- Turn on two-factor authentication — it's the single biggest improvement.
- Use a unique password from a password manager.
- Always check the address bar before signing in.
- Support will never ask for your password or 2FA codes.
Most account takeovers don't involve sophisticated hacking. They happen because a password was reused, a code was typed into a fake page or someone was talked into sharing it. A few simple habits close almost all of those doors.
1. Turn on two-factor authentication
Two-factor authentication (2FA) asks for a six-digit code from an authenticator app every time you sign in. Even if someone learns your password, they can't get in without your phone. Turn it on in Settings → Security: scan the QR code with an app such as Google Authenticator or Authy and confirm with a code.
2. Use a unique password
If you use the same password elsewhere and that site is breached, attackers will try it on other services. A password manager can generate and remember a long, unique password for every site.
3. Watch out for phishing
- Check the address bar before you sign in — phishing pages copy logos and layouts exactly.
- Don't sign in through links in unexpected emails or messages; open the site yourself.
- Be suspicious of urgency: "your account will be blocked in 1 hour" is a classic pressure tactic.
4. Never share codes or passwords
Our support team will never ask for your password, your 2FA codes or remote access to your device. Anyone who does is not support.
5. Read your security notifications
You receive a notification for events such as new sign-ins and password changes. If you see one you don't recognise, change your password immediately and contact support.
If something looks wrong
- 1Change your password in Settings.
- 2Turn on 2FA if it isn't on yet.
- 3Contact support from the Contact page and describe what you noticed.
This article is for educational purposes and is not investment advice. Trading with leverage carries a high level of risk and you can lose all invested capital.