back to article Investment app Robinhood: Extortionist tricked our support desk and made off with customer information

Investment app Robinhood has revealed an extortionist accessed its internal systems and siphoned off customer data after tricking a support desk worker. “Late in the evening of November 3, we experienced a data security incident,” starts a Monday night advisory by the Silicon-Valley-based financial upstart. It continues: An …

  1. Anonymous Coward
    FAIL

    No surprise

    It doesn't surprise me that a customer support rep would click on whatever malware vector was used. Robinhood's entire business model is based on convincing uninformed users to click buttons as soon as possible without a second thought.

    I am qualified by my broker to trade options but I gave it up because it IS too much like gambling and can become addictive. The Robinhood naifs were up against not only hedge funds but also other professional option traders who are glued to their Bloomberg Terminals (at $2000 per month, extra for custom monitors and keyboard) watching every fraction of a cent movement in real time.

    1. W.S.Gosset

      Re: No surprise

      I'm authorised by IMRO->FSA->FCA to trade anything in any size in any strategy and using other people's money but am forbidden to advise people with less than US$10m in investable assets re specific investments.

      You are completely correct.

      Screen-trading numbers is basically gambling -- I've seen PhD Physics boys blow themselves/their fund up with a "guaranteed" model while following everything in realtime so what the hell hope has Jo Bloggs got at home a good half-second off the pace?

      And margin trading? As a lot of derivatives include? Like putting a weekend sailor at the wheel of a supertanker. Madness -- (most) wholesale boys don't use the leverage, they set aside the uninvested cash and earn interest on it.

      1. MiguelC Silver badge

        Re: "they set aside the uninvested cash and earn interest on it."

        Hmmm... how long have you been out of the game? Interest rates have been negative for the last 6 years!

        1. W.S.Gosset

          Re: "they set aside the uninvested cash and earn interest on it."

          STMM. Only a handful of banks in each jurisdiction have access to the respective central banks' deposit windows.

        2. Anonymous Coward
          Anonymous Coward

          Re: "they set aside the uninvested cash and earn interest on it."

          Interest rates have been negative for the last 6 years!

          Not for my Channel Islands building society accounts.

          1. EricB123 Bronze badge

            Re: "they set aside the uninvested cash and earn interest on it."

            Many developing countries have to pay decent interest to borrow any money. There is a huge world out there besides america and Europe.

        3. W.S.Gosset

          Re: "they set aside the uninvested cash and earn interest on it."

          Actually, while I think of it -- even if STMM rates go negative, it doesn't change anything (unless another riskless option appears which has positive returns). Cost-of-carry is just factored into your price decision point -- whether it's positive or negative is irrelevant conceptually; it just affects at what point a trade becomes profitable/attractive. It's all relativities.

          Example: CB arb. One leg of that is being short the stock. You can only do that by borrowing stock you don't own. You pay "rent" for that borrowed stock for the duration of the trade. Your carry is negative: you are not "earning money" on it, you are "losing money" on it: it is in effect a negative interest rate. And that cost and the expected duration is just routinely factored into assessing the existing discount on the bond, factored into calculating the point at which the trade becomes profitable.

          The key point is, by not "taking advantage" of leverage you don't need (or can not justify or can not use legally or can not use due to client mandate), you are making a Risk Control decision, not a Revenue decision. Parking the unused cash has ~0 risk.

          Another consideration: traders are not in the business of making money by parking it in bank accounts; if that's all they were going to do, why would you need them? Another consideration: from a wholesale point of view, behind the scenes, those bank accounts (pooled) are actually just another (interest rate) flow trader's account.

    2. W.S.Gosset

      Re: No surprise

      2 other things about Robinhood which are different from what people think is happening:

      1. You're not actually trading. Rh is. You're just a creditor. Or at best holding an OTC with Rh. They can and will close out or reduce positions purely at their discretion. And if they happen to close out just one leg of say a 2 or 3 leg trade, rather than the whole lot as a unit, you can be unexpectedly crucified.

      2. Rh don't trade on the exchanges. They run everything via special deals with and through marketmakers, and entirely within their dark pools. (Rh might themselves only be holding OTCs...) At the very least, you're being (effectively) automatically front-run by the MM on each trade. You can never check if your price/spread was actually market. You could even be kept in a bubble of artificial/nonexistent/inflated stock, which they can create as an accidental artefact of their special settlement provisions. (Watch the stocks' FTDs for a heads-up on this happening -- it was rife during the GME thing.)

      1. Aristotles slow and dimwitted horse

        Re: No surprise

        Michael Lewis' book Flash Boys goes into all of this at a certain level of detail if you are interested. It's a good read.

      2. Clausewitz 4.0
        Devil

        Re: No surprise

        So, basically, Robinhood is the IQOption for stocks. Putting in a sticker to never trade in both platforms.

        Thanks.

        1. W.S.Gosset

          Re: No surprise

          I don't know IQOption, but if you're interested in the money payoff of investing rather than the control/voting aspects of holding physical stock, I have had good experiences in the past with IGIndex. You are explicitly trading OTCs for the nominated strategy/trade. And they are internally structured apparently identically to an investment bank's wholesale operation -- you will talk directly to Sales Traders who are laying off internally to their own bank-facing desk, rather than to "customer service representatives". It's quite startling in retail to have knowledgeable wholesale available to you.

          Haven't done anything there for a coupla years -- they may have changed.

    3. The Man Who Fell To Earth Silver badge
      WTF?

      I'm suprised

      " Approximately five million customer email addresses; Full names of a different group of two million people; Name, date of birth, and zip code for 310 people; "More extensive account details" for ten people."

      Must have been a looong phone call.

  2. Anonymous Coward
    Anonymous Coward

    The article is missing the tiny text at the bottom...

    "Capital at risk. Your investment may go down as well as up. 72% of CFD accounts lost money."

  3. Anonymous Coward
    Anonymous Coward

    RobinHood, RobinHood...

    You have to be at least 60 years old to remember the original reference.

    1. chuBb.

      Re: RobinHood, RobinHood...

      Or the weetabix advert...

      1. Phones Sheridan Silver badge

        Re: RobinHood, RobinHood...

        https://www.youtube.com/watch?v=4XOvVz8zwxc

    2. Neil Barnes Silver badge

      Re: RobinHood, RobinHood...

      Steals from the poor, gives to the rich...

      (with his bunch of men, of course).

      1. This post has been deleted by its author

    3. Aristotles slow and dimwitted horse

      Re: RobinHood, RobinHood...

      But does anyone remember his lesser known historical contemporary DennisMoore DennisMoore?

      1. Neil Barnes Silver badge

        Re: RobinHood, RobinHood...

        Oh yes :)

      2. DJV Silver badge

        Re: RobinHood, RobinHood...

        Your lupins or your life!

      3. W.S.Gosset

        Re: RobinHood, RobinHood...

        Extraor-rrrrr...

        dinary

  4. W.S.Gosset

    Upside-down, Miss Jane

    > Of course 91-year-old Buffet and 97-year-old Munger are the epitome of the Wall Street billionaire elite Robinhood suggests it wants to supplant.

    Actually, they're precisely the other end of the spectrum. On pretty much any dimension you care to name, but especially Trading Style, Ruthlessness, Lifestyle, and Personality Type. Be careful of getting predigested stereotypes from things like the Guardian or the ABC -- they live in a Disneyland world of baddies and goodies where The Narrative is more important than facts.

  5. FILE_ID.DIZ
    Trollface

    Maybe this is why Robinhood didn't want to offer phone support...

    ...cause their CSRs are just too damn dumb.

  6. Aristotles slow and dimwitted horse

    On the upside...

    On the upside to all of your misery and negative comments : I started learning all about Day Trading as a longer-term plan B during lockdown last year, I ended up doing a great trading course with a US provider and I'm currently up over $8k. I'll admit it's not a large amount in the greater scheme of things, and agree that it "could be" high risk - but I'm absolutely clear on what those risks are, how I mitigate them, and what my overall approach and plan is.

    Happy to concede though that there are probably lots of people doing it who don't really have a clue, and are losing, or have lost a lot of money.

    1. G R Goslin

      Re: On the upside...

      On the other hand, for you to have gained 8k, someone else has had to lose it.. It's a zero sum game. The only winner in a gamble is the bookmaker. If he's a good bookmaker.

  7. logicalextreme

    Well at least

    they were able to say what was actually taken, as opposed to what you usually see from companies that have been breached which is the prolix equivalent of "customer security is paramount to us, ¯\_(ツ)_/¯".

    It indicates that they've got some sort of auditing in place at the bare minimum, and that presumably someone working there at least knew what infosec was, once.

    1. Clausewitz 4.0
      Devil

      Re: Well at least

      QUOTE from Robinhood: "After we contained the intrusion, the unauthorized party demanded an extortion payment,"

      Well, not necessarily. Maybe they just realized the intrusion, AFTER the extortionists demand. But we will never really know for sure.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon