Platform Security: Spotting Phishing Platforms

The cheapest trading education a beginner can buy is the one they didn't lose to a fake broker.

Why traders are prime phishing targets

Traders self-custody credentials worth thousands, sign in across many devices, and are conditioned to expect urgent "verify your account" emails. That combination is catnip for scammers. Phishing has moved beyond email to fake apps, fake MT4/MT5 server entries, and lookalike broker sites.

Common phishing vectors

Vector	What happens
Lookalike domain	tradingvlew.com, metatrader4-download.com steal credentials
Fake mobile app	Apps in third-party stores impersonate brokers
Fake MT4/MT5 server	Scammer hosts their own server; trades are fake
Email "verify account"	Links to spoofed login pages
Telegram/Discord "support"	Impersonators DM users with "urgent" account locks
Fake airdrop or promo	"Deposit 0.1 BTC to claim 1 BTC" — classic crypto scam
Cloned broker website	Identical UI, slightly wrong URL

How to verify a broker is real

1. Check the regulator: FCA (UK), ASIC (Australia), CySEC (Cyprus), NFA/CFTC (US), BaFin (Germany). Search the regulator's official register for the broker's name, not the broker's website.
2. Cross-reference domain age: real brokers have domains registered 5+ years ago. Use WHOIS lookups.
3. Verify the MT4/MT5 server name: real brokers publish their server list. If yours isn't on it, you're on a fake server.
4. Phone support: real brokers publish a phone number. Call it once during onboarding.
5. SSL certificate: click the lock icon and verify the issuing CA. EV certificates show the company name.
6. Withdrawal test: deposit a small amount, then withdraw it before trading. If withdrawal is "delayed," run.

Red flags

• Promises of guaranteed returns or "no-risk" copy trading
• Aggressive bonus offers that lock your funds behind trade-volume requirements
• Pressure to deposit more before withdrawing
• "Account managers" who insist on remote desktop access
• Email from "support@" domains that differ from the official one by one character
• Domain using 0 instead of o, rn instead of m, or extra hyphens

The fake MT4 server scam

One of the most damaging scams targets MT4 specifically:

1. Scammer sets up an "MT4 broker" with their own server.
2. They give you credentials; the platform looks identical.
3. You deposit real money to the scammer's wallet.
4. Your "trading account" shows fake balances and fake fills.
5. When you try to withdraw, support disappears or demands more deposits.

Defense: only download MT4/MT5 from your broker's website. Cross-check the server name against the broker's published list. If your broker isn't on MetaQuotes' verified list, be skeptical.

Protecting your live account

1. Two-factor authentication on the broker's client portal (not just email).
2. Separate passwords: never reuse the broker password anywhere.
3. Hardware key or authenticator app over SMS — SIM swapping is common.
4. Whitelisted withdrawal addresses for crypto brokers.
5. Email alert for every login — most brokers offer this; enable it.
6. Separate device for broker login if possible.

Phishing-resistant habits

• Never click links in emails about your account — type the broker URL manually
• Bookmark the official login page; only use the bookmark
• Verify the URL bar matches the official domain exactly before entering credentials
• Install a password manager — it refuses to autofill on lookalike domains
• Use a VPN on public Wi-Fi when trading
• Update the platform regularly — patches often address security issues

What to do if you suspect phishing

1. Stop: do not enter credentials.
2. Change your password from a trusted device via the official URL.
3. Contact the broker via phone or verified email.
4. Report the phishing URL to Google Safe Browsing and to your local CERT.
5. Freeze withdrawals if your account allows it.
6. Run antivirus if you downloaded anything.

What to do if you already entered credentials

1. Change the password immediately from a different device.
2. Enable or reset 2FA.
3. Withdraw remaining funds if possible.
4. Contact broker support to flag the account.
5. Monitor bank and card statements for weeks.

Practical onboarding checklist

• Broker appears in the regulator's official register
• Domain registered >2 years via WHOIS
• Phone support answers in <2 minutes
• Small withdrawal test completed
• 2FA enabled
• Login alerts enabled
• Password unique to this broker

---

Next: with your account secure, you can focus on the trading system itself.