Security of your Popular Trade account
Security on a financial platform is not a checkbox you tick once: it is a set of layers that work together and that you also control. This page explains, point by point, how we protect your account and your data, and what you can do to join that effort. Every measure described here is active today; none of it is a roadmap.
If anything is still unclear after reading, the Client Support and Compliance team handles security questions at [email protected], first reply usually within 1 business hour.
1. Two-factor authentication (2FA/MFA)
In addition to your password, your account can require a second factor at login: a code generated by an authenticator app on your phone. We recommend turning it on from day one, because a leaked or guessed password stops being enough on its own. The feature is optional but free, and enabling it takes less than two minutes from your profile settings.
If you lose access to your phone or the authenticator app, recovery does not happen with a single click: your identity is verified with the support desk and your onboarding documents before access is re-enabled. That extra step exists precisely so a third party cannot impersonate you through a fake "lost device" story.
2. Data encryption
Communications between your browser and the platform travel encrypted over TLS, so nobody on the same network can read what is transmitted. Stored data, such as your profile information and verification records, is kept encrypted on the systems responsible for processing it, with access restricted to the staff who need it to operate.
Encryption covers both data in transit and data at rest inside the platform's systems and those of the providers involved in the service. We do not store full card numbers: payment methods are processed through the corresponding providers, who apply their own security measures.
3. Fraud and phishing protection
The official domain of the service is popular-trade.com. Any message asking you for passwords, verification codes, or transfers to accounts other than your own did not come from us. As an extra layer, legitimate communications include details of your account that an impostor would not know, so you can tell a real message from a forged one.
We maintain a fraud warning page explaining how to spot clone companies and sites imitating our brand, and where to report them. If you receive a suspected impersonation, forward it to [email protected]: we review every report and notify users when we detect active campaigns.
4. Login notifications
Every time your account is opened from a new device, you get an email notification with the date, time, and approximate origin of the connection. We also alert you when we detect unusual activity, such as repeated failed login attempts or changes to your contact details. These alerts let you react in minutes, not weeks.
The approximate origin deserves a word of caution: it is derived from network data and can occasionally look unfamiliar even for a legitimate login, for example when your phone carrier routes traffic through another region. Read it as a signal to pay attention, not as proof by itself; the decisive questions are whether the time matches your activity and whether the device in the alert is yours.
If a notification corresponds to a login you do not recognize, change your password immediately, close active sessions from the dashboard, and write to us from your registered email. Those cases are prioritized above any other ongoing query.
5. Device and session management
From the dashboard you can see which devices have your session open, when each was last active, and close any of them remotely, including the current one. Idle sessions expire automatically after a period of inactivity, so a forgotten browser tab on a shared computer does not keep access open forever.
We recommend reviewing the device list after using someone else's computer or selling a phone, and closing anything you no longer use right there. It is the simplest digital hygiene habit and one of the most effective. If you ever see a device you do not recognize in that list, do not wait to see what happens: close the session, change your password, and send us the record from your registered email so we can review the access trail on our side.
6. Account recovery
Forgetting a password is normal; recovering it must be safe. Resetting requires verifying your identity against the details and documents from onboarding, and the outcome is sent to the email registered on file. We never ask for your authenticator codes or passwords over the phone: anyone who does is not our team.
If you lose access to your registered email, recovery includes an additional identity check before the contact detail can be changed. It may feel slower, but it is what stops someone from taking over your account with a simple email swap. Every recovery event is written to your audit history, so you can always verify what changed and when, and contest anything you did not authorize.
7. API key permissions
When the platform connects to an external service on your behalf, the connection uses API keys with limited permissions: reading data, executing operations, and withdrawing funds are separate permissions. The principle is simple: each key must be able to do only what the function it was created for needs, and nothing more.
In your settings you can see which keys exist, what permissions they hold, and revoke them. If you stop using an integration, revoke its key that same day: an active key with no purpose is a door nobody is watching.
8. Audit history
Your account keeps a record of important events: logins, service connections, strategy changes, and configuration updates. That history is available to you in the dashboard and serves as the source of truth whenever something needs review: what happened, when, and from where.
When there is a discrepancy, support starts the investigation from that record. We recommend skimming it from time to time, the same way you check your bank statements: familiarity with what is normal is what makes the abnormal visible.
9. Incident support
When you suspect a security problem, there is one channel: write immediately to [email protected] from your registered email, describing what happened. On receiving the report, the team can temporarily suspend account activity while the case is investigated, to protect your funds and data. That preventive block is lifted once the review confirms access is back under your control.
Incident communication follows a clear order: confirmation of receipt, preventive measures applied, review outcome, and recovery steps. If an incident affects several users, we publish a general notice with the applicable recommendations. No security review ends with a plain "all clear": we always explain what was found and what was done.
Remember: security is shared work. Turn on two-factor authentication, use a unique password you do not reuse anywhere else, read the notifications we send you, and write immediately if something does not add up. None of these actions takes more than a few minutes, and each one lowers the chance that someone else gets in where only you should be.