How to Secure Your Crypto Exchange Account: 2FA, Anti-Phishing, Scams
Most losses on exchanges don't come from bad trades — they come from hacks and scams: a fake website, "customer support" on Telegram, an SMS code sent to a stranger. Here are five settings and five scams you need to know about.
Five settings to turn on right away
| Setting | What it does |
|---|---|
| Unique password | A password leaked from another site won't unlock your exchange account |
| 2FA via an authenticator app | Without the code from your phone, nobody can log in or withdraw funds |
| Anti-phishing code | It appears in every genuine email from the exchange, so fakes are obvious at once |
| Withdrawal address whitelist | Funds can only be withdrawn to addresses added in advance |
| Login notifications | You'll know immediately if someone logs into your account |
App-based 2FA is more secure than SMS codes: a scammer can get your phone number reissued using forged documents (SIM swapping), while an authenticator app is tied to your device.
Five scams that cost people money
- Fake website. A link from an ad or a message leads to a copy of the exchange where you type in your login and codes yourself. Only log in through the official app or a bookmark.
- "Customer support" on Telegram. You post about a problem in a public chat, and a "member of the exchange team" messages you right away. Real support only works inside the app and never messages you first.
- An SMS code "for confirmation". Anyone who asks you to tell them a code is a scammer. The code is for you only, and only on the exchange's website.
- A transfer "for verification" or "to a safe account". No such procedures exist.
- P2P outside the exchange. A seller offers to "make it faster" by dealing directly, without a trade on the platform. Then there's no trade protection anymore — and no money either.
If something goes wrong
- Change your password and reset 2FA immediately.
- Freeze your account — major exchanges have this option in their security settings.
- Contact support through the official app.
- Check your email: make sure forwarding to someone else's address hasn't been turned on.
Our partner link. If you decide to open an OKX account, sign up through this link: it's free for you and doesn't change your terms in any way. If you trade, the exchange pays Aspiro a referral bonus, which goes toward developing our apps and the free Academy. We have no access to your account, your funds or your trades.
- Codes are for you only. Neither the exchange, nor a bank, nor an "analyst" will ever ask for them.
- Support never messages you first.
- Log in only via the app or a bookmark. Never via links in messages.
Frequently asked questions
What is an anti-phishing code?
It's a word or phrase you set in your exchange settings. It appears in every genuine email from the exchange — if an email doesn't contain your code, it's fake.
Which app should I use for 2FA?
Any widely used authenticator app will do. Save the backup key when you set it up — you'll need it if you change phones.
An exchange manager messaged me offering help. Is that normal?
No. Major exchanges don't message customers first on messaging apps. Stop the conversation and contact support through the official app.
Start with free education
A step-by-step OKX guide and free Aspiro Academy courses: 26 lessons on investing and trading from scratch, with practice and a certificate.