If you have ever logged into your MetaTrader terminal and found a stack of open trades you did not place — often the same symbol, same direction, with lot sizes that double or step upward each time price moves against you — you are looking at the signature of a grid or martingale bot. Sometimes that bot is one you installed yourself without fully understanding what it does. Sometimes it got there because credentials were shared with a "signal provider," a rented VPS, or a copy-trading service with broader access than it should have had. Either way, the fix is account hygiene, platform settings, and knowing what any automated strategy actually does before you let it near real capital. This guide walks through each layer, with worked numbers showing exactly why grid-style entries are so dangerous and how to keep them off your account.

What "Grid Entries" Actually Are and Why They Show Up Uninvited

A grid strategy opens a series of trades at fixed price intervals in the same direction, regardless of whether the market is moving for or against the position. A related cousin, martingale, increases the lot size after a loss in an attempt to recover the deficit on the next win. Both approaches can look profitable for weeks or months in calm, ranging conditions — then produce a catastrophic drawdown the first time price trends strongly in one direction without a pullback. That is precisely why some automated systems and "set and forget" bots quietly use grid or martingale logic under the hood: it inflates the equity curve during backtests and demo periods while hiding the tail risk.

You may encounter unwanted grid entries in a few common ways: an EA you installed turns out to use grid logic that was not disclosed clearly in its marketing; a "free" bot downloaded from an unverified source contains grid code baked in; or a third party with access to your terminal — a signal service, a "prop firm passing" seller, or a remote VPS operator — runs a grid script without your explicit, informed consent. None of these require a sophisticated hack. They require access, and access is the thing you control.

How Unauthorized Bots Typically Gain Account Access

Before you can prevent a bot from opening grid trades, it helps to understand how it got the ability to trade at all. MetaTrader platforms are explicit about this in their own documentation: automated trading requires the "AutoTrading" or "Algo Trading" button to be enabled in the terminal, and any EA needs to be attached to a chart with permission to trade live, as described in the official automated trading overview. In practice, unauthorized grid activity usually traces back to one of these:

• Sharing your master trading password instead of an investor (read-only) password with someone who only needed to "view" your account.
• Installing an EA from an unverified source that contains hidden grid or martingale logic not disclosed in its description.
• Leaving a VPS or remote desktop accessible with weak or reused credentials, allowing a third party to attach their own script to your terminal.
• Granting a "signal" or "copy trading" service more permission than needed, so it executes its own entries rather than only mirroring a published feed.
• Downloading a cracked or "free" version of a paid EA from a forum or file-sharing site — a common vector for both malware and undisclosed grid logic.

If you are unsure whether your current strategy relies on this kind of averaging-into-losers approach, our breakdown of how drawdown compounds when trades are averaged against the trend is a useful next read before you audit anything else.

Locking Down Account Access: Passwords, Permissions, and Platform Settings

The single most effective prevention step is controlling exactly who — and what software — can place trades on your account. MT4 and MT5 both separate credentials into two tiers, and mixing them up is the most common reason an outside bot ends up with more power than intended.

Two habits close most of the gap here. First, default to the investor password for anyone outside your own devices — including any accountant, mentor, or "verification service" that only needs to see results. Second, treat the AutoTrading toggle as a light switch, not a permanent setting: turn it off when you are not actively supervising a new or unfamiliar script, and only turn it back on for EAs you have personally reviewed. If you are setting up a VPS for the first time, our VPS setup walkthrough for forex trading covers the access-control basics most beginners skip.

Reviewing the Journal and Experts Tabs

MT4 and MT5 log every order request, rejection, and EA action in the "Experts" and "Journal" tabs at the bottom of the terminal, a feature documented in the MetaTrader 4 help center. If you see order requests you don't recognize — particularly a rapid series of same-symbol trades at regular price intervals — that is your first hard evidence of an active grid script, whether you installed it knowingly or not. Screenshot the log entries, including timestamps and lot sizes, before closing anything; you will want this record if you later dispute charges or report a scam.

How to Audit Any EA Before You Let It Touch Your Account

Whether an EA came from a marketplace, a friend, or a paid vendor, run it through a short checklist before you ever enable AutoTrading with it attached. The goal is to confirm the strategy's entry logic, risk sizing, and transparency before it can accumulate a grid of positions you did not authorize.

The MQL5 documentation is a useful reference if you want to understand what a script is technically capable of doing once attached to a chart, and the MQL5 Market lists EAs with published descriptions you can cross-check against actual behavior in a demo account first. Before committing real capital to any EA, our guide to understanding EA settings and inputs explains how to read a strategy's parameter sheet for hidden grid or averaging switches disguised as "recovery mode" or "smart lot" options.

The Math Behind Why Grid and Martingale Entries Wreck Accounts

Grid and martingale systems fail for a mathematical reason, not a bad-luck reason: position size grows faster than the account's ability to absorb further adverse movement. Consider a simplified martingale sequence on a $10,000 account, starting at 0.10 lots and doubling the lot size after each consecutive loss, with each loss measured against a fixed adverse move:

Six consecutive losing legs against a $10,000 account — not an unusual occurrence during a strong trending move in gold — consumes roughly two-thirds of the account, and a seventh leg would very likely trigger a margin call before it even completes. This is the mechanism regulators warn about: a strategy can look like a smooth, high-win-rate system for dozens of trades, right up until one extended trend erases months of gains in days. The CFTC's advisory on trading system fraud specifically flags "recovery" systems that increase position size after losses as a pattern investors should scrutinize closely, precisely because the smooth-looking equity curve conceals the tail risk shown above.

Understanding this math is also why a system's approach to drawdown matters more than its win rate. A strategy that stays flat between trades and sizes positions off account risk, rather than off the outcome of the last trade, cannot produce this kind of runaway exposure. If you want a deeper walkthrough of how position sizing interacts with account risk more broadly, see our piece on capital preservation techniques for EA trading.

Recognizing Red Flags in Bots and Signal Providers

Beyond the technical checklist, a handful of behavioral red flags tend to precede unauthorized grid activity on retail accounts. Watch for vendors or "account managers" who ask for your full trading password rather than an investor password when they only claim to need visibility. Watch for marketing that emphasizes an unbroken win streak without ever showing a drawdown chart — real strategies, including disciplined ones, have losing trades and equity dips. And watch for any pitch that uses the words "guaranteed," "risk-free," or "can't lose," since the FTC's guidance on investment scams and the CFTC's forex fraud resource page both identify these specific phrases as hallmarks of misrepresented trading products, not honest ones.

Another pattern worth flagging: a "free trial" bot that performs conservatively for the first week, then ramps up position sizing once you have granted broader account permissions. This staged approach is a known tactic for building trust before a strategy's true, often grid-based, risk profile shows up. If a provider pressures you to act quickly, avoids detailed questions about entry logic, or discourages testing on a demo account first, treat that reluctance itself as diagnostic information.

Comparing Disclosed vs. Undisclosed Entry Logic

You do not need to see proprietary source code to judge whether a system is being upfront with you. A vendor can honestly describe a strategy in general terms — for example, "a rules-based approach using trend and momentum confirmation on a higher timeframe, with one trade held at a time and no adding to losing positions" — without revealing exact formulas. If a provider cannot or will not describe even that much, or dodges the question of how many trades can be open simultaneously, that avoidance is itself useful information before you connect it to a funded account.

Verifying a Track Record Instead of Trusting Screenshots

Screenshots of a profit-and-loss statement are trivial to fabricate or selectively crop. A verified third-party record is not. Services like Myfxbook connect directly to a live trading account via investor password and publish the full, unedited trade history, including losing trades and drawdown periods — exactly the data a hidden grid strategy would rather you not see. Myfxbook's own verification knowledge base explains how the "verified" badge confirms the account is genuinely connected and not just a static export a vendor controls.

Before trusting any bot with real capital, look for a live-linked, verified track record you can inspect yourself — not a PDF, not a monthly summary email, and not a number quoted in a sales page. A verified feed lets you check exactly what this guide has been describing: how many positions are open at once, whether lot sizes escalate after losses, and how the account behaved during the worst trending weeks on record, rather than only the calm ones. For a related look at what separates a genuinely profitable automated approach from a curated demo, see our analysis of whether automated gold trading is actually profitable.

Broker- and VPS-Level Protections Worth Enabling

Account security is not only a MetaTrader-settings problem. Most regulated brokers offer additional layers that reduce the chance of an outside bot gaining access: two-factor authentication on the broker portal, separate from your trading password; login alerts that flag any sign-in from a new device or location; IP allow-listing on VPS access, which blocks casual credential-stuffing attempts if your provider supports it; a demo-testing period of at least several weeks for any new EA before it touches a funded account; and withdrawal confirmation requirements, which protect you even if trading credentials are somehow compromised.

Building a Grid-Free Risk Framework for Your Account

Prevention is easier when your baseline setup does not depend on trusting every new bot you try. A few structural habits keep unauthorized grid entries from ever having room to operate: assign one EA per chart and one magic number per strategy so you can immediately identify which script placed which order — see our explainer on how EA magic numbers work if this concept is new to you; cap the total number of simultaneously open positions across your account, either through broker-side settings or a monitoring script, so a runaway grid cannot silently scale; and backtest any new EA over multiple market regimes, not just a favorable stretch, before granting it live AutoTrading permission.

If you run more than one EA, review our notes on diversifying across multiple EAs safely so overlapping strategies cannot each add to correlated exposure the same way a grid would.

Golden Viper EA was built around this exact concern. It trades only XAUUSD on the H4 timeframe, taking roughly one qualifying setup per day at most, using risk-based lot sizing across three selectable risk modes — Conservative, Normal, and Aggressive — rather than lot sizes that escalate after a loss. There is no martingale, no grid, and no averaging into losing positions built into its logic; a single position is managed with a profit-lock mechanism on winning trades and an optional safety stop, and every trade is visible in your own MT4 or MT5 Journal tab as it happens. The live track record is published and verifiable on Myfxbook under account 11943038, alongside an MQL5 signal you can inspect independently before ever connecting it to your own account. The EA runs under a one-time $199 license covering both MT4 and MT5 for the account's lifetime — no subscription, no free trial, no money-back guarantee — with a $30/month copy-signal option available if you would rather mirror trades through MQL5 than run the EA directly. You can review the full specification on the Golden Viper EA product page or read more about the team behind it on the about page.

What to Do If You Already Suspect Unauthorized Grid Activity

If you have found unfamiliar trades on your account right now, act in this order. Disable AutoTrading immediately from the terminal toolbar so no further automated orders can be placed. Manually review and close the open positions yourself rather than trusting the bot to unwind them — a grid system left running will often keep adding to the position as price continues moving against it. Change your master trading password and, if a VPS was involved, your VPS login as well; assume any shared credential is compromised. Remove the EA file itself from the terminal's Experts folder so it cannot be re-attached accidentally. Finally, document what happened — screenshots of the Journal tab, the EA's name and source, and any vendor communication — in case you need to report the incident to your broker, card issuer, or a regulator. If you are also evaluating whether the strategy you were sold is legitimate at all, our overview of what separates a proven trading system from a marketing claim is a useful gut-check.

Risk disclosure: trading foreign exchange and commodities such as gold carries substantial risk, and losses are possible even with a disciplined, risk-managed approach. Past performance, including any verified track record referenced above, does not guarantee future results. Only trade with capital you can genuinely afford to lose, and review concepts like drawdown and risk management before connecting any automated system to a live account.

Frequently Asked Questions

How do I know if a bot on my account is using a grid strategy?

Check the Experts and Journal tabs in your MT4 or MT5 terminal for a pattern of same-symbol trades opened in the same direction at regular price intervals, often with lot sizes that increase after losses. Several open positions on one symbol stacking up as price moves against them is the classic signature of a grid or martingale system.

Can someone place trades on my account without my master password?

Generally no. Standard trade execution requires the master trading password and an active AutoTrading or Algo Trading permission in the terminal. However, an investor password combined with a compromised VPS, or an EA you installed yourself that contains undisclosed grid logic, can produce the same result without anyone directly "hacking" your login.

Is a grid strategy always a scam?

Not necessarily, but it is a high-risk approach many vendors misrepresent using terms like "smart recovery" or "advanced averaging." The issue is less about intent and more about undisclosed risk: a strategy that adds to losing positions can look profitable for a long stretch, then produce a severe drawdown quickly — which is why transparency about entry logic matters so much.

What is the difference between an investor password and a trading password?

An investor, or read-only, password only allows viewing account balance, equity, and trade history — it cannot place, modify, or close any order. A master trading password grants full control, including attaching EAs and executing trades. Anyone who only needs to "verify" your results should only ever receive the investor password.

Should I turn off AutoTrading between sessions?

It is a reasonable precaution, particularly while testing a new or unfamiliar EA. Leaving AutoTrading permanently enabled means any script currently attached to a chart, including one you forgot about, can execute trades without further confirmation from you.

Does Golden Viper EA use grid or martingale entries?

No. Golden Viper EA uses risk-based lot sizing across three selectable risk modes and does not increase position size after a loss, add to a losing position, or run multiple simultaneous grid legs. It manages one XAUUSD position at a time on the H4 timeframe with a profit-lock mechanism and an optional safety stop.

How can I verify a bot's track record before trusting it with real money?

Look for a live-linked, third-party verified account, such as one published on Myfxbook, rather than screenshots or PDF summaries. A verified feed shows the complete, unedited trade history, including drawdowns and losing streaks, which makes it far harder to hide grid-style risk behind a curated highlight reel.

What should I do first if I find unauthorized trades on my account?

Disable AutoTrading immediately, manually review and close the open positions yourself, then change your trading password and VPS credentials. Remove the unfamiliar EA file from your terminal before reconnecting, and keep screenshots of the Journal tab in case you need to report the issue to your broker or a regulator.

Are free or cracked versions of paid EAs more likely to contain hidden grid logic?

Yes. Files distributed outside official, verifiable vendor channels are a common vector for both malware and undisclosed strategy changes, including grid or martingale logic added to a script that was not originally built that way.

Can a signal provider place grid trades on my account even if I only wanted to copy their signals?

It depends on the permissions you granted. A properly structured copy-trading or signal service should only require your investor password for verification, with trade replication happening through a controlled, disclosed mechanism. If a "signal" service asked for your full trading password or direct EA installation access, it has the technical ability to run any strategy it chooses on your account, including one you never agreed to.