A practical checklist for securing your exchange account

Account security is a routine you can repeat before depositing funds, after changing devices, and whenever a message feels unusual. Work through these checks from the exchange's verified website or official app. Available settings vary, so follow the current instructions for your account.

Start from the real website

• Check the complete domain before signing in. A familiar logo or sender name is insufficient.
• Save a verified bookmark and use it to investigate account alerts.
• Pause if a message demands a transfer or an unfamiliar support call.

Coinbase's phishing guidance illustrates these impersonation tactics.

Protect the password and email account

Use a long, unique password wherever a password is required. A password manager can create and store it. Protect the linked email account too: enable its additional authentication and review unfamiliar devices, forwarding rules, and recovery details. See Coinbase's account security checklist.

Set up additional authentication

Enable a passkey, security key, or two-factor authentication when offered. Check which options your exchange supports rather than assuming every platform works alike. Follow its backup and recovery instructions before replacing a phone or key. Coinbase's authentication guide provides one platform-specific example.

Keep wallet secrets separate

A self-custody wallet's recovery phrase or private key can give someone control of its funds. Never disclose either to an exchange representative, chat contact, or account-verification page. Avoid screenshots that could sync to cloud storage. Ethereum's security guide explains why these secrets require special care.

Pause when a request is unexpected

Do not send an authentication code to someone claiming to help, install remote-access software at their request, or approve an action you did not initiate. Close the conversation and reach support through the verified app or website. Review account activity and report unfamiliar sessions. A completed checklist reduces avoidable mistakes; it does not guarantee that an account cannot be compromised.