Scam watch: the fake Interactive Brokers emails about your W-8BEN and 2FA passkey

Two fake emails in the name of Interactive Brokers are doing the rounds. One, with the subject "W-8BEN Documentation and Withholding Notice", says a US tax form has expired. The other, "Important Security Alert — 2FA Passkey Setup", asks the reader to switch on a passkey. Near-identical W-8BEN emails also use the names of Saxo and other brokers.

Interactive Brokers did not send these emails, and neither did Saxo or the other brokers named. They are not involved. The emails exist to steal trading account logins.

What the email looks like

Both emails come from "Interactive Brokers Client Services". The address behind it is on a throwaway domain of random letters. The logo is attached to the email as a picture, so it shows even when images are switched off.

The tax email opens: "Your W-8BEN form has expired." It warns that sale proceeds "will be subject to 24% backup withholding" and that access to US shares "may be affected". Then comes a "Sign Tax Form" button.

The security email warns of "a wave of phishing attacks", recommends 2-step sign-in "using a passkey" and even says to use the official website or app. Its "Set Up 2FA Passkey" button does not go there.

Both end with a support phone number, a live chat link and a footer reading "member NYSE, FINRA, SIPC". Apart from one genuine link to the SIPC website, every link points to a random web address ending in .live.

How the scam works

1. The hook is real. The W-8BEN is a genuine US tax form for non-US investors. US rules say it normally runs out at the end of the third calendar year after it is signed, and missing forms can lead to tax being held back.
2. The click. The button leads to a .live address. Security firm Cofense found that earlier fake W-8BEN emails in Interactive Brokers' name led to a copy of its sign-in page that sends whatever is typed to the criminals.
3. The login and the code. The reader types a username and password, and can be asked for the 2-step code too. Interactive Brokers warns that criminals can trick people past 2-step protection, such as text codes or its IB Key app.
4. The takeover. The criminals sign in to the real account straight away, while the code is still valid.

The emails pass the basic email checks for their own throwaway domains. That proves nothing about who is behind them.

How the scammers make money

A trading account holds cash and shares that can be moved or sold quickly.

• Moving money out. Interactive Brokers says that once criminals are inside an account they can transfer funds, sell positions, trade without permission and steal account details.
• "Ramp and dump". Security reporter Brian Krebs describes gangs using many hijacked accounts to buy the same little-traded stock at once. The price jumps, they sell shares they already hold, and the victims are left with stock that soon loses most of its value. Nothing is wired out of the victim's account, so checks on withdrawals do not stop it.
• The scale. In Japan, a reporter's question at a May 2025 Financial Services Agency press conference cited agency figures of 6,380 hijacked trading accounts and 3,505 unauthorised trades between January and April 2025. Sales came to about 161.2 billion yen and purchases to about 143.7 billion yen.
• Selling the logins. Logins that are not used straight away can be sold on. A 2020 study by security firm Digital Shadows found bank and financial logins sold for an average of £56, and high-value ones for upwards of £395.

How to spot it

• The sender's address is not an Interactive Brokers address. Look past the display name.
• The buttons do not lead to interactivebrokers.com. Hover over them on a computer, or press and hold on a phone, to see where they really go.
• Pressure: an "expired" form, a 24% tax threat or a "security alert".
• A security email that asks you to sign in through its own button. Interactive Brokers says a message asking you to log in through a link to sort out an urgent tax document is fraud.

How to protect your business

• Never sign in from an email link. Type the broker's address yourself or use its app, and check for real tasks there. A genuine W-8BEN request will also be waiting in your account.
• Turn on the strongest 2-step sign-in your broker offers, set up from inside the real app or website. Codes sent by text can be phished.
• Never share a password or 2-step code with anyone, including someone claiming to be from the broker's security team.
• Use a password manager. It will not fill in a password on a look-alike site.
• For a company trading account, keep access to a few people and turn on alerts for logins, trades and withdrawals.
• Show staff these emails, especially anyone who handles investments or tax paperwork.
• In the UK, forward suspicious emails to [email protected], the National Cyber Security Centre's reporting service, then delete them.

If you clicked, replied or paid

1. If you typed your password or a code: go to the broker's website or app yourself and change your password at once, and anywhere else you used it.
2. Call your broker on the number in its app or on its official website, not the one in the email. Ask it to check for new logins, trades and withdrawals, and to lock the account if needed.
3. Check your 2-step settings. Remove any device, phone number or passkey you do not recognise.
4. If money or shares have gone: tell your bank and report it to Report Fraud at reportfraud.police.uk, the national service for England, Wales and Northern Ireland. In Scotland, contact Police Scotland.
5. Keep the email. Forward it to [email protected], and keep a copy for your broker and the police.

Real tax forms and security settings live inside your broker account. If an email says your form has expired or your account is at risk, close it and sign in the long way.