Brokerage phishing texts flood in, two-factor authentication left toothless

According to a public warning from the security authorities, fraudsters have recently impersonated several securities platforms, sending phishing texts on the pretext of updating tax documents to lure investors into entering their account number, password and one-time verification code on fake websites — then seize control of the account to run dozens of trades in a short window, often inflicting six-figure losses. Local retail investors say this method is almost impossible to guard against: even with two-factor authentication set up, fraudsters steal the login session in real time and capture the one-time password along with it, leaving the authentication toothless.

Some have found that after a breach the fraudster never logs out, waiting until the victim boards a flight and goes offline before dumping the holdings. Multiple investors report unexplained losses within the same week, yet are unsure whether they were caught and find it hard to tell genuine from fake after the fact.

The observable trend is that the anti-fraud capabilities of brokers and authentication mechanisms are clearly failing to keep pace with the evolution of phishing techniques, and residents — lacking any trustworthy upfront identification or real-time interception support — are left to fend for themselves.