Complete Account Security Guide

Unlike a bank, most cryptocurrency transactions cannot be reversed once confirmed, and account recovery options are often more limited. That makes proactive security far more important than with many traditional financial accounts — the protections below take only a few minutes to set up but make unauthorized access dramatically harder.

Enable Two-Factor Authentication (2FA)

Two-factor authentication requires a second, time-limited code in addition to your password whenever you log in or make sensitive changes. This means that even if someone obtains your password, they still can't access your account without also having your second factor.

1. Download a reputable authenticator app on your phone.
2. In your account's security settings, choose to enable authenticator-app 2FA.
3. Scan the QR code shown with your authenticator app to link the two.
4. Enter the six-digit code generated by the app to confirm the setup.
5. Store any backup codes shown during setup somewhere safe and offline.

Anti-Phishing Code

An anti-phishing code is a short phrase you choose yourself, which then appears in every genuine email the platform sends you. If an email claiming to be from Binance doesn't show your correct code, or shows no code at all, treat it as suspicious and do not click any links inside it.

1. Go to the security settings section of your account.
2. Find the anti-phishing code option and choose a unique phrase (avoid anything guessable).
3. Save the change, then check that your code appears in the confirmation email sent to you.

Device Management

Most platforms let you view every device and session currently logged into your account, along with its approximate location and last activity. Reviewing this list periodically helps you catch unauthorized access early:

• Check your account's active sessions or device management page every so often
• Log out or revoke access for any device you no longer use or don't recognize
• Pay attention to login notifications, especially from unfamiliar locations

Withdrawal Whitelist

A withdrawal whitelist restricts outgoing transfers to a pre-approved list of addresses, meaning withdrawals to any new, unapproved address require additional confirmation (and a waiting period on some platforms). This significantly limits what an attacker could do even if they gained access to your account.

1. Go to the withdrawal or address management settings in your account.
2. Enable the whitelist feature and add only addresses you fully trust and control.
3. Leave the setting enabled going forward, adding new addresses only when genuinely needed.

Password Safety

Reused or weak passwords are one of the most common ways accounts are compromised across the internet, not just in crypto. Use a long, unique passphrase for this account specifically, ideally generated and stored by a reputable password manager rather than memorized and reused. Always access the official website directly — bookmark it rather than searching or clicking links each time.

Scam Prevention

Most account compromises start with social engineering rather than technical hacking. Be cautious of messages that create urgency ("verify now or lose access"), impersonate support staff, or ask you to move funds, share your screen, or reveal a verification code. Legitimate platforms will never ask you for your password, 2FA codes, or recovery codes through email, chat, or phone.

Recovery Tips

Recovery codes let you regain account access if you ever lose your 2FA device. Because they can bypass your second factor, they deserve the same care as your password: store them offline, such as written down and kept in a secure physical location, rather than saved in an email inbox, cloud note, or screenshot on your phone. If you ever suspect your account is compromised:

1. Immediately change your password from a trusted, secure device.
2. Review and revoke any unfamiliar active sessions or API keys in your security settings.
3. Check your 2FA, whitelist, and anti-phishing code settings haven't been altered.
4. Contact official support through the app or website directly — never through a link someone sends you.