Investigación verificada por fuentes: OKX

Verified source facts

1. OKX documents the app path Menu, Security, Anti-phishing code for setting the control. 2. OKX says official emails should include the configured anti-phishing code and a missing or mismatched code should be treated as suspicious. 3. OKX's security guide also recommends authenticator or passkey controls in addition to email verification. 4. OKX's phishing-email guidance recommends checking the sender domain and SPF, DKIM and DMARC results and says sensitive secrets should never be shared by email.

Comparison at a glance

1. Anti-phishing verification step: Official entry

An anti-phishing code is a message-authentication clue, not a replacement for careful navigation or account security. The official entry step concerns correct domain or installed app. Begin only from the official OKX domain or installed app, confirm the control inside the authenticated Security menu, and open security settings from a trusted entry. Never place a password, one-time code, recovery secret, API credential, private key, seed phrase, or identity document into the anti-phishing code or an email reply.

Test the control without trusting the message that prompted the test. Open OKX independently, verify the configured code in the account, and compare it character for character with later security emails. A missing or mismatched code is a stop condition, but a matching code alone cannot resolve regional interface differences; the sender domain, underlying links, mail-authentication details, request context, and authenticated account state remain separate checks.

For official entry, retain only non-secret evidence such as the setup date, method label, expected display location, test result, and incident owner. Open security settings from a trusted entry, then repeat the check from a trusted session without clicking the email link. If regional interface differences remains unresolved, do not reply, sign, approve, transfer, or disclose information.

2. Anti-phishing verification step: Account eligibility

The account eligibility step concerns feature availability for the signed-in account. Begin only from the official OKX domain or installed app, confirm the control inside the authenticated Security menu, and confirm it in the authenticated menu.

A missing or mismatched code is a stop condition, but a matching code alone cannot resolve entity-specific access; the sender domain, underlying links, mail-authentication details, request context, and authenticated account state remain separate checks.

For account eligibility, retain only non-secret evidence such as the setup date, method label, expected display location, test result, and incident owner. Confirm it in the authenticated menu, then repeat the check from a trusted session without clicking the email link. If entity-specific access remains unresolved, do not reply, sign, approve, transfer, or disclose information.

3. Anti-phishing verification step: Code choice

The code choice step concerns memorable non-secret phrase unique to OKX. Begin only from the official OKX domain or installed app, confirm the control inside the authenticated Security menu, and avoid passwords and recovery material.

A missing or mismatched code is a stop condition, but a matching code alone cannot resolve future rotation; the sender domain, underlying links, mail-authentication details, request context, and authenticated account state remain separate checks.

For code choice, retain only non-secret evidence such as the setup date, method label, expected display location, test result, and incident owner. Avoid passwords and recovery material, then repeat the check from a trusted session without clicking the email link. If future rotation remains unresolved, do not reply, sign, approve, transfer, or disclose information.

4. Anti-phishing verification step: Authenticated setup

The authenticated setup step concerns saving the code inside Security. Begin only from the official OKX domain or installed app, confirm the control inside the authenticated Security menu, and complete only in the official session.

A missing or mismatched code is a stop condition, but a matching code alone cannot resolve device-specific layout; the sender domain, underlying links, mail-authentication details, request context, and authenticated account state remain separate checks.

For authenticated setup, retain only non-secret evidence such as the setup date, method label, expected display location, test result, and incident owner. Complete only in the official session, then repeat the check from a trusted session without clicking the email link. If device-specific layout remains unresolved, do not reply, sign, approve, transfer, or disclose information.

5. Anti-phishing verification step: Test email

The test email step concerns exact code displayed in later messages. Begin only from the official OKX domain or installed app, confirm the control inside the authenticated Security menu, and compare before clicking any link.

A missing or mismatched code is a stop condition, but a matching code alone cannot resolve mail delivery delay; the sender domain, underlying links, mail-authentication details, request context, and authenticated account state remain separate checks.

For test email, retain only non-secret evidence such as the setup date, method label, expected display location, test result, and incident owner. Compare before clicking any link, then repeat the check from a trusted session without clicking the email link. If mail delivery delay remains unresolved, do not reply, sign, approve, transfer, or disclose information.

6. Anti-phishing verification step: Sender domain

The sender domain step concerns visible and underlying sender identity. Begin only from the official OKX domain or installed app, confirm the control inside the authenticated Security menu, and inspect the full address.

A missing or mismatched code is a stop condition, but a matching code alone cannot resolve lookalike domains; the sender domain, underlying links, mail-authentication details, request context, and authenticated account state remain separate checks.

For sender domain, retain only non-secret evidence such as the setup date, method label, expected display location, test result, and incident owner. Inspect the full address, then repeat the check from a trusted session without clicking the email link. If lookalike domains remains unresolved, do not reply, sign, approve, transfer, or disclose information.

7. Anti-phishing verification step: Link target

The link target step concerns destination before navigation. Begin only from the official OKX domain or installed app, confirm the control inside the authenticated Security menu, and open the official site independently.

A missing or mismatched code is a stop condition, but a matching code alone cannot resolve redirect chains; the sender domain, underlying links, mail-authentication details, request context, and authenticated account state remain separate checks.

For link target, retain only non-secret evidence such as the setup date, method label, expected display location, test result, and incident owner. Open the official site independently, then repeat the check from a trusted session without clicking the email link. If redirect chains remains unresolved, do not reply, sign, approve, transfer, or disclose information.

8. Anti-phishing verification step: Mail authentication

The mail authentication step concerns SPF, DKIM and DMARC results. Begin only from the official OKX domain or installed app, confirm the control inside the authenticated Security menu, and inspect message security details.

A missing or mismatched code is a stop condition, but a matching code alone cannot resolve provider display differences; the sender domain, underlying links, mail-authentication details, request context, and authenticated account state remain separate checks.

For mail authentication, retain only non-secret evidence such as the setup date, method label, expected display location, test result, and incident owner. Inspect message security details, then repeat the check from a trusted session without clicking the email link. If provider display differences remains unresolved, do not reply, sign, approve, transfer, or disclose information.

9. Anti-phishing verification step: Stop condition

The stop condition step concerns missing or mismatched code. Begin only from the official OKX domain or installed app, confirm the control inside the authenticated Security menu, and do not click, reply or submit data.

A missing or mismatched code is a stop condition, but a matching code alone cannot resolve support response time; the sender domain, underlying links, mail-authentication details, request context, and authenticated account state remain separate checks.

For stop condition, retain only non-secret evidence such as the setup date, method label, expected display location, test result, and incident owner. Do not click, reply or submit data, then repeat the check from a trusted session without clicking the email link. If support response time remains unresolved, do not reply, sign, approve, transfer, or disclose information.

10. Anti-phishing verification step: Layered security

The layered security step concerns authenticator, passkey and recovery path. Begin only from the official OKX domain or installed app, confirm the control inside the authenticated Security menu, and keep an independent tested factor.

A missing or mismatched code is a stop condition, but a matching code alone cannot resolve account-specific controls; the sender domain, underlying links, mail-authentication details, request context, and authenticated account state remain separate checks.

For layered security, retain only non-secret evidence such as the setup date, method label, expected display location, test result, and incident owner. Keep an independent tested factor, then repeat the check from a trusted session without clicking the email link. If account-specific controls remains unresolved, do not reply, sign, approve, transfer, or disclose information.

Decision scenarios

Scenario 1: when official entry becomes decisive

Consider a reader whose main constraint is correct domain or installed app. The correct response is not to infer a universal platform or product winner. It is to open security settings from a trusted entry, retain the evidence, and define a stop condition before funds or permissions are committed. If the evidence changes, the decision must be reopened. This produces a repeatable operating rule rather than a one-time opinion.

Scenario 2: when account eligibility becomes decisive

Consider a reader whose main constraint is feature availability for the signed-in account. It is to confirm it in the authenticated menu, retain the evidence, and define a stop condition before funds or permissions are committed.

Scenario 3: when code choice becomes decisive

Consider a reader whose main constraint is memorable non-secret phrase unique to OKX. It is to avoid passwords and recovery material, retain the evidence, and define a stop condition before funds or permissions are committed.

Scenario 4: when authenticated setup becomes decisive

Consider a reader whose main constraint is saving the code inside Security. It is to complete only in the official session, retain the evidence, and define a stop condition before funds or permissions are committed.

Scenario 5: when test email becomes decisive

Consider a reader whose main constraint is exact code displayed in later messages. It is to compare before clicking any link, retain the evidence, and define a stop condition before funds or permissions are committed.

Scenario 6: when sender domain becomes decisive

Consider a reader whose main constraint is visible and underlying sender identity. It is to inspect the full address, retain the evidence, and define a stop condition before funds or permissions are committed.