Robinhood: Is It Safe?

If you’re into investing – whether in crypto, EFT, or stocks – chances are that you’ve already come across Robinhood. It’s a revolutionary trading platform that offers commission-free stock trades through a web and mobile app.

But here’s the thing: Apps are convenient, but they are also very prone to attacks. We’re talking about scammers and hackers just waiting to snatch up our cash and stocks. So just how safe is a platform like Robinhood?

We’ve investigated this question by looking over Robinhood’s digital security practices and by using its app. In this guide, we’ll go over what we discovered. We’ll explain how Robinhood works, what kinds of risks you should expect, and how you can protect your identity and finances if you decide to use it.

Let’s give a brief answer to the question: Is Robinhood safe?

Is Robinhood Safe?

If you came for the TL;DR version, here it is: Robinhood is an extremely safe stock brokerage and crypto exchange.

Robinhood has never lost cash, stocks, or crypto through a cyberattack on the platform itself. And Robinhood has robust security protocols to make sure that it never is the victim of such an attack.

Here are some of the measures Robinhood takes to protect users’ assets:

• Insurance – Robinhood sweeps cash balances into F.D.I.C. insured banks each day. This means that cash balances at Robinhood are insured up to $250,000 per user. In addition, all stocks and ETFs in the platform are insured up to $500,000 through the Security Investors Protection Corporation (SIPC). Robinhood’s crypto is not covered by these policies. But it does carry a separate policy that helps to protect it if a cyberattack is used to steal its crypto.
• Penetration testing – We always say this about home security: “Look at things from the eyes of a burglar.” Robinhood applies the same strategy to look for potential weaknesses in its security. But rather than just ‘looking,’ Robin Hood has a team of whitehat hackers constantly trying to break through its defenses. That way, Robinhood can stay one step ahead of actual hackers.
• Password security – Robinhood hashes all passwords using the BCrypt hash function. This means that even if an attacker penetrates Robinhood’s defenses and steals your password hash, he or she will still need to crack the hash in order to get your password.
• Sensitive information – Robinhood encrypts sensitive information like social security numbers, phone numbers, etc. before storing them. It also uses Transport Layer Security (TLS) to ensure that when you send sensitive info, it can’t be intercepted by an attacker.
• Two Factor Authentication (2FA) – Robinhood offers the option to enable two-factor authentication (2FA) for your account and our security experts highly recommend using it. With this feature activated, you’ll need to input a code from your phone whenever you log in from a new device. This extra step adds a layer of security, especially in the event that someone gains access to your email and attempts to reset your password.
• Crypto withdrawals are disabled by default – A cryptocurrency exchange is inherently more risky to use than a stock brokerage—because unlike stocks, crypto can be withdrawn and sent to an anonymous, private wallet. For this reason, crypto withdrawals at Robinhood are turned off by default. Although this can create a hassle for some crypto users, it also enhances security by making it nearly impossible for an attacker to withdraw the user’s crypto.

All of this, however, does not mean Robinhood is 100 percent risk-free. In the next section, I’ll go over some risks of using it.

Risks of Using Robinhood

Robinhood is a highly secure stock, ETF, and crypto brokerage, but there are still risks to using it.

Insurance usually won’t cover negligence

We learned earlier that Robinhood provides insurance to mitigate losses resulting from hacks on its platform, but that doesn’t extend to individual accounts, especially if the hack was the result of negligence. Whether or not you will be covered will hinge on factors like your adherence to recommended security practices.

For example, if your Robinhood account was hacked because you didn’t activate 2FA and you used an easy-to-guess password, the insurance might decide not to cover your losses. So while Robinhood offers safety nets in the form of insurance, it may not be universally useful in every case.

>> Also related: Is Credit Karma Safe?

2FA codes can be intercepted

Some hackers are very charismatic. They may be able to call up your phone company and trick it into transferring your phone service to a device the hackers control. In fact, this is a very common type of attack called a “SIM Swap Attack.”

If a hacker gets your phone service transferred to a device under his control, he can receive text messages intended for you, including your 2FA code. So 2FA isn’t a perfect solution to the problem of how to protect your Robinhood account.

Password hashes can be cracked

Even if your password is stored as a hash instead of plaintext, an attacker still may be able to crack the hash using Hashcat or some other cracking software. This is especially true if the password is weak.

Crypto Withdrawals Can Be Enabled Through the Robinhood Wallet

Robinhood is an especially secure exchange for crypto users, since it doesn’t allow crypto withdrawals by default. But some crypto users want to be able to withdraw their crypto into a wallet—because they want to use it to play video games, invest in DeFi apps, or make payments.

So even though Robinhood doesn’t allow withdrawals by default, an attacker can still withdraw your crypto from it if you end up needing to enable withdrawals.

Robinhood Privacy

As with all U.S.-licensed stock brokerages, Robinhood Crypto requires you to verify your identity. That means you can’t use the service unless you enter your name, address, Social Security number, and phone number, and upload photos of your driver’s license or passport.

That creates a risk of your personal information being revealed through a hack. Many Robinhood users were the victims of exactly this kind of attack in 2021.

>> Further reading: Is Webull Safe?

Robinhood Hack

In November 2021, Robinhood announced that it had been hacked, and the hacker had obtained 2 million names, 5 million email addresses, and several thousand phone numbers.1

Luckily, no Social Security numbers, bank account numbers, or debit card numbers were obtained, and no one suffered a financial loss from the breach.

The privacy of users was certainly violated, though, so it’s important to be aware of the risk, not only when using Robinhood, but also when using any licensed financial app.

In the next section, we’ll explain how to mitigate some of these risks and stay safe while using Robinhood Crypto.

How to Stay Safe When Using Robinhood Crypto

Here are a few tips to keep your Robinhood account safe and secure.

1. Use a strong password – Just in case an attacker ever gets your password hash, you may want to make your password as hard to crack as possible. You can do this by making the password especially long and by combining capital and lowercase letters with numbers and special characters. You can test how long your password hash might take to crack by using our How Secure is My Password tool.
2. Use an authenticator app for 2FA – Use Google Authenticator or another authenticator app to receive your 2FA code. This way, the code will not be sent using your phone service, which means that an attacker won’t be able to get the code by convincing your phone company to transfer service to his own device. The attacker could still get the code by stealing your phone. But hopefully, she isn’t that bold.
3. Check the url – Some attackers may try to send you to a fake Robinhood site in an attempt to record your login info. This is called “phishing.” They may do this by sending you an email that looks like it came from Robinhood. Inside the email is a link to the fake site. To help prevent this, each time you log into Robinhood, check the URL at the top of the screen. It should say Robinhood.com. If it says Robinhood@gmail.com, Robinh00d.com, or some other illegitimate domain, it’s most likely a scam phishing site.
4. Watch out for malware – One easy way for an attacker to get your login credentials is to infect your computer with keystroke-logging malware. To do this, the attacker sends you an email posing as someone you want to talk to. Inside the email is a file attachment that looks like legitimate software. When you run the file, it infects your computer with malware and allows the attacker to spy on everything that you’re doing, including what you type on your keyboard. The attacker uses this software to record your login info on all of your financial apps, including Robinood. To help avoid this type of attack, make sure to do a virus scan on any attachments you receive through email.
5. Don’t enable crypto withdrawals (or go ahead and withdraw it all) – If you’re buying crypto in the Robinhood app, consider leaving withdrawals disabled. If you must enable withdrawals (because you’re making payments with your crypto, for example), consider moving all of your crypto out of the app and into a private wallet, where keeping it secure should be easier.

Final Thoughts on Robinhood Safety

Robinhood is a great way to buy and sell stocks, ETFs, and cryptocurrencies, with zero fees. And for the most part, it’s safe. Robinhood also has great insurance protection, is registered with FinCEN to operate legally in the U.S., and employs cybersecurity experts for penetration testing.

Of course, it’s not 100 percent secure — no financial app is — so you should always be aware of the risks of using Robinhood and how to minimize them.

Robinhood is only one option for investing in stocks, ETFs, and crypto. For crypto in particular, you may want to check out Coinbase and Crypto.com as alternatives.