{ "source": "Clarytrade broker account-security dataset", "publisher": "https://clarytrade.com", "humanReadable": "https://clarytrade.com/research/broker-account-security", "license": "Free to cite and reuse with attribution to Clarytrade (clarytrade.com).", "disclaimer": "What each broker's own documentation said a withdrawal requires on the date read; documentation changes, so re-read before relying on a row. Informational only; not financial or security advice.", "stats": { "brokers": 22, "secondRead": 14, "asOf": "2026-09-09", "twoFactor": { "mandatory": 4, "optional": 17, "not-documented": 1 }, "gate": { "second-factor": 11, "email-link": 1, "static-code": 0, "login-only": 9, "not-documented": 1 }, "somethingAtWithdrawal": 12, "nothingDocumentedAtWithdrawal": 10, "withCoolOff": 6, "notRead": 0 }, "records": [ { "brokerName": "Exness", "brokerSlug": "exness", "twoFactor": "mandatory", "methods": [ "Email code (default)", "SMS", "Authenticator app", "Exness Trade push", "Passkey" ], "gate": "second-factor", "withdrawalStep": "Confirmation with the account's active security type on every withdrawal; password recovery is gated by the same factor.", "coolOff": "Withdrawals disabled for 24 hours after a security-type change by face scan; up to 24 hours after other security-type changes.", "resetBypass": "no", "destination": "Payout accounts must carry the exact legal name on the Exness account; an unverified card with no prior deposit is rejected.", "verbatim": "Confirm the withdrawal with your current security type.", "sourceUrl": "https://get.exness.help/hc/en-us/articles/16380545437724-How-to-withdraw-from-a-trading-account", "dateRead": "2026-09-04", "readStatus": "single-read", "note": "The default security type is email, so a client who never changed it has the reset link and the confirmation code arriving in the same inbox." }, { "brokerName": "RoboForex", "brokerSlug": "roboforex", "twoFactor": "optional", "methods": [ "Authenticator app", "SMS", "Email code", "Backup codes (sign-in only)" ], "gate": "second-factor", "withdrawalStep": "A confirmation code by SMS, email or app plus the separate trading-account or wallet password; backup codes are explicitly not valid for withdrawals.", "coolOff": null, "resetBypass": "no", "destination": "No same-method rule is documented in the withdrawal or payment-systems FAQ.", "verbatim": "Two-factor authentication (2FA) adds an extra layer of security during login, fund withdrawals, and internal transfers.", "sourceUrl": "https://roboforex.com/about/client/2-step-authentication/", "dateRead": "2026-09-04", "readStatus": "single-read", "note": "Separate passwords for the Members Area, trading accounts and wallets. A verified phone number cannot be changed self-service." }, { "brokerName": "Vantage Markets", "brokerSlug": "vantage-markets", "twoFactor": "optional", "methods": [ "Authenticator app", "Email code (to enable, and as fallback)" ], "gate": "second-factor", "withdrawalStep": "An authenticator-app code to finalise a funding-account withdrawal; enabling the authenticator is what unlocks crypto and e-wallet withdrawals.", "coolOff": "48 hours after an email, phone or authenticator change; 24 hours after a password change; plus T+1 / T+2 withdrawal requirements.", "resetBypass": "no", "destination": "Card withdrawals only to cards already used to deposit; third-party payments prohibited.", "verbatim": "Even if someone else knows your password, they won't be able to withdraw funds without access to your authenticator device.", "sourceUrl": "https://global.vantagehelpcenter.com/hc/en-us/articles/11150678368911-What-is-a-security-authenticator-device-and-why-is-it-important-for-withdrawals", "dateRead": "2026-09-04", "readStatus": "single-read", "note": "The authenticator can now be changed or disabled self-service by verifying email, face or mobile in the app, so the 48-hour lock is what stands in an attacker's way rather than the authenticator itself." }, { "brokerName": "PU Prime", "brokerSlug": "puprime", "twoFactor": "optional", "methods": [ "Authenticator app", "Email code", "Funds password (app, internal transfers)" ], "gate": "second-factor", "withdrawalStep": "An email code, then an authenticator-app code, on the documented e-wallet withdrawal flow.", "coolOff": "T+1 day after a password change; 48 hours after an email or authenticator change.", "resetBypass": "no", "destination": "Withdrawals go to a previously used card first; a secondary method only once the card amount is used up.", "verbatim": "A security authenticator is a tool that provides an additional layer of protection when authorizing withdrawals from your account.", "sourceUrl": "https://helpcenter.puprime.com/hc/en-001/articles/12901031905039-What-is-a-security-authenticator-used-for", "dateRead": "2026-09-04", "readStatus": "single-read", "note": "Authenticator reset is not self-service: ID photos and a selfie by email, one to three working days. The withdrawal email code goes to the registered inbox, so the app code is the barrier that survives a mailbox compromise." }, { "brokerName": "VT Markets", "brokerSlug": "vt-markets", "twoFactor": "optional", "methods": [ "Authenticator app", "Email OTP", "SMS OTP", "Passkey / biometrics (app)", "Funds password (app)" ], "gate": "second-factor", "withdrawalStep": "An authenticator-app code on the withdrawal request once 2FA is bound; crypto and e-wallet withdrawals require 2FA since 21 May 2024; the app also asks for a funds password on every withdrawal.", "coolOff": "48 hours after a phone, email or 2FA change; 24 hours after a password change or reset.", "resetBypass": "no", "destination": "Same name, and usually the same method as the deposit; a new bank account needs a bank statement dated within three months.", "verbatim": "Binding 2FA to your account significantly fortifies your security. Once active, this verification step will be required for withdrawals, effectively preventing unauthorized access and ensuring your assets remain under your control.", "sourceUrl": "https://get.vtmarkets.help/hc/en-us/articles/57181946904601-What-is-2FA-and-why-do-I-need-to-enable-it", "dateRead": "2026-09-07", "readStatus": "single-read", "note": "A client who never bound 2FA has, after the 24-hour lock, nothing beyond the session between a password reset and a bank-transfer withdrawal." }, { "brokerName": "StarTrader", "brokerSlug": "startrader", "twoFactor": "optional", "methods": [ "Authenticator app", "Email code", "SMS OTP (app)", "Passkey", "Funds password" ], "gate": "second-factor", "withdrawalStep": "With 2FA on, an authenticator code on every withdrawal request; crypto and e-wallet payouts require it; card and bank withdrawals without 2FA show no code step.", "coolOff": "T+1 business day after a login-password change.", "resetBypass": "no", "destination": "Same-name and same-method rules documented.", "verbatim": "Once activated, every login on Client Portal and withdrawal request requires both your password and a unique, time-sensitive code generated by the authenticator app on your mobile device.", "sourceUrl": "https://www.starhelpcenter.com/hc/en-us/articles/13257492640783-How-can-I-set-up-and-manage-2FA", "dateRead": "2026-09-07", "readStatus": "single-read", "note": "The help centre is StarTrader's own Zendesk site, linked from startrader.com. A separate funds password is named but its use is not documented." }, { "brokerName": "Fusion Markets", "brokerSlug": "fusion-markets", "twoFactor": "mandatory", "methods": [ "Authenticator app", "SMS (some regions)" ], "gate": "second-factor", "withdrawalStep": "A 2FA code on every withdrawal; crypto withdrawals need email confirmation as well.", "coolOff": null, "resetBypass": "no", "destination": "Only to accounts matching the account holder's name; no same-method or cooling-off rule documented.", "verbatim": "Once you make your first successful deposit, 2FA becomes mandatory so only you can access your account and request withdrawals.", "sourceUrl": "https://fusionmarkets.com/FAQ", "dateRead": "2026-09-05", "readStatus": "single-read", "note": "2FA can be postponed at sign-up but must be set before the first withdrawal. The phone number is locked while SMS 2FA is on." }, { "brokerName": "Blueberry Markets", "brokerSlug": "blueberry-markets", "twoFactor": "optional", "methods": [ "Authenticator app only", "Backup codes" ], "gate": "second-factor", "withdrawalStep": "A one-time password on the withdrawal request, delivery method chosen at the time; the MFA FAQ says MFA secures logins and critical actions.", "coolOff": null, "resetBypass": "not-documented", "destination": "A new bank profile requires a bank statement issued within three months.", "verbatim": "Is MFA mandatory right now? Not yet. You can currently skip setup, but MFA will soon become mandatory.", "sourceUrl": "https://helpcenter.blueberrymarkets.com/en/articles/15868643-multi-factor-authentication-is-now-available", "dateRead": "2026-09-07", "readStatus": "single-read", "note": "SMS and email codes are explicitly not supported as the factor. The withdrawal OTP's delivery options are not named, so whether an email-only attacker could pass it is not documented." }, { "brokerName": "LiteFinance", "brokerSlug": "litefinance", "twoFactor": "optional", "methods": [ "Authenticator app", "SMS", "Email (any combination)" ], "gate": "second-factor", "withdrawalStep": "An SMS confirmation code to the verified phone number, described in LiteFinance's own security guide and Vietnamese FAQ; the English FAQ describes 2FA for login only.", "coolOff": null, "resetBypass": "no", "destination": "Only to the wallet and currency used to deposit.", "verbatim": "You'll get an SMS with a confirmation code that you will need to use to withdraw money.", "sourceUrl": "https://www.litefinance.org/blog/for-beginners/safety-on-forex/", "dateRead": "2026-09-04", "readStatus": "second-read", "secondRead": { "date": "2026-09-07", "scope": "The withdrawal SMS code appears in LiteFinance's security guide on litefinance.org, litefinance.com and liteforex.eu and in its Vietnamese FAQ, but nowhere in the English help centre. Changing the verified number requires a proof-of-ownership document and an ID selfie, which is why an email reset alone does not reach the code." } }, { "brokerName": "Pepperstone", "brokerSlug": "pepperstone", "twoFactor": "optional", "methods": [ "Authenticator app" ], "gate": "email-link", "withdrawalStep": "An 'Accept Withdrawal' email link to be actioned within one hour, or an authenticator-app code instead if 2FA is enabled.", "coolOff": null, "resetBypass": "not-documented", "destination": "Return to source only: the same bank account or card, in the same name.", "verbatim": "Approve the transaction within one hour via the email sent to you, or using a 2FA code if enabled.", "sourceUrl": "https://pepperstone.com/en/support/how-do-i-confirm-my-withdrawal", "dateRead": "2026-09-04", "readStatus": "second-read", "secondRead": { "date": "2026-09-08", "scope": "Confirmed: the email link and the authenticator code are alternatives, not layers, and the client-area password itself resets by an emailed link, so an inbox-only attacker can complete the whole flow on an account without 2FA. The limiting factor is that Pepperstone pays out only to a bank account or card already linked to the account in the client's own or joint name, so the exposure is an unauthorised payout to the client's own verified funding source, not a transfer to a third party." }, "note": "The 2FA code replaces the email link rather than adding to it, so with 2FA off, control of the registered inbox is enough to approve a payout." }, { "brokerName": "FXTM", "brokerSlug": "fxtm", "twoFactor": "optional", "methods": [ "Authenticator app (in the FXTM app's settings)", "Passkey", "Emailed one-time code at login", "Static 5-digit security code (withdrawals)" ], "gate": "second-factor", "withdrawalStep": "With the app's multi-factor setting on, an authenticator code on withdrawal, in FXTM's own words 'adds extra protection only when you withdraw'; otherwise the static 5-digit security code, 'you may be asked'. A first withdrawal to a new crypto address also needs wallet binding and a phone call from FXTM.", "coolOff": "4 hours after a password or security-code change.", "resetBypass": "not-documented", "destination": "Same method as the deposit for cards and crypto; one active crypto wallet address at a time.", "verbatim": "Multi-factor authentication (MFA) adds an extra layer of security to your account. Once enabled, you'll need to enter a code from your authenticator app when performing certain actions in the app. Adds extra protection only when you withdraw.", "sourceUrl": "https://trade.fxtm.com/assets/packages/components/assets/languages/en.json", "dateRead": "2026-09-04", "readStatus": "second-read", "secondRead": { "date": "2026-09-08", "scope": "The help centre has no two-factor article at all, but FXTM's own trading app at trade.fxtm.com ships an optional multi-factor setting (authenticator app or passkey) whose own description scopes it to withdrawals, plus a mandatory four-digit code emailed at login. All of it was read from the app's published interface strings; none of it is documented outside the app, and we could not confirm every client sees the toggle without logging in." }, "note": "The 5-digit security code is a fixed secret, not a rotating one; it is reset by an emailed one-time code and a reset triggers the withdrawal lock." }, { "brokerName": "IC Markets", "brokerSlug": "ic-markets", "twoFactor": "optional", "methods": [ "Authenticator app", "SMS", "Backup codes" ], "gate": "login-only", "withdrawalStep": "The Global, Seychelles, Bahamas and EU withdrawal pages describe no code or confirmation; the Australian entity's page says every withdrawal needs a 'Confirm Withdrawal' click in an email.", "coolOff": null, "resetBypass": "not-documented", "destination": "Routed back by deposit method; no third-party payments; cards must be in the account holder's name and approved by compliance.", "verbatim": "2FA requires you to follow one extra step to verify your identity before accessing your account, providing you with an additional layer of security.", "sourceUrl": "https://www.icmarkets.com/global/en/help-resources/protecting-your-account", "dateRead": "2026-09-04", "readStatus": "second-read", "secondRead": { "date": "2026-09-07", "scope": "The Australian entity, International Capital Markets Pty Ltd, documents an email confirmation link on every withdrawal on its own withdrawal page. No IC Markets entity documents a code or 2FA prompt at withdrawal. The Australian help centre says the login code is asked for on untrusted devices and skipped once a device is trusted." }, "note": "A password reset sends a temporary password by email; whether 2FA still applies afterwards is not stated." }, { "brokerName": "XM", "brokerSlug": "xm", "twoFactor": "optional", "methods": [ "Authenticator app or email code (one at a time)" ], "gate": "login-only", "withdrawalStep": "None documented: twenty-three Deposits & Withdrawals answers and the UK and Australian client agreements describe no code or confirmation at withdrawal; the only withdrawal-side protections are return-to-source and a margin-level restriction.", "coolOff": null, "resetBypass": "not-documented", "destination": "All withdrawals go back to the source of the deposit; no third parties.", "verbatim": "Unlike normal single-factor authentication, which grants account access through a username and password alone, MFA requires a one-time password (OTP).", "sourceUrl": "https://www.xm.com/help-center/creation-management", "dateRead": "2026-09-04", "readStatus": "second-read", "secondRead": { "date": "2026-09-07", "scope": "XM publishes no step-by-step withdrawal walkthrough, so this row states what XM documents (MFA at login; no code documented at withdrawal), not an in-session test." }, "note": "If the client chose email as the second factor, the reset link and the code arrive in the same inbox." }, { "brokerName": "IG", "brokerSlug": "ig", "twoFactor": "optional", "methods": [ "Authenticator app only" ], "gate": "login-only", "withdrawalStep": "None documented for the UK, EU, Australian, Singapore, Swiss and international entities: the withdrawal pages describe no code or approval; destination control is same-route return plus bank-statement checks.", "coolOff": null, "resetBypass": "no", "destination": "Normally returned via the same method and to the same place it came from; a different destination is at IG's discretion after verification.", "verbatim": "Is 2FA mandatory? No, but we strongly recommend it for all accounts to ensure maximum security. Will 2FA slow down my trading? No, once logged in, you can trade normally without additional authentication.", "sourceUrl": "https://www.ig.com/uk/help-and-support/accounts-and-statements-dd8eb165/account-details-and-settings-c33e0a1c/two-factor-authentication-faqs-974ff27d", "dateRead": "2026-09-05", "readStatus": "second-read", "secondRead": { "date": "2026-09-07", "scope": "Two exceptions on IG's own material: IG Securities (Japan) requires a separate mandatory withdrawal password on every request and offers a TOTP prompt on withdrawals; IG Crypto (UK) requires 2FA before any crypto transfer to an external wallet. Cash withdrawals elsewhere are code-free. 2FA is mandatory for the Singapore entity, optional elsewhere." }, "note": "After a reset, the FAQ says to add the 6-digit code after the new password, so an enabled 2FA survives an email reset." }, { "brokerName": "eToro", "brokerSlug": "etoro", "twoFactor": "optional", "methods": [ "SMS code", "Phone-call code", "Push to a trusted device" ], "gate": "login-only", "withdrawalStep": "None documented for cash: the withdrawal steps are amount, payment method, submit. The eToro Money crypto wallet is the exception, with an SMS code on every outbound send.", "coolOff": null, "resetBypass": "not-documented", "destination": "Back to the deposit source, or to an alternative method in the client's name once eToro has approved it.", "verbatim": "2FA adds an additional layer of security to access your account, by entering a verification code sent to your mobile phone via SMS or phone call.", "sourceUrl": "https://www.etoro.com/customer-service/etoro-security-guidelines/", "dateRead": "2026-09-05", "readStatus": "second-read", "secondRead": { "date": "2026-09-07", "scope": "eToro Money crypto wallet: 2FA is mandatory for the app and an SMS code is required on every outbound crypto send. Cash withdrawals from the investment account and the eToro Money currency account describe no code." }, "note": "eToro's help centre could not be read by any permitted route; those articles were read as search-indexed copies, while the static etoro.com pages and the UK client agreement were read first-hand." }, { "brokerName": "Axi", "brokerSlug": "axi", "twoFactor": "mandatory", "methods": [ "Authenticator app", "SMS", "Voice call" ], "gate": "login-only", "withdrawalStep": "None documented: MFA is required at sign-up, login and when adding a wallet; the card-withdrawal steps show no code; a code is sent only when changing the crypto return address.", "coolOff": null, "resetBypass": "no", "destination": "Return to source on all methods; card withdrawals only 24 hours after a deposit on the same card; one registered crypto address at a time.", "verbatim": "You'll be asked to verify your identity during: Signup, Login, Adding a wallet.", "sourceUrl": "https://help.axi.com/en-US/axiv2--axicorp-prod/article/18dmQImn-how-do-i-create-my-account-and-set-up-mfa-sms-or-app", "dateRead": "2026-09-05", "readStatus": "second-read", "secondRead": { "date": "2026-09-08", "scope": "Axi's help centre documents a withdrawal-time one-time password only for Local Money Transfer withdrawals in Thailand, and even there it is required once per session and skipped while the ten-hour login MFA session is still active. Every other documented withdrawal method and region shows no code beyond being logged in." }, "note": "Login always requires MFA and the registered number cannot be changed self-service (identity check, one to two business days), which is why an email reset alone does not defeat it." }, { "brokerName": "XTB", "brokerSlug": "xtb", "twoFactor": "mandatory", "methods": [ "SMS", "Authenticator app", "Email code (international site)", "Backup codes" ], "gate": "login-only", "withdrawalStep": "None documented once a bank account is verified: 'bank account verification is required only for the first withdrawal'; a new bank account needs a verification deposit or a bank statement, and on the UK site an SMS code.", "coolOff": null, "resetBypass": "not-documented", "destination": "Only to a bank account in the client's sole name, verified at the first withdrawal and again for any new account.", "verbatim": "2FA is mandatory and cannot be disabled. The only available option is to change your authentication method to a different one.", "sourceUrl": "https://www.xtb.com/en/help-center/trading-account/two-factor-authentication-2fa", "dateRead": "2026-09-07", "readStatus": "second-read", "secondRead": { "date": "2026-09-08", "scope": "Nine regional help centres and both sets of terms describe the mandatory factor at login only, with no code on a withdrawal to a verified bank account. XTB's own Client Office web app, however, contains a switchable per-entity withdrawal SMS confirmation step; which entities have it switched on cannot be seen from outside a client session and no help centre mentions it. So a withdrawal-time code is undocumented and cannot be assumed for any given XTB entity, not proven absent." }, "note": "Trusted devices skip the login code on later logins. A client-activated Emergency Lock blocks withdrawals and is lifted only by video verification. XTB International's June 2026 service regulations still say multi-factor authentication is not mandatory, contradicting the help centre." }, { "brokerName": "Capital.com", "brokerSlug": "capital-com", "twoFactor": "optional", "methods": [ "Authenticator app", "Live-selfie check (alternative)", "SMS (named in a troubleshooting article)" ], "gate": "login-only", "withdrawalStep": "None documented: the withdrawal how-to (Account > Payments > Withdraw) shows no code or prompt; the only other documented 2FA gate is API-key generation.", "coolOff": null, "resetBypass": "no", "destination": "Returned to the original payment method; bank withdrawals to own-name accounts only.", "verbatim": "You'll need your email and password, plus a secondary verification method to log in.", "sourceUrl": "https://help.capital.com/hc/en-us/articles/28243028712466-How-can-I-make-my-account-more-secure", "dateRead": "2026-09-07", "readStatus": "second-read", "secondRead": { "date": "2026-09-08", "scope": "All 472 help-centre articles across both of Capital.com's help sites and the UK, Australian, CySEC and Seychelles client agreements were searched: for card, bank, wire and e-wallet withdrawals, every rail available to UK, EU and Australian clients, nothing is asked at withdrawal beyond the session. The one exception is crypto withdrawals, offered only under the Bahamas entity in listed countries, where the web platform refuses to proceed until 2FA is on and then demands a six-digit code. On resets: the forgot-password flow is email-only, an enabled factor survives it and is still demanded at the next login, and removing 2FA without the code requires an image of the client holding their ID, all in Capital.com's own words." }, "note": "Login-only rests on the absence of any withdrawal-time step in the help centre and the client agreements, not on an explicit statement. Read through Capital.com's own help-centre API because the pages serve a bot challenge." }, { "brokerName": "FP Markets", "brokerSlug": "fp-markets", "twoFactor": "optional", "methods": [ "SMS code (4-digit, shown in a 2020 tutorial video)" ], "gate": "login-only", "withdrawalStep": "None documented: the withdrawal FAQ is log in, Funding > Withdraw, amount, submit; the email FP Markets sends is a notification after processing. The only explanation of 2FA anywhere on its sites is a 2020 video showing an optional SMS code at Client Portal login.", "coolOff": null, "resetBypass": "not-documented", "destination": "Same method and same account as the original deposit; no third-party withdrawals.", "verbatim": "2FA can be enabled under the Profile section of your Client Area. We strongly recommend activating it to protect your account from unauthorised access.", "sourceUrl": "https://www.fpmarkets.com/en-au/education/faq/", "dateRead": "2026-09-04", "readStatus": "second-read", "secondRead": { "date": "2026-09-08", "scope": "2FA is mentioned in one-line FAQ answers on the Australian, global and EU sites, always as recommended and never with a method named. The only place it is explained is a 2020 'Enabling Two-Factor authentication' tutorial video, which shows an optional four-digit SMS code at Client Portal login. Nothing on any FP Markets site describes a withdrawal-stage step." }, "note": "Their sites block automated reads, so the pages were read through a text-extraction proxy." }, { "brokerName": "ThinkMarkets", "brokerSlug": "thinkmarkets", "twoFactor": "optional", "methods": [ "Authenticator app", "SMS or WhatsApp code (crypto withdrawals, per the portal's own strings)" ], "gate": "login-only", "withdrawalStep": "Fiat withdrawals: a review screen and no code, per ThinkPortal's own interface strings. Crypto withdrawals: an authenticator code if 2FA is on, otherwise a six-digit code by SMS or WhatsApp. None of it appears in the help centre.", "coolOff": null, "resetBypass": "not-documented", "destination": "Back to source on all methods; a changed crypto wallet or lost card needs proof, then bank wire in the same name.", "verbatim": "We promote using 2FA – a security enhancement feature to improve your account's protection against unauthorised access.", "sourceUrl": "https://support.thinkmarkets.com/hc/en-gb/articles/11787024185361-How-do-I-activate-two-factor-authentication-2FA-on-ThinkPortal", "dateRead": "2026-09-05", "readStatus": "second-read", "secondRead": { "date": "2026-09-08", "scope": "ThinkPortal's public interface strings carry a 'Verify your withdrawal' step for crypto withdrawals: a Google Authenticator code when 2FA is enabled, otherwise a six-digit one-time code by SMS or WhatsApp, unless withdrawal codes are switched off for the client's country. Fiat withdrawals, which must return to the original deposit method, have a review screen and no code. All 498 help-centre articles were searched; none describes any of this." }, "note": "The 2FA article, last edited August 2023, does not say what the factor gates. The SMS one-time password on the security page verifies that a phone call is from ThinkMarkets, not logins or withdrawals." }, { "brokerName": "Tickmill", "brokerSlug": "tickmill", "twoFactor": "optional", "methods": [ "Email code", "SMS", "Authenticator app", "Recovery codes" ], "gate": "second-factor", "withdrawalStep": "In the Client Area, two-step verification can be switched on separately for login, withdrawals and password changes; with the withdrawal toggle on, each request must be confirmed with a code. With it off, the portal warns that 2FA is not enabled for withdrawals and lets the client accept the risk. None of this is in the public FAQ, which says only that 2FA can be enabled.", "coolOff": null, "resetBypass": "not-documented", "destination": "Same method as the deposit; profits to other methods registered in the client's name; no third-party or anonymous accounts.", "verbatim": "Two-Factor Authentication (2FA) is not enabled for Withdrawals", "sourceUrl": "https://my.tickmill.com/", "dateRead": "2026-09-07", "readStatus": "second-read", "secondRead": { "date": "2026-09-08", "scope": "Tickmill's own Client Area bundle, shared by its Seychelles, Labuan, EU and UK entities, names three methods (email, SMS, authenticator app), offers a per-action toggle for login, withdrawals and password changes, trusts a device for thirty days, and shows a warning with an 'Accept the risk' button when a withdrawal is requested with the withdrawal factor off. The public site, the app-store listings and the client agreements mention 2FA in one sentence and name no method." }, "note": "The quoted sentence is the portal's own warning text. Read from the publicly served Client Area application, not from a logged-in session, so which toggles are on by default was not observed." }, { "brokerName": "Eightcap", "brokerSlug": "eightcap", "twoFactor": "not-documented", "methods": [], "gate": "not-documented", "withdrawalStep": "None documented: log in, choose method, enter amount, confirm, then a Finance-team review. The portal's own code adds an emailed confirmation link only for Australian-resident clients, and for China, Hong Kong, Taiwan and Macau clients withdrawing to USDT or USDC, the first time they withdraw to a new payout destination. UK, EU, Bahamas and other international clients get no second check.", "coolOff": null, "resetBypass": "not-documented", "destination": "Same method as the deposit.", "verbatim": "To use our Online Facility, you will need to use a username and password (Access Code).", "sourceUrl": "https://www.eightcap.com/en/traders/make-a-withdrawal/", "dateRead": "2026-09-05", "readStatus": "second-read", "secondRead": { "date": "2026-09-09", "scope": "No two-factor authentication is documented on any Eightcap site, in any client agreement or app-store listing, and the client portal's published code wires none up; a password reset is an emailed link. The same code contains an undocumented withdrawal confirmation email, with a tokenised link or a signed declaration to the finance desk as fallback, that fires only for Australian-resident clients and for China, Hong Kong, Taiwan and Macau clients withdrawing to stablecoins, on a first withdrawal to a new payout destination. Nothing fires for anyone else." }, "note": "Eightcap's separate Challenges product documents an email-code 2FA, which is not the brokerage portal. Whether the login provider enforces a factor on its own hosted page could not be seen from outside a session." } ], "notRead": [ { "brokerSlug": "avatrade", "reason": "not yet read" }, { "brokerSlug": "hfm", "reason": "not yet read" }, { "brokerSlug": "bybit", "reason": "crypto exchange, outside this CFD-broker study" }, { "brokerSlug": "okx", "reason": "crypto exchange, outside this CFD-broker study" } ] }