security · 5 min read
Protecting your MT5 and broker accounts
Two passwords, one rule: nobody gets them. Here is how the MT5 password system works and the five habits that keep an account yours.
Master vs investor password
MT5 has two passwords per account. The master (trader) password can open, modify and close trades. The investor password is read-only: it shows the account but cannot trade. Signal scams often ask for the investor password 'to verify your account' — then use social engineering or a reset to escalate. We never ask for either. Verification is done by account number in the partner panel; that is all we need.
Five habits
- Unique MT5 password. Not your email password, not your broker portal password. Change it from the terminal: Tools → Options → Server → Change.
- 2FA on the broker portal. Withdrawals and password resets go through the portal; 2FA closes the reset route.
- Withdrawal method lock. Brokers return funds to the deposit method by default. Do not ask support to change it 'for convenience' — that policy is protecting you.
- Device hygiene. Screen lock on, MT5 password not saved on shared devices, official app only.
- Email as the crown jewel. Your broker email resets everything else. 2FA there first.
If you think you have been compromised
- Change the master password from a clean device immediately.
- Email the broker to freeze withdrawals while you investigate.
- Check the account history for trades you did not place — MT5 History tab, all time.
- Tell us in a support ticket if the story involves someone claiming to be XAUPROOF; we track impersonators.
Our record is public precisely so that you never need to hand anyone access to prove anything. If a service needs your password to 'connect', the record is what they lack.
Published 01 Sep 2026 · Updated 01 Sep 2026