-side protections are return-to-source and a margin-level restriction. Second read: XM publishes no step-by-step withdrawal walkthrough, so this row states what XM documents (MFA at login; no code documented at withdrawal), not an in-session test. | None documented | second read 4 Sept 2026 source |
| XTB SMS · Authenticator app · Email code (international site) · Backup codes | Mandatory | Login only | None documented once a bank account is verified: 'bank account verification is required only for the first withdrawal'; a new bank account needs a verification deposit or a bank statement, and on the UK site an SMS code. Second read: Nine regional help centres and both sets of terms describe the mandatory factor at login only, with no code on a withdrawal to a verified bank account. XTB's own Client Office web app, however, contains a switchable per-entity withdrawal SMS confirmation step; which entities have it switched on cannot be seen from outside a client session and no help centre mentions it. So a withdrawal-time code is undocumented and cannot be assumed for any given XTB entity, not proven absent. | None documented | second read 7 Sept 2026 source |
| Eightcap | None documented | Not documented | None documented: log in, choose method, enter amount, confirm, then a Finance-team review. The portal's own code adds an emailed confirmation link only for Australian-resident clients, and for China, Hong Kong, Taiwan and Macau clients withdrawing to USDT or USDC, the first time they withdraw to a new payout destination. UK, EU, Bahamas and other international clients get no second check. Second read: No two-factor authentication is documented on any Eightcap site, in any client agreement or app-store listing, and the client portal's published code wires none up; a password reset is an emailed link. The same code contains an undocumented withdrawal confirmation email, with a tokenised link or a signed declaration to the finance desk as fallback, that fires only for Australian-resident clients and for China, Hong Kong, Taiwan and Macau clients withdrawing to stablecoins, on a first withdrawal to a new payout destination. Nothing fires for anyone else. | None documented | second read 5 Sept 2026 source |
The sentences, verbatim, and the payout-destination rules
- Blueberry Markets: “Is MFA mandatory right now? Not yet. You can currently skip setup, but MFA will soon become mandatory.”Destination: A new bank profile requires a bank statement issued within three months.SMS and email codes are explicitly not supported as the factor. The withdrawal OTP's delivery options are not named, so whether an email-only attacker could pass it is not documented.
- Exness: “Confirm the withdrawal with your current security type.”Destination: Payout accounts must carry the exact legal name on the Exness account; an unverified card with no prior deposit is rejected.The default security type is email, so a client who never changed it has the reset link and the confirmation code arriving in the same inbox.
- Fusion Markets: “Once you make your first successful deposit, 2FA becomes mandatory so only you can access your account and request withdrawals.”Destination: Only to accounts matching the account holder's name; no same-method or cooling-off rule documented.2FA can be postponed at sign-up but must be set before the first withdrawal. The phone number is locked while SMS 2FA is on.
- FXTM: “Multi-factor authentication (MFA) adds an extra layer of security to your account. Once enabled, you'll need to enter a code from your authenticator app when performing certain actions in the app. Adds extra protection only when you withdraw.”Destination: Same method as the deposit for cards and crypto; one active crypto wallet address at a time.The 5-digit security code is a fixed secret, not a rotating one; it is reset by an emailed one-time code and a reset triggers the withdrawal lock.
- LiteFinance: “You'll get an SMS with a confirmation code that you will need to use to withdraw money.”Destination: Only to the wallet and currency used to deposit.
- PU Prime: “A security authenticator is a tool that provides an additional layer of protection when authorizing withdrawals from your account.”Destination: Withdrawals go to a previously used card first; a secondary method only once the card amount is used up.Authenticator reset is not self-service: ID photos and a selfie by email, one to three working days. The withdrawal email code goes to the registered inbox, so the app code is the barrier that survives a mailbox compromise.
- RoboForex: “Two-factor authentication (2FA) adds an extra layer of security during login, fund withdrawals, and internal transfers.”Destination: No same-method rule is documented in the withdrawal or payment-systems FAQ.Separate passwords for the Members Area, trading accounts and wallets. A verified phone number cannot be changed self-service.
- StarTrader: “Once activated, every login on Client Portal and withdrawal request requires both your password and a unique, time-sensitive code generated by the authenticator app on your mobile device.”Destination: Same-name and same-method rules documented.The help centre is StarTrader's own Zendesk site, linked from startrader.com. A separate funds password is named but its use is not documented.
- Tickmill: “Two-Factor Authentication (2FA) is not enabled for Withdrawals”Destination: Same method as the deposit; profits to other methods registered in the client's name; no third-party or anonymous accounts.The quoted sentence is the portal's own warning text. Read from the publicly served Client Area application, not from a logged-in session, so which toggles are on by default was not observed.
- Vantage Markets: “Even if someone else knows your password, they won't be able to withdraw funds without access to your authenticator device.”Destination: Card withdrawals only to cards already used to deposit; third-party payments prohibited.The authenticator can now be changed or disabled self-service by verifying email, face or mobile in the app, so the 48-hour lock is what stands in an attacker's way rather than the authenticator itself.
- VT Markets: “Binding 2FA to your account significantly fortifies your security. Once active, this verification step will be required for withdrawals, effectively preventing unauthorized access and ensuring your assets remain under your control.”Destination: Same name, and usually the same method as the deposit; a new bank account needs a bank statement dated within three months.A client who never bound 2FA has, after the 24-hour lock, nothing beyond the session between a password reset and a bank-transfer withdrawal.
- Pepperstone: “Approve the transaction within one hour via the email sent to you, or using a 2FA code if enabled.”Destination: Return to source only: the same bank account or card, in the same name.The 2FA code replaces the email link rather than adding to it, so with 2FA off, control of the registered inbox is enough to approve a payout.
- Axi: “You'll be asked to verify your identity during: Signup, Login, Adding a wallet.”Destination: Return to source on all methods; card withdrawals only 24 hours after a deposit on the same card; one registered crypto address at a time.Login always requires MFA and the registered number cannot be changed self-service (identity check, one to two business days), which is why an email reset alone does not defeat it.
- Capital.com: “You'll need your email and password, plus a secondary verification method to log in.”Destination: Returned to the original payment method; bank withdrawals to own-name accounts only.Login-only rests on the absence of any withdrawal-time step in the help centre and the client agreements, not on an explicit statement. Read through Capital.com's own help-centre API because the pages serve a bot challenge.
- eToro: “2FA adds an additional layer of security to access your account, by entering a verification code sent to your mobile phone via SMS or phone call.”Destination: Back to the deposit source, or to an alternative method in the client's name once eToro has approved it.eToro's help centre could not be read by any permitted route; those articles were read as search-indexed copies, while the static etoro.com pages and the UK client agreement were read first-hand.
- FP Markets: “2FA can be enabled under the Profile section of your Client Area. We strongly recommend activating it to protect your account from unauthorised access.”Destination: Same method and same account as the original deposit; no third-party withdrawals.Their sites block automated reads, so the pages were read through a text-extraction proxy.
- IC Markets: “2FA requires you to follow one extra step to verify your identity before accessing your account, providing you with an additional layer of security.”Destination: Routed back by deposit method; no third-party payments; cards must be in the account holder's name and approved by compliance.A password reset sends a temporary password by email; whether 2FA still applies afterwards is not stated.
- IG: “Is 2FA mandatory? No, but we strongly recommend it for all accounts to ensure maximum security. Will 2FA slow down my trading? No, once logged in, you can trade normally without additional authentication.”Destination: Normally returned via the same method and to the same place it came from; a different destination is at IG's discretion after verification.After a reset, the FAQ says to add the 6-digit code after the new password, so an enabled 2FA survives an email reset.
- ThinkMarkets: “We promote using 2FA – a security enhancement feature to improve your account's protection against unauthorised access.”Destination: Back to source on all methods; a changed crypto wallet or lost card needs proof, then bank wire in the same name.The 2FA article, last edited August 2023, does not say what the factor gates. The SMS one-time password on the security page verifies that a phone call is from ThinkMarkets, not logins or withdrawals.
- XM: “Unlike normal single-factor authentication, which grants account access through a username and password alone, MFA requires a one-time password (OTP).”Destination: All withdrawals go back to the source of the deposit; no third parties.If the client chose email as the second factor, the reset link and the code arrive in the same inbox.
- XTB: “2FA is mandatory and cannot be disabled. The only available option is to change your authentication method to a different one.”Destination: Only to a bank account in the client's sole name, verified at the first withdrawal and again for any new account.Trusted devices skip the login code on later logins. A client-activated Emergency Lock blocks withdrawals and is lifted only by video verification. XTB International's June 2026 service regulations still say multi-factor authentication is not mandatory, contradicting the help centre.
- Eightcap: “To use our Online Facility, you will need to use a username and password (Access Code).”Destination: Same method as the deposit.Eightcap's separate Challenges product documents an email-code 2FA, which is not the brokerage portal. Whether the login provider enforces a factor on its own hosted page could not be seen from outside a session.
Patterns
Five things the table shows
The mailbox is the single point of failure more often than the password
Pepperstone's withdrawal approval is an email link, or an authenticator code if the client has switched 2FA on; the code replaces the link rather than adding to it. XM lets a client choose email as the second factor, so the password-reset link and the login code arrive in the same inbox. Exness defaults every new account to email as its security type. PU Prime's withdrawal flow starts with an email code before the app code. In each case the app-based factor is the one that survives a compromised inbox, and in each case it is the client's choice to use it.
“Mandatory 2FA” can mean the login only
Axi and XTB force a second factor on every client and cannot be switched off. Both document it for logging in and neither documents a step on the withdrawal request. At XTB, trusted devices skip the login code on later logins. A compulsory factor is a real improvement over an optional one; it is not the same thing as a factor on the payout.
The exceptions live in one entity or one product
Most second reads narrowed a finding rather than overturning it, and always in the same way. IC Markets' Australian entity sends an email confirmation on every withdrawal; its Global, Seychelles, Bahamas and EU pages describe none. IG Japan requires a separate withdrawal password; IG's UK, EU, Australian and Singapore entities do not. eToro's crypto wallet asks for an SMS code on every send; eToro's cash withdrawal does not. Axi asks for a code on Thai bank withdrawals and nowhere else. Two went further: FXTM's trading app carries a multi-factor setting scoped to withdrawals that its help centre never mentions, and ThinkMarkets' portal verifies crypto withdrawals with a code while fiat withdrawals get none. The entity that opens your account, and the product you withdraw, are what the rules attach to, which is the same lesson as our entity decoder.
The quiet protection is the cooling-off period
6brokers lock withdrawals for a fixed time after a password, email, phone or authenticator change: Vantage and PU Prime for 24 to 48 hours, VT Markets for 24 to 48 hours, StarTrader for one business day, FXTM for four hours, Exness for 24 hours after a security-type change. A lock does not stop an attacker; it gives the real owner time to notice the change email and call the broker. Vantage's own help centre is candid that this lock, not the authenticator, is what now stands in the way, because the authenticator can be removed self-service.
The app knows things the help centre does not
Six times, the second reader found the protection in the broker's own software and nowhere in its documentation. FXTM's app carries a multi-factor setting whose own description scopes it to withdrawals; its help centre has no two-factor article at all. Tickmill's Client Area offers a per-action toggle and warns “2FA is not enabled for Withdrawals” with an accept-the-risk button; its public FAQ says only that 2FA exists. ThinkMarkets' portal verifies crypto withdrawals with a code. XTB's Client Office contains a withdrawal SMS step that individual entities can switch on. Capital.com forces 2FA on crypto withdrawals for its Bahamas entity. Eightcap's portal emails a confirmation link to Australian clients on a first withdrawal to a new destination, and to nobody else. A client who reads the help centre before funding, which is what every broker tells them to do, would not learn that any of these exist, and would not know to switch them on. Where a row says the app does more than the docs, that is what it means.
Reading it
What to do with your own account
- • Switch the second factor on before you fund, and choose the authenticator app over email or SMS wherever the broker offers it. Every “optional” row above is a broker whose protection is off until you act.
- • Find out where the factor applies. Make a small withdrawal early and see whether you are asked for a code. If you are not, the row above is your answer and your password is your balance.
- • Protect the mailbox first. At most brokers the registered email can reset the password and receive the confirmation; a unique password and app-based 2FA on the email account matter more than on the trading account.
- • Expect the destination rule to help. Return-to-source and own-name rules mean a thief usually cannot send funds to a fresh account, but they can still trade the balance away or move it to a wallet already on file.
- • If a broker's row says “not documented”, ask support in writing what a withdrawal requires and keep the reply. Silence in a help centre is a finding, not a reassurance.
Coverage
What was read once, what was read twice, and what was not read
Stated so that the table's confidence is explicit.
- • 14 of 22 rows are second reads:an independent researcher was given the first finding and told to refute it from the broker's own material. Most were narrowed, and the narrowed scope is printed in the row. Three, FXTM, ThinkMarkets and Tickmill, were partly overturned by the broker's own app or portal; those rows now say what the app does and that the help centre does not.
- • The remaining rows are single reads.Favourable findings (a code on the withdrawal) rest on the broker's own words and carry a verbatim quote. Unfavourable single reads are worded strictly as what the broker documents and are queued for a second read; any that change will be corrected in place with the date.
- • Several sites block automated reading. Those rows were read through the broker's own help-centre API, a text-extraction proxy on the same URL, or a search-indexed copy, and the row's note says which. No crawler was impersonated and no bot challenge was bypassed.
Methodology
How this table was produced
- • Seven questions per broker: is 2FA available; is it compulsory; which methods; does it apply to the withdrawal request or only the login; what does a withdrawal request itself require; can an email password reset alone defeat an enabled factor; is there a payout whitelist or a lock after credential changes.
- • Sources are the broker's own domains only: help centre, security pages, client agreements and terms, app-store listing text. No review sites, no forums, no assumptions about industry norms.
- • “Login only” is recorded when the broker's own description of 2FA covers access and no page, agreement or withdrawal walkthrough mentions a code or approval on the withdrawal. It is a statement about their documentation, not a test of a funded account.
- • The snapshot date is the most recent read in the table. The oldest reads, first in the re-check queue: Exness (4 Sept 2026), FXTM (4 Sept 2026), LiteFinance (4 Sept 2026).
- • Commission weighting: 0%. Which brokers appear and how they are graded never depends on a partner relationship. Several brokers in the “login only” and “not documented” groups are Clarytrade partners.
Limitations
What this study does not claim
- • It describes documentation, not behaviour. A broker may enforce a check its help centre never mentions, or describe one it applies only in some regions. Rows will be upgraded to tested findings as clients report them.
- • It covers the brokers in our research database, not the market. Absence means unread, nothing more.
- • Back-office review, fraud monitoring and manual holds exist at every broker and are invisible to this method. A “not documented” row is not a claim that withdrawals are unmonitored.
- • Security settings change faster than fee schedules. Quote the read date with any figure from this page. Corrections: hello@clarytrade.com, and each corrected row will carry its date.
Go deeper
The withdrawal, end to end
Share
Cite this study
Clarytrade, a broker-research database, read the account-security documentation of 22CFD brokers on the brokers' own sites. 11 require a rotating second factor on the withdrawal request itself; 9 document two-factor authentication for the login only; 1 document neither. 4 make the second factor compulsory. Snapshot: 2026-09-09. Method: clarytrade.com/methodology. Verification queries: hello@clarytrade.com.
Please link to clarytrade.com/research/broker-account-security when citing, and quote the snapshot date: security settings are re-read every quarter.
Machine-readable data: clarytrade.com/research/broker-account-security/data.json — every record with its source URL and read date, regenerated on each deploy. Free to reuse with attribution.
Risk warning. Capital at risk. Most retail CFD accounts lose money. Trade only with money you can afford to lose.