Almost every account takeover starts the same way: the attacker already has the first factor. A leaked password, a phished code, a compromised inbox — the front door key, obtained somewhere you'll never see. Two-factor authentication exists for exactly this moment. It asks a second, independent question the attacker usually cannot answer, and it turns "they got the password" from a breach into a non-event.
But 2FA is only as good as its implementation details — which factors are offered, what happens to existing sessions, how bans propagate. Here's how it works in the Singuard Prop Firm CRM and Broker CRM, and what to look for in any platform you evaluate.
Why a Second Factor Changes the Math
Single-factor security fails silently: a stolen password works perfectly, from anywhere, until someone notices. A second factor breaks that by demanding proof from a different channel — something the trader has (a phone running an authenticator app) rather than something they know. The attacker now needs two independent compromises, simultaneously, against the same person. Attackers are economists; almost all of them move on to the next target instead.
For trading firms the stakes justify the small friction several times over. Behind a portal login sit funded account access, payout requests, identity documents and payment methods. An account worth attacking deserves a lock worth picking twice.
TOTP: The Gold Standard for Client Accounts
The CRM's strongest second factor is TOTP — time-based one-time passwords — through any standard authenticator app: Google Authenticator, Authy, 1Password and the rest. The mechanics are elegant: at setup, the platform and the app share a secret; from then on, the app derives a fresh six-digit code from that secret and the current time, rotating every thirty seconds, entirely offline.
The properties that make this the benchmark:
- Nothing travels. The code is computed on the device, not sent to it — there's no message to intercept in transit.
- Codes die in seconds. A phished TOTP code is useful for one sign-in attempt within its window, not indefinitely.
- Independent of the inbox. This is the crucial pairing with passwordless sign-in: if authentication proves inbox control, the second factor must live outside the inbox. TOTP does. An attacker who owns the trader's email still hits a wall. (See passwordless sign-in for the first layer.)
Email Codes: The Pragmatic Second Lane
Not every trader will install an authenticator app, and a 2FA option nobody enables protects nobody. So the CRM also offers email-code 2FA: a short-lived code delivered to the trader's verified address at sign-in. It's a genuine security improvement over no second factor — it defeats a plain stolen password outright — while being familiar enough that adoption is effortless.
Be honest about the hierarchy, though: email codes share fate with the inbox. For traders using passwordless sign-in, email 2FA adds little, because both proofs point at the same channel. The sensible guidance to give your traders: email codes as the floor, TOTP as the standard, and TOTP strongly encouraged once an account is funded.
Evaluation tip: ask any platform vendor not just "do you support 2FA?" but "which factors, and what happens to existing sessions when an account is banned?" The second question separates real security engineering from a checkbox.
The Forgotten Half: Session Control
Authentication controls who gets in. Session control decides what happens to everyone who is already in — and this is where many platforms quietly fail. A ban that only blocks the next login is a door locked with the intruder inside.
The Singuard CRMs treat sessions as first-class security objects:
- Sign out every device. Traders have a one-click control that revokes all of their active sessions everywhere — the correct reflex the moment a phone is lost or an email looks phishy. Recovery from suspicion becomes self-service instead of a support ticket.
- Bans revoke sessions instantly. When staff ban a client, every session that client holds is revoked at that moment — on web, desktop and mobile. There is no grace window in which a banned actor keeps operating on a still-warm login.
- Suspend, reactivate, reset. Staff can suspend and reactivate accounts and reset trading credentials, with each action written to the permanent audit log — who did it, to whom, and when (see audit trails).
This matters beyond hygiene. A prop firm that detects coordinated abuse — say, cross-account copy trading flagged by the rules engine — needs the offending accounts out now, not at their next login. Instant revocation is the enforcement arm of detection.
Policy: What to Require, What to Offer
A practical posture for most firms: offer 2FA to everyone from day one, encourage it at funding time — the moment a trader has something real to protect, they're most receptive — and keep the friction honest by supporting both TOTP and email factors. Staff accounts are a different conversation: your team's seats can approve payouts and edit rules, so hold them to the highest factor you support, backed by the permission-scoped permission model where every staff action is logged. And remember the layer beneath it all: however a session authenticated, money still requires approved KYC to move — authentication and verification are separate gates by design, a distinction that underpins the whole compliance stack described in AML basics.
None of this requires you to build anything. TOTP, email codes, sign-out-everywhere, ban revocation and the audit log ship as defaults on every Singuard firm — included in a launch that takes 24 hours, not a security roadmap that takes a year.
"2FA adoption is a UX problem. Offer authenticator apps for the careful and email codes for everyone else, and coverage actually happens."
— Roman Onta, Executive Director, Broker CRM & UI/UX
Key Takeaways
- 2FA turns a stolen password into a non-event by demanding a second, independent proof — attackers overwhelmingly move on.
- TOTP authenticator apps are the standard — offline, thirty-second codes, independent of the inbox. Email codes are the accessible floor.
- Session control finishes the job: sign-out-every-device for traders, and bans that revoke every active session instantly.
- On the Singuard CRMs the full stack ships as a default — no security backlog between you and launch.
Frequently Asked Questions
Which Authenticator Apps Work with the CRM's TOTP 2FA?
Any standard TOTP app — Google Authenticator, Authy, 1Password and others. Setup is the familiar scan-and-confirm flow, and codes are generated offline on the trader's device every thirty seconds.
What Happens to a Banned User's Open Sessions?
They're revoked immediately. A ban doesn't wait for the next login attempt — every active session the client holds is terminated at the moment of the ban, and the action is recorded in the audit log with who performed it and when.
Should I Force 2FA on All Traders?
Most firms get better results offering it universally and pushing hard at the funded stage, where traders are most motivated. Combine it with passwordless sign-in for the strongest default posture — and hold your own staff accounts to the strictest standard you support.