With all due respect, this is rather needlessly alarmist by implying even 2FA didn't protect the brokerage account. But when you read the article it states the chain of events as:
The victim then
1. clicks the phishing link
2. lands on an exact copy of the brokerage login
3. types their username and password
4. approves the two-factor authentication on their phone.
So essentially all this is saying is that "if you follow phishing links, you can get hacked" - well, of course.
The solution here is to never click on links to any website from your email/text message. Always go to the website directly and login.
There's nothing wrong with IBKR or any other website that uses 2FA, they work as intended. It is on the user to not use suspicious links from email/text messages, they cannot do anything about that failure mode.
I am far from being an expert on security. This has been educational as I have been generally lax although I thought I was in good shape with my brokerage account. .
I have always the concerned about a data breach. My electronic medical records provider was breached for example. And data breach notifications from sites I go to have been so common that I just throw them into the trash--barely noticing where the breach occurred. I think Blue Cross Blue shield was breached for example. I am pretty sure some bad people already know my SS# and probably my entire medical history.
My point is I thought I was protecting myself my entering the password manually each time. That I was protecting myself from data breaches of Apple's Passkey for example.
Again, not an expert but Gemini says this:
Native Passkey Handling: On services where you use Apple passkeys instead of standard passwords, Apple’s Secure Enclave handles authentication via WebAuthn, making credential theft impossible on a spoofed domain at the cryptographic level.
I that true? Would using Apple Passkey's (or Google's) have prevented this from happening?
Gemini gives some more technical details here:
Yes, using a passkey (Apple, Google, or a hardware key) would have completely prevented this hack.
Your draft raises the exact right technical question to counter the forum poster's claim that "2FA worked as intended." However, there are two important technical distinctions to understand before posting, plus a few ways to sharpen your reply so other forum members take it seriously.
Key Technical Realities
Passkeys aren't just "more random passwords": Passkeys eliminate passwords entirely. Instead of a secret string, they use asymmetric public-key cryptography. A private key stays locked inside your device's hardware chip (Apple Secure Enclave or Google Titan), and a public key lives with the broker. There is no password to phish, brute-force, or leak in a database breach.
Why passkeys stop this attack: Passkeys rely on WebAuthn/FIDO2 standards, which are cryptographically domain-bound. When you click a phishing link leading to
interactivebrokers.phish-site.com, your browser checks the domain against the passkey. Because the domain does not matchinteractivebrokers.com, the browser refuses to offer or sign the passkey. The attacker captures nothing.Interactive Brokers actually supports passkeys: Unlike Fidelity, IBKR already rolled out native WebAuthn passkey support (under Client Portal $\rightarrow$ User Settings $\rightarrow$ Security $\rightarrow$ Secure Login System $\rightarrow$ Passkey). If the victim had activated IBKR's native passkey instead of standard push/SMS notifications, the attack would have failed at step 2.
The risk of typing passwords manually: Entering passwords by hand every time actually increases your risk of being phished. Humans are prone to missing subtle lookalike domains or reverse proxies when distracted or rushed. Password managers (like Apple Passwords) and passkeys act as automated domain checkers: if you land on a spoofed site, they simply refuse to offer your credentials, alerting you before you make a mistake.