Exchange anti-phishing codes: setup and safe checks

What an anti-phishing code can and cannot establish

Step by step

1. Open the verified account

   Use the official app or a trusted bookmark. Do not begin from a message that pressures you to reset security or save funds.

2. Read the coverage description

   Find anti-phishing protection in security settings and check whether it covers email, SMS or specified message categories for your account.

3. Create a separate recognition string

   Follow the displayed format rules. Do not reuse a password, identity number, recovery phrase or authenticator seed as your code.

4. Confirm and inspect safely

   Finish the account verification and check the saved status. Observe a relevant notification from an ordinary action you initiated, without making an unnecessary transfer.

5. Act through independent navigation

   If a future message is unexpected, missing the code or showing a wrong code, open the official service separately. Report suspected phishing through its verified support channel.

What the code adds to message checking

A familiar sender name, logo and polished email layout are easy to imitate. A recognition string you configured gives you another detail to compare. If a message that should contain the code does not show it, stop before following its instructions. A wrong code deserves the same caution. The next action is to inspect the real account through a trusted entry point, not to reply to the suspicious sender and ask for reassurance.

The feature is useful precisely because checking it is simple, but simplicity has a boundary. The string is displayed in messages and can become visible to anyone with access to those messages. Treat it as private recognition information rather than a secret that can safely authorize transactions. A copied code can appear in an attacker’s message without making the message authentic.

Email and SMS coverage are service-specific

Do not assume every exchange inserts its anti-phishing code into every channel. Binance’s official anti-phishing guide describes both email and SMS coverage. OKX’s account security guidance describes the code as an aid for recognizing email. Other services may apply it to specified email categories or offer different behavior across products. Read the official description for your account and channel instead of transferring one exchange’s claim to another.

A text message appearing in the same conversation as older genuine messages is not conclusive proof of origin. Sender identifiers and conversation grouping can mislead. If SMS coverage is not confirmed for your service, the absence of a code cannot by itself classify every text. Independently verify unexpected messages anyway, especially those asking you to change security settings, install software or move funds.

Choose a recognizable string without exposing other secrets

Choose something you can reliably recognize that is not your exchange password, email password, authenticator seed, wallet recovery phrase or identity document number. Follow the character and length rules shown in the real setup screen. This guide intentionally provides no universal format because platforms can use different constraints and update them. A password manager can hold a private record of which recognition string belongs to which exchange.

Separate codes across services make it easier to notice an incorrect context and reduce reuse after one mailbox leak. Do not publish a screenshot containing the code, put it in a public support thread or include it in a social media profile. If a screenshot is needed for a support case, remove the code and other sensitive fields first. Support does not need your unrelated login credentials to understand that a message looks suspicious.

Set up through the authenticated account

Open the official app or a verified bookmark and enter the account security area. Find the anti-phishing feature, read which messages it covers and create the recognition string there. Complete whatever security verification the account requests. Do not open the setting through an unsolicited email saying that your code has expired. The security change should be an action you start deliberately inside the real account.

After saving, check that the setting shows the expected value or enabled state. Use the next relevant message generated by an ordinary action you initiated to understand how the code is displayed. Do not perform an unnecessary withdrawal simply to generate a sample. A normal account notification may be enough if it belongs to a covered category. Keep the distinction between verifying delivery behavior and proving the safety of all future communications.

Where to begin on Bitget, OKX and Binance

For Bitget, start from the verified profile or personal account area, open security and look for the anti-phishing setting. For OKX, enter account security and look for anti-phishing protection, then read the email coverage explanation. For Binance, use the account security area and locate the anti-phishing code setting. Follow the official page (以官方页面为准). These generic paths avoid depending on an old screenshot or a menu label that differs on mobile.

Before changing a code, check whether you are looking at the correct account and regional service. An email from an unrelated product may not use the same recognition feature. A search result with a familiar brand does not establish that you are in the right account. Reach the help center from the official service you independently opened, and compare its instructions with the security controls actually displayed.

Where to begin on Bybit, MEXC and Gate

For Bybit, use the verified account security area and search the official help center for anti-phishing code setup. For MEXC, open account security and use the official anti-phishing code help entry if the control is unclear. For Gate, look in the account security area and consult its security guide for anti-phishing setup. Follow the official page (以官方页面为准). Availability, accepted strings and confirmation challenges must be checked in the current account.

If you cannot find a setting, do not install an extension or scan a stranger’s QR code to unlock it. Ask support through the already verified application whether the feature is available for your account. The absence of an optional recognition code is a reason to be more careful with messages, not a reason to replace official navigation with a third-party setup service.

Use a message inspection routine

First ask whether you expected the message. Then check the code where the service says it should appear, the sender details and the requested action. A claim that your assets will be frozen unless you act immediately deserves independent verification. Open the app separately and inspect account notifications, security events or support messages. Do not treat a good-looking address in the email body as proof that the actual link goes there.

Even a correct code cannot validate an attachment, a telephone number or the destination of a transfer. It also cannot establish that an investment offer is suitable or that a support representative is genuine. If the message asks for a wallet recovery phrase, remote access or a transfer to a verification wallet, stop. The recognition string does not transform those requests into normal account maintenance.

Handle missing, wrong or leaked codes

A missing code in a covered message is a warning, not a diagnosis of exactly what happened. The message may be fraudulent, the account may use another configured string, or the message category may fall outside the feature. Do not resolve uncertainty by clicking the message’s own recovery link. Compare the setting inside the real account and ask official support if the discrepancy remains.

If someone else saw your code, change it through the authenticated security page. A mailbox compromise requires more than changing the recognition string: secure the mailbox, inspect forwarding rules and sessions, review exchange access and check for unauthorized security changes. Preserve suspicious message details for an official report, while keeping codes and personal data out of public posts. A changed string does not invalidate a stolen account session.

Use the feature within a wider security routine

The code helps with message recognition. An authenticator or passkey protects authentication, while an address allowlist can restrict withdrawal destinations. These controls address different points in an attack. Maintain an updated device, use unique passwords and protect the recovery email. When changing phones or email accounts, verify that your recognition routine still works and that old account access has been removed appropriately.

Avoid training yourself to act automatically whenever the code matches. The strongest habit is to use messages as notifications and the independently opened official service as the place to act. That habit remains useful if the code is copied, a sender is spoofed or a service changes its communication format. An effective check should slow down an unexpected request enough for you to understand what you are authorizing.

Frequently asked questions

Official references

• Binance anti-phishing code guide
• OKX account security and email protection
• Bybit phishing recognition guidance
• MEXC account help and anti-phishing setup links
• Gate security and anti-phishing help
• Bitget phishing risk guidance