# Security Measures
**URL:** https://tradingqna.com/t/security-measures/175802
**Category:** General
**Created:** [November 12, 2024, 11:32am UTC](https://tradingqna.com/t/security-measures/175802 "2024-11-12T11:32:15Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@Prabhaji](https://tradingqna.com/u/Prabhaji)
#### Post date: [November 12, 2024, 11:32am UTC](https://tradingqna.com/t/security-measures/175802/1 "2024-11-12T11:32:15Z")
As I have seen that most all the demat hacking is done when email is compromised. Can I request zerodha to not send email and otp for password reset on my email? I just only want otps on my mobile number not on email. Will zerodha help me in this case?
@nithin please your response needed sir. I also want to tag all the [@moderators](https://tradingqna.com/groups/moderators)
---
### Author:  [@Shravan\_B\_K](https://tradingqna.com/u/Shravan_B_K)
#### Post date: [November 12, 2024, 4:35pm UTC](https://tradingqna.com/t/security-measures/175802/2 "2024-11-12T16:35:17Z")
Hi @Prabhaji
I would like to bring to your kind attention a few security measures that are already in place.
We send a push notification and a email notification when someone tries to login from a new location or a new device after the first factor is entered before the entry of the second factor.
Further in case of password reset, the flow currently needs the user to enter his PAN (this only the user knows) and the User ID to trigger the account reset OTP. This flow currently ensures that the attacker has to know the user’s PAN and user ID details to request the OTP. There is also a account block feature that we have introduced that gives the user to get his account blocked within 15 minutes. I have explained in detail [here](https://tradingqna.com/t/product-updates-over-the-last-year-at-zerodha/153765/264).
While it’s true that a few cases of account hack have happened in the past due to email compromise. We have taken a few measures in this regard as well. If a email service provider doesn’t have a 2FA mandated then we have stopped linking such email ids with the Zerodha’s trading account (eg : Rediff mail). We have also added a nudge for the users to change the email ID linked to kite.
Coming to the specific request of not sending OTPs to email and only to mobile phone, we did do analysis in this regard and people mostly used email OTPs more than mobile OTPs. Also the counter argument here is that if we send OTP only to mobile and if the mobile device is lost, then the user cannot reset his password 🙂 There is also the issue with compromise of SMS over the telephone network. Hence it would inconvenience a large chunk of users without really adding security.
It’s a good thing to enable 2FA on your email to prevent any of this in the first place.
Hope this addresses your concern.
---
### Author:  [@Prabhaji](https://tradingqna.com/u/Prabhaji)
#### Post date: [November 12, 2024, 4:55pm UTC](https://tradingqna.com/t/security-measures/175802/3 "2024-11-12T16:55:28Z")
> [@Shravan\_B\_K](#):
>
> Further in case of password reset, the flow currently needs the user to enter his PAN (this only the user knows) and the User ID to trigger the account reset OTP.
You also have one option to reset password which is “I don’t know user ID” and we can easily reset it without knowing user ID only with pan.
---
### Author:  [@Prabhaji](https://tradingqna.com/u/Prabhaji)
#### Post date: [November 12, 2024, 4:56pm UTC](https://tradingqna.com/t/security-measures/175802/4 "2024-11-12T16:56:01Z")
> [@Shravan\_B\_K](#):
>
> We have also added a nudge for the users to change the email ID linked to kite.
Can you please explain this?
---
### Author:  [@Prabhaji](https://tradingqna.com/u/Prabhaji)
#### Post date: [November 12, 2024, 5:04pm UTC](https://tradingqna.com/t/security-measures/175802/5 "2024-11-12T17:04:54Z")
> [@Shravan\_B\_K](#):
>
> Coming to the specific request of not sending OTPs to email and only to mobile phone, we did do analysis in this regard and people mostly used email OTPs more than mobile OTPs.
I am asking it for myself. Is it possible to request zerodha for not sending otps on email.
---
### Author:  [@Shravan\_B\_K](https://tradingqna.com/u/Shravan_B_K)
#### Post date: [November 12, 2024, 5:08pm UTC](https://tradingqna.com/t/security-measures/175802/6 "2024-11-12T17:08:47Z")
> [@Prabhaji](#):
>
> You also have one option to reset password which is “I don’t know user ID” and we can easily reset it without knowing user ID only with pan
PAN (which is known only to the user) is still needed.
> [@Prabhaji](#):
>
> Can you please explain this?
As I said in my previous reply, if someone has a email service provider whose security measures are weak we nudge the user on the order window to switch the email service provider.
Adding to the what has been said in the previous post, we have seen that the number of fraud cases drop drastically after the mandatory 2FA implementation. Most of the account block requests that we see today are cases of mobile loss and hence sending only Mobile OTP isn’t possible.
> [@Prabhaji](#):
>
> I am asking it for myself. Is it possible to request zerodha for not sending otps on email
Let me come back to you on giving the user an option to opt out of email OTP after discussing this internally.
---
### Author:  [@Prabhaji](https://tradingqna.com/u/Prabhaji)
#### Post date: [November 12, 2024, 5:12pm UTC](https://tradingqna.com/t/security-measures/175802/7 "2024-11-12T17:12:10Z")
Yes please, I will be very thankful to you if you enable this feature. It will be a great help for many investors.
---
### Author:  [@Prabhaji](https://tradingqna.com/u/Prabhaji)
#### Post date: [November 12, 2024, 5:14pm UTC](https://tradingqna.com/t/security-measures/175802/8 "2024-11-12T17:14:06Z")
> [@Shravan\_B\_K](#):
>
> PAN (which is known only to the user) is still needed.
Suppose I have sent emails with my personal informations like PAN and other details to my parents and brother. If my email got hacked then the hacker can easily get my pan. Right? So please make it possible to opt only for getting OTPs on Mobile. I will feel more comfortable and secure in getting OTPs only on Mobile number.
---
### Author:  [@tallerballer](https://tradingqna.com/u/tallerballer)
#### Post date: [November 12, 2024, 7:00pm UTC](https://tradingqna.com/t/security-measures/175802/9 "2024-11-12T19:00:17Z")
Best is for you to not secure zerodha account, but to secure your email account properly.
You can make it 10 times more harder for someone to hack your email by enabling 2FA in gmail.
---
### Author:  [@Prabhaji](https://tradingqna.com/u/Prabhaji)
#### Post date: [November 13, 2024, 3:53am UTC](https://tradingqna.com/t/security-measures/175802/10 "2024-11-13T03:53:15Z")
Thanks for your suggestion. But personally I feel it’s better to secure my demat account. And yes emails are also getting compromised even after enabling 2FA.
---
### Author:  [@Diwuproman](https://tradingqna.com/u/Diwuproman)
#### Post date: [November 13, 2024, 8:58am UTC](https://tradingqna.com/t/security-measures/175802/11 "2024-11-13T08:58:53Z")
> [@Shravan\_B\_K](#):
>
> Let me come back to you on giving the user an option to opt out of email OTP after discussing this internally.
I am also happy if you make it possible. Only thing restrict me to invest more is this email fraud things. Please enable the option to opt out email OTP. It will be more secure to only have mobile OTP option. Yes 2FA is good but not that secure. I am saying this after watching lot of videos and many youtubers are getting hacked because their emails are compromised even they already enabled 2FA.
And yes Zerodha will be appreciated if you enable this option. Please make the facility to opt out and enable email otp whenever we want. @nithin tagging you with the hope that you will understand our fear and make it possible to make trading and investing more secure.
---
### Author:  [@Prabhaji](https://tradingqna.com/u/Prabhaji)
#### Post date: [November 13, 2024, 11:15am UTC](https://tradingqna.com/t/security-measures/175802/12 "2024-11-13T11:15:59Z")
Hi @VenuMadhav sir,
Can you please consider this request and help us from fraudulent activities 🙏
---
### Author:  [@Shravan\_B\_K](https://tradingqna.com/u/Shravan_B_K)
#### Post date: [November 13, 2024, 4:12pm UTC](https://tradingqna.com/t/security-measures/175802/13 "2024-11-13T16:12:36Z")
> [@Diwuproman](#):
>
> Yes 2FA is good but not that secure. I am saying this after watching lot of videos and many youtubers are getting hacked because their emails are compromised even they already enabled 2FA.
> [@Prabhaji](#):
>
> And yes emails are also getting compromised even after enabling 2FA
While I check internally on the possibility of giving an option to opt out of email OTP, just wanted to clarify that 2FA algorithms such as TOTPs are highly secure and can only be bypassed by social engineering.
---
### Author:  [@Prabhaji](https://tradingqna.com/u/Prabhaji)
#### Post date: [November 13, 2024, 6:01pm UTC](https://tradingqna.com/t/security-measures/175802/14 "2024-11-13T18:01:37Z")
> [@Shravan\_B\_K](#):
>
> While I check internally on the possibility of giving an option to opt out of email OTP
Thanks 🙏
---
### Author:  [@Prabhaji](https://tradingqna.com/u/Prabhaji)
#### Post date: [November 13, 2024, 6:02pm UTC](https://tradingqna.com/t/security-measures/175802/15 "2024-11-13T18:02:09Z")
> [@Shravan\_B\_K](#):
>
> just wanted to clarify that 2FA algorithms such as TOTPs are highly secure and can only be bypassed by social engineering.
I just don’t want any risk sir 🙏
---
### Author:  [@TitanTrader](https://tradingqna.com/u/TitanTrader)
#### Post date: [November 14, 2024, 5:16am UTC](https://tradingqna.com/t/security-measures/175802/16 "2024-11-14T05:16:23Z")
> [@tallerballer](#):
>
> enabling 2FA
no one without your device can hack if you enable this.
---
### Author:  [@Prabhaji](https://tradingqna.com/u/Prabhaji)
#### Post date: [November 14, 2024, 4:33pm UTC](https://tradingqna.com/t/security-measures/175802/17 "2024-11-14T16:33:33Z")
I am talking about the gmail 2FA 👍 @TitanTrader
---
### Author:  [@Prabhaji](https://tradingqna.com/u/Prabhaji)
#### Post date: [November 15, 2024, 6:35am UTC](https://tradingqna.com/t/security-measures/175802/18 "2024-11-15T06:35:02Z")
> [@Shravan\_B\_K](#):
>
> While I check internally on the possibility of giving an option to opt out of email OTP
Any update on this Sir @Shravan_B_K
---
### Author:  [@pavinjoseph](https://tradingqna.com/u/pavinjoseph)
#### Post date: [November 15, 2024, 7:06am UTC](https://tradingqna.com/t/security-measures/175802/19 "2024-11-15T07:06:19Z")
Email today is way more secure than SMS. From Google AI:
> SMS one-time passwords (OTPs) are not safe because they are vulnerable to a variety of attacks, including:
>
> - **SIM swapping**
>
> Attackers can trick the user’s mobile carrier into issuing a new SIM card, giving them access to the user’s phone number and OTPs.
>
> - **Man-in-the-middle (MITM) attacks**
>
> Attackers can intercept OTPs using malware or vulnerabilities in the SS7 protocol.
>
> - **Social engineering**
>
> Attackers can use social engineering to bypass SMS OTP systems.
>
> - **Replay attacks**
>
> If an OTP isn’t invalidated after first use, it can be used again in a replay attack.
>
> - **No end-to-end encryption**
>
> SMS messages are not encrypted, so they can be intercepted at various points.
>
> - **Delivery failures**
>
> SMS delivery is dependent on mobile network reliability, which can vary by location.
>
> Some alternatives to SMS OTPs include:
>
> - Multi-factor authentication (MFA)
> - Software authentication, which requires authentication via a mobile app like Microsoft Authenticator or Google Authenticator
---
### Author:  [@Prabhaji](https://tradingqna.com/u/Prabhaji)
#### Post date: [November 15, 2024, 8:54am UTC](https://tradingqna.com/t/security-measures/175802/20 "2024-11-15T08:54:40Z")
Thanks for your suggestions. But my query is different.
[Next page](https://tradingqna.com/t/security-measures/175802.md?page=2)