Security decision matrix
Identify the threat before changing settings
Fast action helps only when it matches the incident. Start with the account, email, device, and withdrawal path.
| Signal | Likely risk | First safe action |
|---|---|---|
| Unexpected login alert | Possible credential exposure | Secure email first, then review sessions from a clean device. |
| 2FA device lost | Access recovery risk | Use official recovery. Do not pay anyone or share backup codes. |
| Fake support contact | Phishing or recovery scam | Stop replying. Open the provider through a bookmark or typed domain. |
| Unknown API key | Automated account access risk | Revoke it, rotate credentials, and review trades and withdrawals. |
| Withdrawal address changed | Funds may be at immediate risk | Freeze withdrawals if available and contact official support. |
| Account locked | Security, KYC, region, or policy review | Read the exact status and use the matching official appeal route. |
2FA setup desk
Pick the method and the backup together
The best 2FA setup is not only the strongest method. It is the method you can use, recover, and refuse when a fake site asks for it.
Best when the exchange supports it and you can manage recovery
This can resist many fake-login attacks better than typed codes, but you need a backup key or recovery plan before relying on it.
Register a backup method according to the provider's rules.Good default for many beginners
Authenticator apps avoid some phone-number risks, but the setup QR code and backup codes must be protected like credentials.
Store recovery codes somewhere separate from the phone.Useful backup, weaker as the only defense
Phone numbers and email accounts can be targeted. If this is the only available method, make the email and mobile account much stronger.
Use it as a fallback only when stronger options are unavailable.Convenient, but dangerous when unexpected
A push prompt is safe only when you initiated the login or withdrawal. Unexpected prompts can be attacker attempts.
Deny prompts you did not start and review account activity.Prompt discipline
Codes prove you, not the website
- Do not enter a code after following an unexpected link.
- Do not read a live 2FA code to support or a caller.
- Do not approve a prompt you did not start.
- Do not store setup QR codes or recovery codes in exposed screenshots.
Choose the strongest method you can manage
Available methods may include a security key or passkey, an authenticator app, SMS, email codes, or device approval. The exchange decides which methods it supports for login, withdrawals, and security changes.
NIST's current digital identity guidance distinguishes ordinary one-time codes from phishing-resistant cryptographic authentication. Where a reputable exchange supports a security key or passkey and you understand its recovery process, that can provide stronger phishing resistance than typing a code into a website.
A stronger method is only useful if you can recover it safely. Before choosing, check whether the provider supports backup keys, backup codes, trusted devices, identity review, or a second authenticator.
Set up 2FA from the official account
Type or use a saved bookmark for the exchange's verified domain, sign in, and open its security settings. Do not begin from an email, direct message, search ad, or QR code sent by another person.
Follow the live instructions and confirm the new method before relying on it. If a QR code or setup secret is displayed, treat it like a credential: anyone who copies it may be able to generate valid codes.
Do the setup before funding the account. It is easier to slow down, test login, and fix recovery while there is no meaningful balance at risk.
- Verify the domain and app publisher
- Secure the linked email account first
- Use a unique exchange password
- Register the authentication method privately
- Test sign-in before ending the setup session
- Enable login, withdrawal, and security-change alerts
Prepare recovery before you need it
Save provider-issued recovery codes or backup methods in a protected place separate from the everyday phone. NIST defines a recovery code as a secret that can restore access when the normal authenticator is unavailable.
Do not store a recovery code in a public note, unprotected screenshot, chat, or email draft. If the provider supports more than one strong authenticator, consider registering a protected backup according to its current rules.
Write down what you would do if the phone is lost, the authenticator app is deleted, the email account is compromised, or a security key is unavailable. That plan should not depend on the same device for every step.
Use 2FA without being phished
A one-time code is not a signal that a website or caller is legitimate. Never read a code to support, approve a prompt you did not initiate, or enter a code after following an unexpected link.
The FTC advises contacting a company through a website or phone number you already know is real rather than using information in a suspicious message. If a prompt appears unexpectedly, deny it and review the account from a clean device.
If you see a login prompt you did not start, treat it as an incident, not as a nuisance. Secure email, review sessions, check API keys and withdrawal addresses, and do not approve the prompt to make it disappear.
Review the setup after account changes
After changing a password, email, phone number, authenticator, device, or withdrawal allowlist, review the whole security page again. Some providers apply temporary withdrawal holds after sensitive changes.
Keep old devices and authenticator apps until the new setup is confirmed and recovery material is stored. Then remove methods you no longer control.
If you lose the authenticator later, use the official recovery process instead of asking social-media contacts, referral publishers, or paid recovery services to reset it.
Common questions
Frequently asked questions
Is an authenticator app better than SMS for a crypto exchange?
An authenticator app avoids some phone-number attacks, while a security key or passkey may offer stronger phishing resistance when properly supported. Use the strongest method you can secure and recover.
Should I screenshot the 2FA QR code?
Avoid leaving an unprotected copy. The QR code or setup secret may let another person generate valid codes. Follow the provider's backup instructions and protect recovery material offline.
Does 2FA make a crypto exchange account completely safe?
No. It does not remove phishing, malware, compromised email, malicious API keys, withdrawal mistakes, exchange failure, or market risk.
What should I do if I get a 2FA prompt I did not start?
Deny it, do not enter any code, and review the account from the verified website or app. Secure email, sessions, API keys, and withdrawal settings if anything looks unfamiliar.
Primary references
Official sources checked
These official pages were reviewed on June 15, 2026. Exchange policies can change, so open the source before acting.