2FA, anti-phishing codes, and withdrawal allowlists

A password only proves that someone knows one secret. If your email is also open, the exchange password usually falls with it, because the attacker uses “forgot password”. The next layers are 2FA and withdrawal rules that cannot be bypassed in one night.

1. Prefer an authenticator app over SMS when both exist

SMS can be redirected with a SIM swap: someone convinces the carrier the card was lost, and the OTP arrives on their card. An authenticator app (Google Authenticator, Aegis, Authy, or an equivalent) makes the code on your phone without SMS.

1. Install the authenticator from the official store before you turn 2FA on.
2. In the exchange security menu, choose the authenticator and scan the QR code.
3. Type the 6-digit code to confirm.
4. Store the backup codes shown once. Write them on paper, away from the phone. A photo in a gallery that syncs to the cloud is almost the same as having no backup.

2. If the phone is lost

Plan this before it happens. Without backup codes, recovery depends on exchange support and can take days, plus another identity check. With backup codes, you enroll a new phone and revoke the old one.

Do not photograph the 2FA QR code and send it to “a friend who understands”. Anyone with that QR can produce the same codes.

3. Anti-phishing code on email

Many exchanges let you set a short secret word. That word must appear on their real emails. A fake email with the right logo does not know the word.

1. Pick a word you do not use as a password, and that is not your name or birth date.
2. Keep it in a password manager or a separate note.
3. On every “withdrawal completed” or “new device” email, look for the word. If it is missing, do not click buttons in that email. Open the app from your bookmark and check activity there.

4. Withdrawal address allowlist

An allowlist means funds can leave only to addresses you already added. Adding a new address often waits several hours up to a day or more. The delay is intentional: someone who breaks in today cannot empty the account to their address immediately.

• Add your own wallet address when you are calm, not while panicking.
• Send a small amount first, confirm it arrived, then raise the amount.
• Match the network. A correct address on the wrong network can mean the funds never arrive. See deposits and networks.
• Do not turn the allowlist off because a chat said it would make withdrawals faster.

5. Devices and email

• The exchange email uses a unique password, plus 2FA on that email.
• Lock the phone screen. An authenticator on an unlocked phone is open.
• Do not sign in on a shared computer or through a browser extension you installed from an ad.
• If there is a connected-apps or API-key screen, delete keys you do not recognize. An API key that can withdraw is a password.

6. Signs someone else has the account

• A “new login” email for activity that was not you.
• 2FA suddenly off, or switched to an SMS number that is not yours.
• A new withdrawal address you did not add.
• Balance moved into a product you never opened.

From another device: change the email password first, then the exchange password, revoke sessions, and open an official ticket. Do not reply to the warning email if the anti-phishing word is missing.

7. A sensible order before the first deposit

1. Bookmark the official domain.
2. Unique password.
3. Authenticator plus backup codes on paper.
4. Anti-phishing word, then a test email if the menu offers one.
5. An empty allowlist is safer than a rushed one. Fill it after you have your own address and a small test transfer.

Other basics: fake sites · rejected KYC · 2FA and withdrawals · missing deposits · comparing exchanges.