Agreed, there are so many passwords and secure device responses to overcome.....I'd say it is indeed foolproof. Thanks IB for implimenting these devices long ago!
If simplest is best then setting things up with your broker so that 1) a change of address can not be done without written permission and confirmation via a telephone call to you, never from you 2) disallow all wire transfers and allow checks shipped out via a commercial carrier only, so that even a bogus change of address at your post office will not cause the checks to be misdirected to an ID thief's address. .