2FA and phishing hygiene for crypto accounts
Protect exchange and email accounts with app-based 2FA instead of SMS, and learn the daily habits that defeat phishing links and fake messages.
Most stolen crypto is not taken by breaking clever cryptography. It is taken by tricking people. Strong account settings and a few calm habits stop the majority of these attacks.
What is 2FA?
Two-factor authentication (2FA) means you need two things to log in: something you know (your password) and something you have (usually your phone or a security key). Even if someone steals your password, they still need the second factor.
Authenticator app beats SMS
SMS codes are better than nothing, but they have a known weakness called a SIM swap. A criminal convinces your mobile carrier to move your phone number to their SIM card. From then on, your login codes go to them.
An authenticator app generates codes on your own phone, so a SIM swap cannot capture them. A physical security key is stronger still where supported. Save the 2FA backup codes on paper, like your seed phrase, so you can recover if your phone is lost.
Tom's exchange account uses SMS codes. A scammer SIM-swaps his number, resets his email password via SMS, then logs into the exchange and withdraws his 1,200 USDT. With an authenticator app on both email and exchange, the stolen phone number alone would not have been enough.
Secure your email first
Your email is the master key to most accounts, because password resets go there. Give it a unique, long password and app-based 2FA. Use a different password for every crypto service. A password manager makes this easy.
Phishing hygiene
Phishing means fake messages or websites that imitate real ones to steal logins, codes or seed phrases. Habits that help:
- Bookmark the real sites of your exchange and wallet, and only use those bookmarks.
- Do not click links in emails, texts or direct messages about your account. Open the site yourself instead.
- Be careful with search ads. Scammers sometimes buy ads that lead to copycat sites.
- Check the address bar. Look for small spelling changes, such as an extra letter or a different ending.
- Distrust urgency. "Act within 24 hours" or "your account is locked" is a pressure tactic.
- Turn on withdrawal allowlists on exchanges, so funds can only go to addresses you saved in advance.
Never share a 2FA code with anyone, even "support". A real support agent never needs your code to help you.
Your practice wallet at /app/trade uses virtual USD (no real value). It is a safe place to learn trading, but treat your real exchange and email accounts with the full security setup above.
A free account tracks lessons, unlocks the quizzes and gives you 10,000 virtual USD (no real value) to practise with.