Quellengeprüfte Recherche: Binance

Verified source facts

1. Binance says the anti-phishing code is a user-defined marker included in genuine Binance emails and SMS after activation. 2. Binance's current setup guide requires 6 to 8 characters and at least three of uppercase letters, lowercase letters, digits and underscores; it says no other special characters are allowed. 3. Creation or rotation is confirmed with registered 2FA or a passkey. 4. Binance advises treating a missing or incorrect code as suspicious and checking the actual sender rather than its display name. 5. Binance Verify can check a claimed URL, email, phone number, Telegram ID or social handle, but a "verified" result does not replace full message and destination checks.

Comparison at a glance

1. Safe onboarding step: Official entry

Account-security onboarding should begin from the official domain or app and stay inside the authenticated security interface. The official entry step concerns starting from the real Binance domain or app. Confirm the current control in the user's own account, then navigate to Account and Security without using message links. Never copy a password, one-time code, biometric, recovery phrase, private key, API secret, or identity document into notes or chat.

Design for loss before changing the primary method. A passkey may depend on one device, a platform keychain, a password manager, a hardware key, or a synchronized credential provider. The venue's public documentation can describe supported paths, but it cannot prove the state of this account or device device compromise. Keep the existing method until the independent backup has been tested from a trusted context.

For official entry, record only non-secret evidence: method label, custody owner, setup date, tested device and recovery owner. Navigate to Account and Security without using message links, then sign out of a non-critical session and prove the alternate path. If device compromise remains unresolved, stop before deleting any working authenticator.

2. Safe onboarding step: Code design

The code design step concerns recognizable non-secret value. Confirm the current control in the user's own account, then avoid passwords, recovery words and personal data.

The venue's public documentation can describe supported paths, but it cannot prove the state of this account or device future disclosure to an attacker.

For code design, record only non-secret evidence: method label, custody owner, setup date, tested device and recovery owner. Avoid passwords, recovery words and personal data, then sign out of a non-critical session and prove the alternate path. If future disclosure to an attacker remains unresolved, stop before deleting any working authenticator.

3. Safe onboarding step: Creation

The creation step concerns authenticated Anti-Phishing Code control. Confirm the current control in the user's own account, then create the code and confirm the displayed requirements.

The venue's public documentation can describe supported paths, but it cannot prove the state of this account or device regional interface differences.

For creation, record only non-secret evidence: method label, custody owner, setup date, tested device and recovery owner. Create the code and confirm the displayed requirements, then sign out of a non-critical session and prove the alternate path. If regional interface differences remains unresolved, stop before deleting any working authenticator.

4. Safe onboarding step: Verification

The verification step concerns 2FA or passkey approval. Confirm the current control in the user's own account, then complete the check on a trusted device.

The venue's public documentation can describe supported paths, but it cannot prove the state of this account or device account recovery outcome.

For verification, record only non-secret evidence: method label, custody owner, setup date, tested device and recovery owner. Complete the check on a trusted device, then sign out of a non-critical session and prove the alternate path. If account recovery outcome remains unresolved, stop before deleting any working authenticator.

5. Safe onboarding step: First test

The first test step concerns appearance in a later genuine message. Confirm the current control in the user's own account, then compare the marker without clicking links.

The venue's public documentation can describe supported paths, but it cannot prove the state of this account or device delivery-channel formatting.

For first test, record only non-secret evidence: method label, custody owner, setup date, tested device and recovery owner. Compare the marker without clicking links, then sign out of a non-critical session and prove the alternate path. If delivery-channel formatting remains unresolved, stop before deleting any working authenticator.

6. Safe onboarding step: Missing code

The missing code step concerns message lacks the expected marker. Confirm the current control in the user's own account, then stop and verify through a separate channel.

The venue's public documentation can describe supported paths, but it cannot prove the state of this account or device whether a legitimate template omitted it.

For missing code, record only non-secret evidence: method label, custody owner, setup date, tested device and recovery owner. Stop and verify through a separate channel, then sign out of a non-critical session and prove the alternate path. If whether a legitimate template omitted it remains unresolved, stop before deleting any working authenticator.

7. Safe onboarding step: Wrong code

The wrong code step concerns message shows an old or different marker. Confirm the current control in the user's own account, then treat it as suspicious and report it.

The venue's public documentation can describe supported paths, but it cannot prove the state of this account or device source of the mismatch.

For wrong code, record only non-secret evidence: method label, custody owner, setup date, tested device and recovery owner. Treat it as suspicious and report it, then sign out of a non-critical session and prove the alternate path. If source of the mismatch remains unresolved, stop before deleting any working authenticator.

8. Safe onboarding step: Domain check

The domain check step concerns actual sender and destination rather than display name. Confirm the current control in the user's own account, then inspect the full domain and typed destination.

The venue's public documentation can describe supported paths, but it cannot prove the state of this account or device lookalike-domain detection by the mail client.

For domain check, record only non-secret evidence: method label, custody owner, setup date, tested device and recovery owner. Inspect the full domain and typed destination, then sign out of a non-critical session and prove the alternate path. If lookalike-domain detection by the mail client remains unresolved, stop before deleting any working authenticator.

9. Safe onboarding step: Rotation

The rotation step concerns changing a leaked or stale marker. Confirm the current control in the user's own account, then update it from Security and retest.

The venue's public documentation can describe supported paths, but it cannot prove the state of this account or device messages already queued before rotation.

For rotation, record only non-secret evidence: method label, custody owner, setup date, tested device and recovery owner. Update it from Security and retest, then sign out of a non-critical session and prove the alternate path. If messages already queued before rotation remains unresolved, stop before deleting any working authenticator.

10. Safe onboarding step: Incident path

The incident path step concerns reporting and account containment. Confirm the current control in the user's own account, then use official support and review active sessions.

The venue's public documentation can describe supported paths, but it cannot prove the state of this account or device attacker access not visible in public documentation.

For incident path, record only non-secret evidence: method label, custody owner, setup date, tested device and recovery owner. Use official support and review active sessions, then sign out of a non-critical session and prove the alternate path. If attacker access not visible in public documentation remains unresolved, stop before deleting any working authenticator.

Decision scenarios

Scenario 1: when official entry becomes decisive

Consider a reader whose main constraint is starting from the real Binance domain or app. The correct response is not to infer a universal platform or product winner. It is to navigate to Account and Security without using message links, retain the evidence, and define a stop condition before funds or permissions are committed. If the evidence changes, the decision must be reopened. This produces a repeatable operating rule rather than a one-time opinion.

Scenario 2: when code design becomes decisive

Consider a reader whose main constraint is recognizable non-secret value. It is to avoid passwords, recovery words and personal data, retain the evidence, and define a stop condition before funds or permissions are committed.

Scenario 3: when creation becomes decisive

Consider a reader whose main constraint is authenticated Anti-Phishing Code control. It is to create the code and confirm the displayed requirements, retain the evidence, and define a stop condition before funds or permissions are committed.

Scenario 4: when verification becomes decisive

Consider a reader whose main constraint is 2FA or passkey approval. It is to complete the check on a trusted device, retain the evidence, and define a stop condition before funds or permissions are committed.

Scenario 5: when first test becomes decisive

Consider a reader whose main constraint is appearance in a later genuine message. It is to compare the marker without clicking links, retain the evidence, and define a stop condition before funds or permissions are committed.

Scenario 6: when missing code becomes decisive

Consider a reader whose main constraint is message lacks the expected marker. It is to stop and verify through a separate channel, retain the evidence, and define a stop condition before funds or permissions are committed.

Sources and editorial method

This is research, not investment, legal, tax, or account-specific advice. Product availability, fees, controls, and legal terms can vary by entity, region, account tier, and time. Verify the live official page and the exact account screen before acting.