Unauthorized trades on my IB account.

[gaussian]

Good to know someone else is having similar issues. Mine weren't any options for hedging. IB just increased the size of my ES shorts by 4 times. I entered the short position on Friday close and didn't log in on Monday. I still had plenty of margin leftover, but a violent move to 3250 next week would have resulted in a margin call. What's surprising is that the positions were working in my favour, so, unbeknownst to me, my net liquidity was 8-10% higher on Monday.

I'm doubting this more and more.

If I ever had a question on trades I was immediately forwarded to someone who would answer my question expeditiously. The trade desk was generous with their time, and I've switched brokers often so I'm familiar with them. I've never had a platform issue the trade desk wasn't willing to work with me on. A simple "how do you show me?" has solved nearly every issue I've ever had.

Everything in this topic stinks. You record your own screen while you're away but can't correlate any trades? You've inspected your trade report yet the trades don't exist? Somehow you managed a "massive position" yet they added more orders to your trade? Could it have been user error? Most likely. Yet it benefited you? Further cementing in my mind this is user error. A trade desk wouldn't trade in your favor, they'd either liquidate you or hedge your position.

Nothing makes sense. There's no logic in any of this. If the trades don't exist yet you claim to see trades you need to check your eyes or call the trade desk. This post smells. Get off the forum and call the trade desk.

Being this is your only topic and your first posts, I'm wagering it's possible you're trying to ruin IBs reputation on a major trading website. I've had bad orders and strange platform issues and my first instinct was to call the trade desk and talk to a trader until the problem was resolved - not complain on a forum. This wreaks of a poorly disguised shill post.

 

[def]

I just saw this post and there are a number of issues.
First and foremost CALL THE HELP DESK IMMEDIATELY if you think you have unauthorized access to your account or ask them to check IP/MAC addresses to see who accesses your account over the time frame in question. At a minimum, send a ticket. Any hint of unauthorized access will get appropriate attention.

The other poster is talking liquidations which is a different matter altogether and does not in any way shape or form involve unauthorized access.

Given what little information you provided, I would double and triple check your code and also look at your audit trails as I doubt a hacker would trade the same products you normally trade. The audit trails are certainly available from the 9th on your end as well as more in depth ones on ours. In particular, check to make sure you didn't have any resting orders when you logged out.

I personally know of zero cases of hacking from anyone using 2FA authentication and thus suspect there is a reasonable explanation here. Either way, I would change your password immediately, set your account to only have access from your IP address and let the help desk dig into the weeds on this. I for one would not be sympathetic towards compensating if this was real and it happened again and you said " this is not the first time but last time it made money so I didn't complain".

 

[remogul92]

It could also be standing limit orders (GTC) that they left open. I've been burned a few times fat fingering a key and then walking away.

I’ve done this myself. And just like the OP initially thought someone had hacked my account.

 

[Lucius Lupus]

I just saw this post and there are a number of issues.
First and foremost CALL THE HELP DESK IMMEDIATELY if you think you have unauthorized access to your account or ask them to check IP/MAC addresses to see who accesses your account over the time frame in question. At a minimum, send a ticket. Any hint of unauthorized access will get appropriate attention.

The other poster is talking liquidations which is a different matter altogether and does not in any way shape or form involve unauthorized access.

Given what little information you provided, I would double and triple check your code and also look at your audit trails as I doubt a hacker would trade the same products you normally trade. The audit trails are certainly available from the 9th on your end as well as more in depth ones on ours. In particular, check to make sure you didn't have any resting orders when you logged out.

I personally know of zero cases of hacking from anyone using 2FA authentication and thus suspect there is a reasonable explanation here. Either way, I would change your password immediately, set your account to only have access from your IP address and let the help desk dig into the weeds on this. I for one would not be sympathetic towards compensating if this was real and it happened again and you said " this is not the first time but last time it made money so I didn't complain".

Here's what I'd like to know from IB: on a purely technical basis, if the trading desk can close my positions (as in when margin limits are breached), why can they not open positions for me without my knowledge using the same authentication credentials? What technical restrictions are in place at IB which would stop the trading desk from opening positions on my behalf? Isn't there a master key which allows account supervisors to fully access the account, including the capability to place opening orders? Are they using different authentication/access credentials to my account if they're opening a position instead of closing it? If there are no technical restrictions specifically on opening an order, why would a rogue character at IB trading desk not be a possible culprit here? With the screenrecording and the logs, you will really be telling the regulator that they are not seeing what they're seeing on the screen.


For those of you who are into the business of hagiography for IB, check this out about monkey business from IB for which it did compensate the victim (always happens just before close for some reason):


https://www.cftc.gov/sites/default/...dispositions/documents/legalpleading/idke.pdf

Don't get me wrong, IB has been better than my previous experiences with big brokers, but looking at their change of policy regarding PFOF, data outsourcing to an outside firm, and their financial losses, clearly there is financial stress at IB, which might help explain this kind of change in behaviour. The point is that an experienced trader should get a hint when it's time to move on.

I have screenrecordings, logs, and my friend the regulator. Nothing to prove. Just want you guys to know this is happening.

 

[ids]

Please stop these baseless speculations. This is either an unauthorized access or a bug. You should talk to the help desk.

 

[Option_Attack]

+1 I've been with IB for 20 years, never seen anything like this. I think IB support has better things to do than trade the OP's account. How could they benefit, or did they just want to mess with you? Doesn't make sense. I think the answer will be "Oh sh*t, I screwed something up. Never mind..."

I'm doubting this more and more.

If I ever had a question on trades I was immediately forwarded to someone who would answer my question expeditiously. The trade desk was generous with their time, and I've switched brokers often so I'm familiar with them. I've never had a platform issue the trade desk wasn't willing to work with me on. A simple "how do you show me?" has solved nearly every issue I've ever had.

Everything in this topic stinks. You record your own screen while you're away but can't correlate any trades? You've inspected your trade report yet the trades don't exist? Somehow you managed a "massive position" yet they added more orders to your trade? Could it have been user error? Most likely. Yet it benefited you? Further cementing in my mind this is user error. A trade desk wouldn't trade in your favor, they'd either liquidate you or hedge your position.

Nothing makes sense. There's no logic in any of this. If the trades don't exist yet you claim to see trades you need to check your eyes or call the trade desk. This post smells. Get off the forum and call the trade desk.

Being this is your only topic and your first posts, I'm wagering it's possible you're trying to ruin IBs reputation on a major trading website. I've had bad orders and strange platform issues and my first instinct was to call the trade desk and talk to a trader until the problem was resolved - not complain on a forum. This wreaks of a poorly disguised shill post.

 

[wrbtrader]

Desperately need help with suspicious activity on my IB account. I opened a small position on Friday close and logged out. Didn't open until today's close and, to my horror, my position size was 4 times the original. The API was disconnected and there were no instructions for automated trading through TWS. Audit Trail shows a large number of trades yesterday (Monday) when I didn't even log in the whole day. What's going on? Have I been hacked? Who's doing the trades? Only I have the security device to log in and I had it in my pocket the whole time. I managed to close the positions in profit. In fact, whoever did the trades was doing my a great favour and the profits would have been significant had I accidently logged in last night when there was a 20 point drawdown in ES; still, I'm truly baffled about what's going on with unauthorized trades. It has happened before in August and I did complain to IB, but back then the positions were much smaller. Time to switch the funds to other accounts?

Routinely, make screenshots of your open positions before logging off the computer. That timestamp should show trade position, trade ID and any other info you may need to help to show your position.

You said this happen before back in August. I'm sure IB told you to change your password (login info) and you did just that even if they did not tell you to do it...correct ???

I will assume your computer itself is also password protected and that nobody else in your family has access to it. You'll be surprise at how many people trade on the same computer that their spouse / children have access also to it.

In the past year, I saw a few members at this forum post screenshots of their broker trade execution platform with the full account number, name and trade transaction IDs. I'm not talking about a snippet blotter of a p/l column.

Crazy security risk there all by itself especially considering most here are anonymous nor do you know what someone can do with that info that's just a visitor.

Never use the WiFi of the place you're visiting although I'm not sure about what you meant when you stated your "security device" was in your pocket.

wrbtrader

 

[Lucius Lupus]

Routinely, make screenshots of your open positions before logging off the computer. That timestamp should show trade position, trade ID and any other info you may need to help to show your position.



I will assume your computer itself is also password protected and that nobody else in your family has access to it. You'll be surprise at how many people trade on the same computer that their spouse / children have access also to it.

In the past year, I saw a few members at this forum post screenshots of their broker trade execution platform with the full account number, name and trade transaction IDs. I'm not talking about a snippet blotter of a p/l column.

Crazy security risk there all by itself especially considering most here are anonymous nor do you know what someone can do with that info that's just a visitor.

Never use the WiFi of the place you're visiting although I'm not sure about what you meant when you stated your "security device" was in your pocket.

wrbtrader

Thanks, wr. By security device, I meant IB's key. I'd never post screen shots with any numbers, including p/l. Too much info to identify yourself. Kids are too young to have accessed the computer and wife is technically illiterate and has no idea about my password and or IB key. So very little risk there.

 

[wrbtrader]

Thanks, wr. By security device, I meant IB's key. I'd never post screen shots with any numbers, including p/l. Too much info to identify yourself. Kids are too young to have accessed the computer and wife is technically illiterate and has no idea about my password and or IB key. So very little risk there.

That would then imply you've been hacked or IB has a problem on their side...the latter you'll never be able to prove.

Hopefully, all account passwords has been changed and you now have a new IB key. I wonder if IB can send you an IP log that the trades were made from or maybe you already have access to the info yourself via some sort of IP log file ?

wrbtrader

 

[IB-AN]

A PM was sent to the OP offering to review the audit trail of the trades he believes to be unauthorized. This audit trail would allow us to confirm the user who logged into the account and submitted the orders in addition to session identifiers such as IP Address and Mac Address.

He declined this offer for reasons we'll leave up to him to explain.