🎣 What is an Anti-Phishing Code?
An anti-phishing code is a unique security phrase that you set in your exchange account settings. It appears in all legitimate emails from the exchange, helping you distinguish real communications from phishing attempts.
Phishing is one of the most common ways hackers steal crypto. They send fake emails that look like they're from your exchange, tricking you into clicking malicious links or entering your credentials. Your anti-phishing code is a simple but powerful defense against this.
When you set an anti-phishing code, the exchange includes it in every email they send you. If you receive an email that claims to be from the exchange but doesn't contain your code, it's a fake. Never click links in emails without your code.
📝 How to Set Up an Anti-Phishing Code
Setting up an anti-phishing code is quick and easy. Here's how to do it on major exchanges.
-
1
Log in to your exchange account
Go to your exchange's website and log in (Binance, OKX, Bybit, KuCoin, etc.).
-
2
Navigate to security settings
Look for "Security," "Anti-Phishing Code," or "Security Phrase" in your account settings.
-
3
Enter your anti-phishing code
Type in a unique, memorable phrase. This will appear in all legitimate exchange emails.
-
4
Save and confirm
Save the settings. You may need to confirm with 2FA or email verification.
-
5
Test it
Trigger a legitimate email from the exchange (e.g., a withdrawal confirmation) and verify that your code appears.
Exchange-Specific Locations
| Exchange | Feature Name | Location |
|---|---|---|
| Binance | Anti-Phishing Code | Security Settings → Anti-Phishing Code |
| OKX | Security Phrase | Security Settings → Security Phrase |
| Bybit | Anti-Phishing Code | Account & Security → Anti-Phishing Code |
| KuCoin | Anti-Phishing Code | Security Settings → Anti-Phishing Code |
| Coinbase | Security Phrase | Settings → Security → Security Phrase |
After setting up your anti-phishing code, test it immediately. Request a withdrawal confirmation email or a login notification to verify that your code appears. If it doesn't, contact support.
🔑 Choosing Your Anti-Phishing Code
Choosing a good anti-phishing code is important. Here are some tips.
Use a random combination of words and numbers (e.g., "blue_dragon_sunset_22"). Make it memorable but not obvious.
Avoid using your name, birthdate, or other personal information that could be guessed or found online.
Avoid common phrases like "password123" or "security." These are easy to guess.
Choose something you'll remember without writing it down. You need to recognize it when you see it in emails.
- Good: "crimson_tiger_2025"
- Good: "mountain_sunset_24"
- Bad: "password123" (too common)
- Bad: "John1985" (personal info)
📧 How to Use Your Anti-Phishing Code
Using your anti-phishing code is simple: always check for it in any email claiming to be from your exchange.
Step-by-Step Verification
- Step 1: Receive an email from your exchange (withdrawal confirmation, login notification, etc.).
- Step 2: Look for your anti-phishing code in the email body or header.
- Step 3: If the code is present, the email is legitimate.
- Step 4: If the code is missing, the email is a phishing attempt — do not click any links.
If it doesn't have your anti-phishing code, it's not from your exchange. This simple rule can protect you from almost all email-based phishing attacks.
🛡️ Additional Phishing Prevention Tips
While anti-phishing codes are powerful, they're even more effective when combined with other security measures.
Before clicking any link, hover over it to see the actual URL. Phishing sites often use domains that look similar but are slightly misspelled.
Even if you fall for a phishing attempt, 2FA can prevent unauthorized access. Use TOTP or hardware keys, not SMS.
Consider using a separate email address for your crypto exchanges. This reduces the risk of phishing attacks targeting your primary email.
Exchange mobile apps are often more secure than email links. Use the official app for account management and notifications.
Keep your browser, operating system, and security software updated to protect against malware and phishing exploits.
If you receive a phishing email, report it to your exchange's security team. This helps them take action against phishing campaigns.
- ✅ Check for your anti-phishing code
- ✅ Hover over links to verify the URL
- ✅ Never enter credentials from an email link
- ✅ Always navigate to the exchange directly
- ✅ Enable 2FA on your account
- ✅ Use a separate email for crypto
- ✅ Report suspicious emails
🚨 What to Do If You Fall for a Phishing Attempt
If you think you've been phished, act quickly. Here's what to do.
-
1
Change your password immediately
Log in to your exchange account (using a secure connection) and change your password.
-
2
Revoke all API keys
Delete all existing API keys and create new ones if needed.
-
3
Check for unauthorized activity
Review your account history, order history, and balances for unauthorized transactions.
-
4
Contact exchange support
Report the incident to your exchange's support team. They may be able to help freeze any unauthorized activity.
-
5
Enable additional security
If you haven't already, enable 2FA (preferably hardware-based) and set up an anti-phishing code.
-
6
Monitor your accounts
Keep a close eye on your exchange account and linked email for any further suspicious activity.
If you've entered your credentials on a phishing site, the attacker may already be in your account. Act immediately — every minute counts. Change your password and revoke API keys first, then investigate.