Anti-phishing code
Also called: anti-phishing phrase
Definition
An anti-phishing code is a personal word or phrase you set in your exchange account that the exchange includes in its genuine emails, so you can spot fake messages that do not contain it.
This entry is shown in English.
How Anti-phishing code works
Phishing emails often copy an exchange's logo, layout and sender name perfectly. What a scammer does not know is the private code you chose in your security settings. Exchanges such as Binance, OKX, Bybit and Bitget offer this feature, and some show the code in other official messages too.
When an email claims to be from your exchange, look for your code first. If it is missing or wrong, treat the email as fake, do not click any links, and open the exchange app directly instead.
The code only proves an email is real; it does not make links inside a real email safe to follow blindly, and scammers can still reach you through SMS, social media or calls, which usually do not carry the code. Choose something that is not easy to guess and do not share it.
Example
Say you set the anti-phishing code BlueKettle42 on your exchange. One morning you get an email saying a withdrawal of 0.4 ETH is pending and you must cancel it within 15 minutes. The design looks right, but there is no BlueKettle42 anywhere. You ignore the link, open the exchange app and see no pending withdrawal. The email was a phishing attempt.
Common mistakes
- Setting the code but never actually checking for it when an urgent email arrives.
- Assuming a message on Telegram or SMS is real because your email has a code.
- Choosing an obvious code such as your name or the exchange name.
Learn and practise
FAQ
Where do I set an anti-phishing code?
Usually in the security section of your exchange account settings. The exact menu name differs between exchanges.
Does an anti-phishing code stop all scams?
No. It helps you verify emails, but you still need 2FA, a withdrawal whitelist and careful checking of links and addresses.