What the crypto account security check covers
The crypto account security check follows the path an attacker usually takes: the password, the second factor, the email account, the phone and finally the withdrawal.
Closing each of those doors makes an account takeover much harder, even if one of them is opened.
The ten protections in the crypto account security check
| Protection | What it stops |
|---|---|
| Two-factor authentication by app, passkey or key | Logins with a stolen password |
| Unique password in a password manager | Reuse of passwords leaked from other sites |
| Secure email account | Password resets by whoever controls your email |
| Withdrawal address allow-list | Withdrawals to an attacker's address |
| Offline recovery phrase | Theft of a self-custody wallet |
| Typed address or bookmark | Fake login pages in search ads and messages |
| Updated, locked devices | Malware and physical access |
| SIM swap protection | Takeover of SMS codes |
| Login and withdrawal alerts | Attacks going unnoticed |
| Never sharing codes or screens | Fake support scams |
Why SMS is the weakest second factor
SMS codes are better than no second factor, but they depend on your mobile number.
In a SIM swap, a criminal persuades a mobile operator to move your number to their SIM card and then receives your codes.
An authenticator app, a passkey or a hardware security key does not depend on your number, which is why the crypto account security check gives them full points.
Your email account is the master key
Most exchanges let you reset a password by email, so whoever controls your email can often control your exchange account.
Protect the email account with the same care: a unique password, two-factor authentication and a check of which devices are logged in.
Allow-lists and withdrawal delays
A withdrawal address allow-list lets you send crypto only to addresses you have saved in advance.
Many exchanges also delay withdrawals to a newly added address, which gives you time to notice and stop an attack.
Whether an exchange offers these features is part of the User protection score in our Reliability Score.
Fix the gaps from your crypto account security check
- Email first: secure the email account linked to your exchanges.
- Second factor: switch from SMS to an app, passkey or security key.
- Passwords: unique for every exchange, stored in a password manager.
- Withdrawals: switch on the allow-list and alerts.
- Recovery phrase: move it offline, as the guide to seed phrases explains.
- Habits: bookmark your exchange and never share codes.
The guide to crypto account security explains each step in detail.
Crypto account security check: setting up two-factor authentication
- Install an authenticator app from the official app store, or prepare a security key.
- Open the exchange's security settings through its official app or a bookmark.
- Choose app-based 2FA or a passkey, and scan the code or register the key.
- Store the backup codes offline, on paper in a safe place.
- Remove SMS as a fallback if the exchange allows it.
- Repeat for your email account, which protects every password reset.
Crypto account security check: email hygiene
- Use an email address only for financial accounts, not for newsletters and shopping.
- Check the list of devices logged in to your email and remove unknown ones.
- Check for forwarding rules you did not create, a trick used to intercept codes.
- Never click links in emails about account problems; log in through your bookmark instead.
Crypto account security check: device safety
| Device setting | Why it matters |
|---|---|
| Automatic updates | Closes known security holes |
| Screen lock with PIN or biometrics | Stops anyone who picks up your phone |
| Apps only from official stores | Reduces the risk of malware and fake apps |
| No remote-access apps unless you installed them yourself for a known reason | Prevents takeover through "support" scams |
Crypto account security check: what exchanges offer
Security features vary between providers, and they are part of the User protection score in the Reliability Score.
Bit2Me, for example, lists password, 2FA, authorised IP addresses and authorised devices among its account controls on its security page.
Checked on the provider's website on 24 October 2026.
Where an exchange offers withdrawal allow-lists or delays for new addresses, switch them on.
If your crypto account is compromised
- Contact the exchange through its official site or app immediately and ask to freeze the account.
- Secure your email from a clean device.
- Change passwords and reset two-factor authentication.
- Record what happened and report it, as the guide to reporting explains.
Crypto account security check: a 15-minute setup order
- Email first: a unique password and app-based 2FA on the email account linked to your exchange.
- Password manager: a unique, long password for the exchange account.
- Two-factor authentication: an authenticator app, a passkey or a security key instead of SMS where possible.
- Backup codes: stored offline, separate from your phone.
- Withdrawal allow-list: only your own wallet addresses, if the provider offers it.
- Notifications: alerts for logins, withdrawals and security changes.
- Anti-phishing code: if the provider offers one, so genuine emails can be recognised.
Run the crypto account security check again afterwards to confirm that every item is covered.
Crypto account security check: phishing patterns to recognise
| Pattern | What it looks like | What to do |
|---|---|---|
| Urgent security alert | "Your account will be frozen in 24 hours unless you verify" | Open the app yourself, never the link |
| Fake support | Someone offers help after you post a question online | Use only support inside the official app |
| Wallet "sync" or "validation" | A site asks for your seed phrase to fix a problem | Never enter it anywhere |
| Lookalike address | A domain with an extra letter or a different ending | Use a saved bookmark |
| Phone call from "the exchange" | A caller asks for a code or to move funds to a "safe" account | Hang up; providers do not ask this |
Common patterns described in regulators' and providers' warnings; the wording varies.
Crypto account security check: questions readers ask
Is an authenticator app enough? It is much stronger than SMS, and a passkey or hardware security key is stronger still against phishing.
What if I lose my phone? Use your backup codes or the provider's recovery process, and change your passwords from a trusted device.
Does the check store my answers? No; the check runs in your browser and nothing is sent to the site.
Repeat the check after changing phones.
A new phone needs its authenticator app moved or set up again before the old one is reset.
Frequently asked questions
What is the most important crypto account security setting?
Two-factor authentication by app, passkey or security key, together with a secure email account, because most takeovers start with a stolen password or email.
Is SMS two-factor authentication safe enough?
It is better than nothing, but it can be bypassed with a SIM swap. An authenticator app, a passkey or a security key is stronger.
What is a withdrawal allow-list?
A setting that lets you withdraw only to addresses saved in advance, often with a delay for new addresses.
Should I store my recovery phrase in a password manager?
Many security guides advise keeping a recovery phrase offline, away from any internet-connected device, because anyone with the phrase controls the wallet.
Will exchange support ever ask for my security code?
Genuine support does not need your codes, your password or your recovery phrase. A request for them is a sign of a scam.
Are my answers to the crypto account security check stored?
No. The check runs in your browser, and nothing is saved or sent.
Every figure on this page is checked against the ESMA register, the exchange's own terms and fee pages or another primary source, and the sources are listed above. Editorial policy · How we rate