Choose the strongest method you can manage
Available methods may include a security key or passkey, an authenticator app, SMS, email codes, or device approval. The exchange decides which methods it supports for login, withdrawals, and security changes.
NIST's current digital identity guidance distinguishes ordinary one-time codes from phishing-resistant cryptographic authentication. Where a reputable exchange supports a security key or passkey and you understand its recovery process, that can provide stronger phishing resistance than typing a code into a website.
Set up 2FA from the official account
Type or use a saved bookmark for the exchange's verified domain, sign in, and open its security settings. Do not begin from an email, direct message, search ad, or QR code sent by another person.
Follow the live instructions and confirm the new method before relying on it. If a QR code or setup secret is displayed, treat it like a credential: anyone who copies it may be able to generate valid codes.
- Verify the domain and app publisher
- Secure the linked email account first
- Use a unique exchange password
- Register the authentication method privately
- Test sign-in before ending the setup session
- Enable login and withdrawal alerts
Prepare recovery before you need it
Save provider-issued recovery codes or backup methods in a protected place separate from the everyday phone. NIST defines a recovery code as a secret that can restore access when the normal authenticator is unavailable.
Do not store a recovery code in a public note, unprotected screenshot, chat, or email draft. If the provider supports more than one strong authenticator, consider registering a protected backup according to its current rules.
Use 2FA without being phished
A one-time code is not a signal that a website or caller is legitimate. Never read a code to support, approve a prompt you did not initiate, or enter a code after following an unexpected link.
The FTC advises contacting a company through a website or phone number you already know is real rather than using information in a suspicious message. If a prompt appears unexpectedly, deny it and review the account from a clean device.
Common questions
Frequently asked questions
Is an authenticator app better than SMS for a crypto exchange?
An authenticator app avoids some phone-number attacks, while a security key or passkey may offer stronger phishing resistance when properly supported. Use the strongest method you can secure and recover.
Should I screenshot the 2FA QR code?
Avoid leaving an unprotected copy. The QR code or setup secret may let another person generate valid codes. Follow the provider's backup instructions and protect recovery material offline.
Does 2FA make a crypto exchange account completely safe?
No. It does not remove phishing, malware, compromised email, malicious API keys, withdrawal mistakes, exchange failure, or market risk.
Primary references
Official sources checked
These official pages were reviewed on June 15, 2026. Exchange policies can change, so open the source before acting.