VT Markets is facing questions about its account security procedures after an Egyptian customer alleged that an unauthorized party accessed his MetaTrader 5 (MT5) trading account three times, repeatedly changed the password and removed an automated trading bot.
The allegations appeared in a Trustpilot review published on October 13, 2026, by a customer identified as Adham Ismail. The complaint describes suspicious activity beginning October 8, followed by unsuccessful requests to freeze the account, obtain access records and resolve three pending withdrawals.
The allegations have not been independently verified. There is no confirmed evidence of a security breach affecting VT Markets’ infrastructure or of a wider account-takeover campaign. Nevertheless, the reported combination of repeated unauthorized access, password changes and allegedly inadequate account protection raises questions beyond an ordinary withdrawal dispute.
Customer Claims MT5 Account Was Accessed Three Times
According to the complaint, the customer began receiving unauthorized login and verification attempts on October 8. Over the following days, an unknown party allegedly gained access to the MT5 account on three occasions and changed the trading password each time.
The customer also claims that one of his trading bots was removed. He says he notified VT Markets, requested that trading activity be frozen and asked the broker to investigate the account’s access history.
However, he alleges that the account was not frozen and that VT Markets did not provide login records, confirmation of the disputed access attempts or practical assistance in securing the account.
The complaint does not include publicly accessible server logs, device identifiers or other technical evidence establishing how the alleged intrusions occurred. It also does not establish whether the password changes originated from an unauthorized external device, a compromised computer or another access mechanism.
The reviewer additionally claims that a friend with a VT Markets account experienced a similar pattern. That second allegation remains unverified and cannot establish multiple related incidents.
Three Withdrawal Requests Remained Under Security Review
The customer says he submitted three withdrawal requests between October 10 and October 12. On October 12, he allegedly received an email explaining that withdrawals were undergoing additional security checks expected to take approximately one to two business days.
At the time of his October 13 review, the customer said two requests remained marked “Submitted,” while another had been showing “Processing” since October 10.
He also reported difficulties receiving verification codes on his registered mobile number, despite having completed identity verification. According to the complaint, support had not provided a suitable alternative verification procedure or a substantive escalation.
The customer says he submitted a formal written complaint to VT Markets and contacted a South African regulator. Neither the regulatory filing nor the underlying correspondence has been independently verified.
Importantly, the withdrawal timeline does not itself demonstrate misconduct.
VT Markets’ published withdrawal documentation states that requests generally require one to three business days for processing, with additional delays possible because of payment methods, weekends, bank checks and compliance reviews.
October 10 and 11 fell on a weekend. A security review communicated on Monday, October 12, therefore would not necessarily have exceeded a one-to-two-business-day estimate by the following day.
A comparable distinction emerged in Dave Finances’ recent reporting on an IC Markets withdrawal complaint, where published processing conditions explained several aspects of the customer’s experience.
VT Markets’ Security Guidance Addresses Unusual Trading Activity
VT Markets already publishes procedures for customers who identify unfamiliar trades or changes to their accounts.
Its Help Centre advises customers to examine whether Expert Advisors, copy-trading arrangements or other automated settings explain unexpected activity before assuming unauthorized access.
Where activity remains unexplained, the broker recommends changing the MT4 or MT5 master password, updating Client Portal and email passwords, enabling two-factor authentication and contacting support with relevant account details and timestamps.
VT Markets also issued a warning on June 30, 2026, about fraudulent websites and platforms impersonating its brand. The company urged customers to use official services and avoid sharing passwords or verification codes through suspicious communications.
That earlier warning establishes that VT Markets had publicly identified impersonation risks. It does not connect those websites to the October complaint or demonstrate that the broker’s own systems were compromised.
On its public Trustpilot page reviewed on October 14, no company response was visible alongside the specific Egyptian customer’s complaint.
Why the Alleged Password Changes Matter More Than Withdrawal Delays
The central issue is not whether a withdrawal takes an extra business day. It is what happens when a customer believes someone else has gained control of a live trading account.
An unauthorized MT5 session could potentially expose account information, allow trades to be placed or alter positions, depending on the credentials involved. In leveraged forex and CFD trading, such activity can create losses before a customer realizes anything is wrong.
The distinction between MT5 master and investor passwords matters. Master access enables trading operations, while investor credentials provide read-only access.
MetaQuotes’ official MT5 authentication documentation also explains that one-time passwords can protect trading accounts even when conventional credentials are exposed. However, this functionality depends on support and configuration at the trading-server level.
That creates a question for VT Markets: does enabling two-factor authentication in the Client Portal also protect direct MT5 trading-server access, or must customers configure separate safeguards?
The reported bot removal introduces another technical complication. MT5 Expert Advisors normally operate within a desktop terminal or hosted virtual environment. Simply logging into the same trading account from another device does not ordinarily delete a locally installed bot.
Determining whether the bot was deleted, detached from a chart or disabled would help establish whether the incident involved trading credentials, terminal configuration or access to a computer or hosted environment.
Access Records Could Determine Whether the Allegations Hold Up
The strongest evidence would be timestamped login records showing when the account was accessed, which devices or network addresses were involved and how the password changes were authorized.
Without that information, the complaint leaves several competing explanations open, including compromised credentials, phishing, unauthorized device access or a misunderstanding of activity generated by connected services.
There is also a legitimate tension between customer transparency and security. Brokers cannot reasonably publish unrestricted internal security logs, but customers reporting unauthorized access need enough information to understand what happened and challenge an inaccurate finding.
Dave Finances recently examined similar questions about account-access evidence and disclosure in a FunderPro dispute. Although that case concerned alleged account sharing rather than an intrusion, both demonstrate why timestamps and device-level evidence can be decisive.
Another consideration is the legal entity responsible for the customer’s account. VT Markets identifies regulated operations in South Africa and Mauritius, but the specific contracting entity determines which protections, complaint procedures and dispute-resolution arrangements apply.
As explained in Dave Finances’ examination of offshore forex broker risks, a financial brand’s regulatory registrations do not automatically establish which jurisdiction governs an individual customer’s account.
What VT Markets Needs to Clarify Next
Several answers would materially change the significance of this complaint.
First, VT Markets needs to establish whether the three alleged MT5 connections occurred and whether the password changes were initiated from unfamiliar sessions. Second, it should clarify whether a customer reporting suspected account takeover can request an immediate trading restriction and what authentication is required to authorize that restriction.
Third, the broker could explain whether the withdrawal reviews were specifically related to suspected unauthorized activity or simply routine payment-compliance checks.
The difference matters. Enhanced withdrawal scrutiny may protect a customer from having funds transferred to an attacker, but that protection is incomplete if unauthorized trading remains possible while the account is under review.
Independent evidence from another customer describing the same password-change pattern would also warrant closer examination. At present, the reference to an affected friend remains an unsupported secondhand claim.
For now, the October 13 complaint remains an individual allegation rather than evidence of a broader VT Markets security incident. Its importance lies in whether the broker can establish what happened, demonstrate how it handled the reported account risk and explain why the customer says his requests for protection went unresolved.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574