Security at Interactive Brokers

Well … yeah, here’s how it works in practice:

  • the regulator says what the high level rules are for the participants (e.g. a bank) in that financial market (usually not spelling out specific limit amounts or what internal procedure the bank needs to apply
  • the banks interpret those regulator rules and put together internal guidelines that the staff needs to adhere to
  • the bank itself chooses an auditor that the bank pays to do regular audits, as mandated by the regulator*
  • the auditor … well, audits, which is basically verifying what the bank stated as their procedures was actually implemented and adhered to by the bank (and that the procedures support the high level rules by the auditor). Insert lots of handwaving here as well as spot checks, but not the auditor going through every activity by the bank and making sure it’s legit
  • the auditor provides a preliminary report to the bank
  • if the report is fine, the preliminary report becomes the final report and is provided to the regulator. If the report contains minor issues (definition required for “minor” …), the bank fixes these and a final “clean” report is produced and provided to the regular

You see, lots of room for interpretation at all levels … and even with this level of leeway big banks regularly get fined for having breached the rules, including large banks like Julius Baer, etc. Slap on the wrist, possibly change of management, and life goes on. :wink:


* In case it’s not already obvious: the auditor has an incentive to produce a report that the bank likes while of course balancing this with making sure not to be blatantly turning a blind eye on the bank to ensure they continue to exist as an auditor recognized by the regulator.
Fun fact: Wirecard was audited by Big Four accounting firm EY …

4 Likes

That’s very unsecure if it indeed works like this. A potential hacker can transfer funds to any bank account then.

1 Like

They should do it like Kraken, which is the best I’ve ever seen: multiple levels of TOTP authentications, one for login and transactions, separate one for withdrawals, separate one for withdrawal account changes. None can be sidestepped via SMS or social engineering. And this is even cheaper for them than sending hardware tokens with batteries…

SEPA/IBAN transfers never did name checking. Not retail, not B2B. Its not in the standard, though I believe its being proposed by some. Personally I dont see the point, esp with people’s dyslexia and ignorance, spelling and differences. Do you use full name, or just second surname, or Last First, or two first names etc. I do often IBAN transfers with made up or shortened names, noone cares. As long the 2 digit checksum fits and correct account, currency, time, all good. Unless it gets triggered for some manual check.

A 150k transfer might get a meatbag to look at, a 3k withdrawal to major bank likely never will trigger a filter.

I find IB documents the public part of their procedures fine. Some are not disclosed. Perhaps Saxo does far higher manual control on withdrawals, no way they name match with receiving banks. Look, maybe IB is just not the right broker for some people. And that’s fine.

Most people with IB work with singular logon user which has all the rights active (user management part of settings). Why not split two a trading user and funding user, later having withdrawal rights and different authentication methods. From a retail users perspective I understand the frustrations with such setup and time needed to use/setup, but the options are there to most extent.

Feedback link searching for better 2FA/double-2FA finds me just some poorly worded ones with 7-9 votes. If people have a good vote link, do share.

2 Likes

Good luck with explaining that to your grandparents when they want to do payments … :sweat_smile:

2 Likes

Well, how would you implement this, then? I assume that from your standard bank you initiate payments to accounts in other people/companies’ name all the time …

IIRC NL DeGiro allows transferring funds only to bank accounts they know, i.e. from which they received money and where the names match.

2 Likes

Yes, I am with you and this is probably why e.g. wealthy clients are still with Swiss (private) banks; at a certain level, you do not care about costs anymore, you just want to have guarantees and security.

Maybe it is not the right broker for the majority of buy and hold passive wealth accumulators. I would be totally happy with an offer like US Vanguard, very simple, you buy and hold, and they insure online risks.

In Europe we are just underserved: we have expensive banks with good protections, and brokers that cater to active investors who try to beat the market or just speculate in Tesla and such.

For me the unique attraction of IBKR is costs: I can buy VT via options at IBKR. This saves me some 0,3% per year compared to the UCITS funds just because I claim back DWT paid in America when I do my taxes. IBKR does not charge AUM fees, so there comes some 0,2% savings compared to banks. In total 0,5% per year.

If I keep my money invested at IBKR, I would be 10% richer in 20 years compared to a bank. That’s significant. On the other hand, I don’t want to warry about security, market risk is risk enough. I am trying to find a personal solution to this, go further with IBKR, or keep investing through the banks. The threads like this help making more informative decisions (or raise the level of frustration further).

3 Likes

Well said. One can make it easy and keep everything at IBRK, or you can make it more “complicated” and have two foreign brokers (e.g. IBRK + Schwab) and you are splitting up your assets and keep a bigger part on a Swiss bank. So, you are diversifying and keep the costs lower.

This could be an idea. But I am glad that this thread started.

Here are somethings to consider.

  • AUM costs at SQ and Saxo are capped, so it’s not huge difference. It’s max 200 CHF for SQ and max 120 for Saxo
  • VT is also available on SQ (for all) and Saxo (for some)
  • stamp duties will always be disadvantage for Swiss brokers , so this is unavoidable while using Swiss brokers / banks
  • The main disadvantage of SQ is higher trading commissions vs IB. But that is only one time cost.
  • some people prefer to buy at IB and transfer to SQ (thus limiting impact of one time buying costs and also stamp duties )

Another point - this 0.5% difference might be exaggerated. Because 0.3% that you can claim back is also the deduction you are allowed in CH for 3rd party costs. So net net wouldn’t it be a wash for VT vs VWRL? Are we double counting?

Another thing to consider and probably the whole idea behind this thing:

  • Withdrawal/Transfers: With SQ possible to any account (since it is a bank); with Saxo only possible to the account holder’s name. This is probably the most crucial point for me, to take Saxo, even if Saxo would be more expensive.
1 Like

Saxo won’t be more expensive. It’s cheaper I think vs SQ….

2 Likes

That’s exactly what I do: split between the bank and IBKR. I wanted to leave a limited amount at the bank and have the majority of money at IBKR, but now I think will stop putting new money into IBKR and go on with the bank.

1 Like

May I ask, which (Swiss) bank you are with? An ultra safe one with unlimited state guarantee or just a random one?

There is no bank which will gives guarantees against scams. I really think you need to differentiate between Esuisse guarantee which is normally for cash and only applies if bank goes bankrupt

I don’t know any bank which is ultra safe and guarantees all your securities against scammers

Even though I always recommend diversification of brokerages and bank accounts, I also think we need to be careful with our accounts in first place.

It’s not so easy to move money from IB to another account. It involves certain steps. For someone to do so without your knowledge would be tough. Most likely you will have some (unknowingly) role in that too (like social engineering, clicking spam links etc) . They would also need to know who you are, are you worth hacking etc

Imagine Saxo only allows to transfer to your own account. But your own bank account allows transfer to whoever. So it’s not only Saxo account that needs to be safe, it’s also your actual bank account too.

So while you try to use more secure brokerage , also try to embed safe digital practices in normal life.

1 Like

Sure, I am Dutch and invest at Rabobank. I think we have more or less similar conditions, likely Dutch banks are somewhat cheaper and there is no stamp duty!

1 Like

VWRL costs 0,22% vs VT 0,07%. The leakage at VWRL is 12%, assuming 2% dividend it is 0,24%. So in total around 0,46%. VT leaks 0,12% tax on non-US dividend (2023 data). The difference between them was in 2023 around 27 bps. On top of that I have AUM broker costs.

In my case I don’t have access to VWRL at the bank, but to Irish Vanguard Institutional Plus funds. The TER of these funds (World + EM + Small Cap, essentially VT) is around 0,12%, but Vanguard’s Irish mutual funds leak 30% US DWT.

Isn’t it absurd to think that IBKR is not safe? Even Raiffeisen accounts work with SMS verification. You would need a person who is familiar with it and can assess the situation. We can also philosophise about what will happen to VT if Iran sends nuclear bombs to America. How likely is it that your mobile phone will be hacked, your PW will be stolen and that it will hit you?

1 Like

Alright WEBG might help close the TER gap in future. As it’s a new ETF launched with 0.07%

1 Like