Seven Binance Security Settings to Complete

A newly created account is not fully secured. Complete these controls before funding and keep a reliable recovery route. Menu labels can change; use the Security area shown inside your account.

1. Use a unique password

Do not reuse an exchange password for email, social media, or another platform. Use a password manager to generate a long, unique password. Change it from a trusted device if you suspect exposure and review account activity at the same time.

2. Prefer a passkey or authenticator-based 2FA

Passkeys and hardware security keys are designed to resist phishing. Time-based codes from an authenticator generally resist SIM swapping better than SMS alone. Choose a method you can recover safely and store its recovery material before you need it.

3. Protect your email account

Email often participates in login, notifications, and recovery. Give it a different password and 2FA, then review forwarding rules, recovery addresses, and signed-in devices. An attacker who controls email may intercept security alerts.

4. Set an anti-phishing code

An anti-phishing code is a phrase created in account security settings and displayed in legitimate notification emails. If it is missing or wrong, treat the message as suspicious and verify through an official bookmark. Do not reuse your password as the code.

5. Review devices and activity

Remove devices you no longer use or recognize. Check login locations, times, and security events. If something is wrong, protect email and the exchange account, revoke suspicious sessions, and use official support.

6. Configure withdrawal address controls

If you regularly withdraw to a small set of wallets, consider an address allowlist or similar control. Verify every new address and understand any security waiting period. An allowlist reduces some account-takeover risk but cannot correct a wrong network or address.

7. Control API and third-party access

Most beginners do not need an API key. Do not create one for an unfamiliar bot or managed-trading service. When an API is genuinely needed, apply least privilege, IP restrictions, a separate sub-account, and regular review. Revoke a key immediately if exposed.

Monthly check

Can you still recover email and exchange authentication?
Are there unknown devices, addresses, or API keys?
Is the anti-phishing code still correct?
Does your bookmark point to the correct official domain?
Can you remove old withdrawal addresses or third-party permissions?

Anyone claiming to be support and requesting a password, 2FA code, private key, or recovery phrase is not trustworthy. Do not install remote-control software or share your screen with a stranger.

Official sources

Last reviewed: 2026-07-19.