How to Secure a Crypto Exchange Account: A Step-by-Step Guide for Beginners

To secure a crypto exchange account before your first deposit, secure your email, set a password, turn on two-factor authentication, save recovery codes, add withdrawal controls and test it all, so you can buy cryptocurrency with the login and withdrawal protections already on. In a November 2025 alert (opens in a new tab), the FBI warned that MFA will not protect you if you land on a fraudulent login page, so a code typed into a fake page does not help.

What you need before you start

• Access to the email account you will sign up with, and your login for it.
• A phone for the second login check.
• A password manager for a new password, and pen and paper for recovery codes.
• Optional: a security key, a small external device that connects to your computer or phone through a port, a biometric or Bluetooth to log you in.
• A platform in mind. If you have not chosen one, read how to choose a crypto exchange first.

You do the work in the platform's security settings, and its help center explains anything that looks different from this guide. Account security comes from layers that each stop a different attack, so do not skip one because another is on.

How to secure your exchange account, step by step

1. Secure your email account first

   Your email is the reset channel for every account tied to it. The NCSC says (opens in a new tab) a criminal who reaches it could reset your other account passwords and get into your other accounts.

   Give your email a strong password you use nowhere else. If you have reused that password elsewhere, change it now. Then switch on 2-step verification in your email settings: it stops a criminal who has only your password, though not one who tricks you into typing your code on a fake page.

   Check: sign out of your email and sign back in. If the second check does not appear, go back to the settings.

2. Create the exchange account with a unique password

   Go to the platform through its official site or app and sign up with that email. Set a password you use nowhere else. The FBI advises (opens in a new tab) always using unique, complex passwords, and the NCSC warns (opens in a new tab) that if you reuse one, criminals only need one password to reach all your accounts.

   A password manager creates and stores long passwords for you. The NCSC advises (opens in a new tab) using one where a service does not support passkeys. Save the new password straight into it. If you use paper, keep it where only you can reach it.

3. Turn on the strongest two-factor authentication

   Open the security settings and find two-factor authentication (2FA), a second check besides your password. Different agencies call it MFA or 2-step verification (2SV): it is the same idea. The FBI advises (opens in a new tab) enabling it on any account possible and never disabling it. On some platforms, 2FA at sign-in does not cover withdrawals, so read step 5 before you finish.

   Pick the strongest option listed. A passkey and a security key are the two strongest here:

   • A passkey, a newer login method where you approve the login instead of typing a password (some platforms offer it as a second check). The NCSC says (opens in a new tab) passkeys are highly resistant to phishing and cannot be intercepted, reused or guessed like passwords.
   • A security key. CISA says (opens in a new tab) that because only the key owner has the device, phishing scams do not work against it, and phishing-resistant MFA is designed to prevent MFA bypass attacks, which get around a regular code, such as one typed into a fake page.
   • An authenticator app on your phone, which the NCSC calls (opens in a new tab) the main alternative to text messages.
   • Text messages (SMS), only if nothing else is offered. The NCSC notes they are not the most secure type of 2SV, but they are better than none.

   SMS has a specific weakness. The FTC says (opens in a new tab) that in a SIM swap, scammers may call your phone provider and say your phone was lost or damaged so your number moves to a SIM card they control. It adds that text verification may not stop a SIM card swap.

   Check: the settings should show 2FA as on. If the platform offers only SMS, use it, and look again for stronger options later.

4. Save your recovery codes offline

   The NCSC says (opens in a new tab) some accounts give you a list of backup codes when you switch on 2FA. Platforms may call them recovery codes. They can be used even if you lose your phone, and each code works only once.

   Copy them onto paper, not into a photo, screenshot or cloud note, and keep the paper away from your phone in a safe place only you can reach. Never share a code or type one anywhere except the platform's official login. If the platform gives no codes, look in the settings for a second 2FA option, since many services let you set up more than one.

   Recovery codes are not a seed phrase. They stand in for the second check on one account, while a seed phrase restores a self-custody wallet, which you create separately. Read what a seed phrase is before you ever set one up.

5. Set up withdrawal protection and an address allowlist

   Some platforms ask for 2FA again before a withdrawal or a new address, and some let you keep an allowlist: a list of withdrawal addresses you have approved, which some platforms call a withdrawal whitelist. An allowlist adds checks before coins can go to a new address, such as 2FA, an alert email or a wait, which can give you time to react.

   As of October 2026, Crypto.com's help center says (opens in a new tab) its App requires address whitelisting every time you send crypto to a new address, and asks for 2FA to whitelist an address from an untrusted device. If you have set up a passkey, you can use it for withdrawals; without one, you must verify withdrawals with 2FA and an SMS code. It also recommends turning on the 24-hour withdrawal lock, which applies to a newly added address if the feature is enabled.

   For its separate Exchange product, Crypto.com's reset page (opens in a new tab), last updated in June 2024, says withdrawals may be disabled for 24 hours after you successfully disable 2FA.

   Kraken sets 2FA per action. Its 2FA page (opens in a new tab) says the code can be used for signing in, trading, depositing or withdrawing funds, or as a Master Key, and that 2FA for each of these needs to be set up separately. Kraken also offers a Global Settings Lock. Kraken says (opens in a new tab) that the lock prevents adding a withdrawal address, and that without it an attacker who gets into your account can turn off or change 2FA for sign-in, funding, trading and the Master Key.

   These are single companies' rules; look for your platform's own in the security or withdrawal settings.

   Check: before you add an address, compare the whole address character by character with the one in your own wallet. An allowlist cannot tell you whether an address is yours, and a wrong one still loses the coins. See how to send crypto to your own wallet.

6. Turn on alerts, review devices and test a login

   In the settings, look for email or app alerts for logins, new addresses and withdrawals, and switch them on. Also look for a list of signed-in devices and remove any you do not recognize. The FBI advises (opens in a new tab) that you monitor your financial accounts regularly.

   Now test it. Log out, log back in with your password and second check, and confirm each works. Do not use a recovery code for the test. If the login fails, fix it with the platform's help center before you deposit.

Example: what each layer stops in a made-up break-in

This story is invented and names no platform. Suppose a small forum where you have an account leaks its passwords.

• A thief tries the leaked password on your exchange. A unique password means the leak never matches your exchange login.
• The thief sends you a link to a fake login page. A code typed into it can be stolen, but a passkey or security key is designed to resist this.
• The thief gets in anyway and tries to withdraw to a new address. Withdrawal 2FA, the allowlist and any new-address wait are meant to block or delay that send.
• An alert email arrives for the withdrawal you did not request. You contact support at once, as described in if you think someone got in.

How to sign in safely every time

The FBI advises (opens in a new tab) using bookmarks or favorites to go to login websites, or using the official app, and avoiding search results and advertisements. Criminals use phishing websites that look like the real company's site to trick you into giving away your login details, so this protects your cryptocurrency exchange account at every login.

The FBI says companies generally do not contact you to ask for your username, password or one-time passcode. If a caller or message does, end it and contact support from inside the official app. For more patterns, read how to spot crypto scams.

Some platforms also offer an anti-phishing code, a word or phrase you choose that appears in genuine emails from the platform. As of October 2026, Crypto.com's help center says (opens in a new tab) enabling one is recommended to help identify whether emails are legitimately from the Crypto.com App, and that once it is on, all emails from the App and Exchange include it. If your platform offers a code, turn it on and treat an email without it with suspicion.

If you think someone got in

Use a device you trust. If you see a withdrawal or an address you did not request, contact support first, through the official app and not a link from an email or message. Then work through these:

1. Change the exchange password, and change your email password if you reused it. If your phone number was swapped, the FTC says (opens in a new tab) to change your account passwords after you regain it.
2. Open the security settings, sign out all devices you do not recognize, and look for withdrawal addresses you did not add.
3. If you reset 2FA, remove the old entry from your authenticator app.
4. If you cannot log in because the password or email was changed, go to the platform's help pages through its official site or app.

As of October 2026, Crypto.com tells App users (opens in a new tab) who get an email for an action they did not request (address whitelisting or a crypto withdrawal) to contact support immediately, using in-app chat if possible. Its staff will help disable crypto transactions if necessary, attempt to stop the withdrawal request and change the passcode, which needs your identity verified. Note the word attempt: nothing promises you will get coins back.

To report a scam, see where to report a crypto scam.

Risks to understand

• If you lose your phone and your recovery codes, you may have to prove who you are. As of October 2026, the Crypto.com Exchange (opens in a new tab), for one, requires a video of yourself showing the ID you used to register on the Crypto.com App when you cannot access your authenticator.
• These settings protect your login. They do not protect your coins if the platform itself fails. Read how to store crypto safely.
• Methods, holds and options differ by platform and change over time, so check your own security settings rather than relying on a guide.

Once your account is locked down, read how to buy crypto step by step before you make your first deposit.