Recently, personal data breaches have occurred at many companies.
What I fear most is that my online brokerage accounts could be hijacked, wiping out the assets I've built up over time.
This is something I truly don't want to happen. If it did, it would cause severe physical and mental distress—enough to make me consider ending my life.
So, let's take security measures we can implement ourselves to strengthen our defenses!
This time, I've simply summarized what you should do as anti-hijacking measures for online brokerages.
The three firms I use are:
SBI Securities
Monex Securities
Rakuten Securities
Here is what you need to do:
1. Create a Dedicated Gmail for Your Brokerage Accounts
Many people probably haven't done this yet?
I myself created a dedicated Gmail for securities for the first time this time around.
Use this Gmail ONLY for:
SBI Securities
Monex Securities
Rakuten Securities
Do not use it for shopping, SNS, newsletters, or other services.
Completely isolate it for brokerage use only.
2. Set Up Passkeys on That Gmail
Also set up passkeys on your Google account.
On iPhone, log in with Face ID; on Mac, use Touch ID, etc.
Don't delete the Google Authenticator you're currently using; keep it as a backup.
In other words, make it:
Main: Passkey
Backup: Authenticator
3. Set Up Passkeys on SBI Securities
Register a passkey on SBI Securities.
After that, turn ON the "Disable Login Password" setting.
This means you will no longer be able to log in with just a username + password.
This increases security.
For SBI Securities, go all the way to a state where you can only log in via passkey.
4. Also Set Up Passkeys on Monex Securities
Set up passkeys on Monex Securities as well.
Confirm that you can successfully log in with the passkey.
Since Monex requires passkey authentication, this is basically sufficient.
5. Also Set Up Passkeys on Rakuten Securities
Set up passkeys on Rakuten Securities as well.
Log in normally with the passkey.
Furthermore, on Rakuten Securities, you can enable the lock on changing withdrawal bank account.
If you don't usually change your withdrawal bank account, this is a very effective security measure.
6. Turn On Notifications for All Three Firms
Turn on all possible notifications.
I strongly recommend enabling especially:
Login notifications
Order notifications
Withdrawal notifications
Registration info change notifications
Make sure you can notice immediately if a notification arrives when you haven't done anything.
7. Check Your Withdrawal Bank Accounts
Check across SBI Securities, Monex Securities, and Rakuten Securities whether the registered withdrawal bank accounts are correct.
Check to ensure they haven't been changed to unknown accounts.
8. Never Click Links in Emails from Brokerages
Making this a personal rule helps prevent phishing emails.
Even if it's a genuine email, do not log in via URLs inside the email.
If an important-looking email arrives:
Close the email
↓
Open the official app yourself
OR
Access via a bookmark of the official site you saved yourself
Stick to this workflow.
9. Don't Click SMS Links Either
Even if SMS messages arrive saying things like "Identity Verification," "Unauthorized Access," "Account Suspension," or "Security Check," do not enter via the link.
Always verify through the official app.
10. Use Different Passwords for Everything
Are you using the same password for SBI Securities, Monex Securities, Rakuten Securities, and your dedicated brokerage Gmail?
If so, your security settings are full of holes.
Be sure to use different passwords.
It's recommended to generate long random strings using a password manager rather than creating passwords yourself.
11. Keep Smartphone and PC Updated
Keep iPhone, Mac, and browsers always updated to the latest version.
Don't install suspicious apps or browser extensions.
Final Checklist
□ Create a dedicated Gmail for brokerages
□ Set up passkeys on Gmail
□ Keep Google Authenticator as a backup
□ Set up passkeys on SBI Securities
□ Turn ON "Disable Login Password" on SBI Securities
□ Confirm passkeys on Monex Securities
□ Set up passkeys on Rakuten Securities
□ Consider locking withdrawal account changes on Rakuten Securities
□ Turn on login notifications for all 3 firms
□ Turn on order notifications
□ Turn on withdrawal notifications
□ Check withdrawal bank accounts
□ Do not log in via email URLs
□ Do not log in via SMS URLs
□ Always access via official app or bookmarks
□ Do not reuse passwords
□ Update iPhone, Mac, and browsers to latest versions
Ultimately, these four things are the most important:
Dedicated Brokerage Gmail
Passkeys
Disabling Password Login on SBI
Never Logging In via Email/SMS Links
Just doing this much significantly strengthens your protection.
As your assets grow larger, instead of thinking "I'm safe," it's appropriate to assume the possibility of being hijacked from the start and configure your settings accordingly.
Note: As of October 2026. Each firm's specifications may change.
If there are other measures you can take, please share them in the comments.
Sharing your knowledge will enhance the security of my followers.
