2FA for crypto: protect your exchange, email and SIM

Why 2FA matters

If someone gets your exchange password, 2FA is what stops them from logging in and withdrawing. But not all 2FA is equal.

The options, from weakest to strongest

1. SMS codes: better than nothing, but vulnerable to SIM-swap fraud and message interception.
2. Authenticator apps (such as Google Authenticator, Microsoft Authenticator or Authy): codes are generated on your phone, not sent over the network.
3. Passkeys and hardware security keys: tied to your device and resistant to phishing. Use them where your exchange or email supports them.

Set it up in this order

1. Email first. Whoever controls your email can reset most other accounts. Turn on an authenticator or passkey there.
2. Exchanges. Turn on authenticator 2FA for login and withdrawals.
3. Withdrawal allowlist. Many exchanges let you restrict withdrawals to saved addresses, often with a waiting period for new ones.
4. Anti-phishing code. Some exchanges add a personal code to genuine emails so you can spot fakes.

Protect against SIM swaps

Ask your mobile operator about extra verification for SIM replacement, and don't share Aadhaar or ID scans with unknown callers. If your phone suddenly loses signal, contact your operator immediately.

Backup codes

When you set up 2FA, you'll get backup codes. Write them down and store them offline with your other important documents. Without them, losing your phone can lock you out.

More habits in the wallet security checklist and phishing guide.

Sources

• National Cyber Crime Reporting Portal (helpline 1930)
• Financial Intelligence Unit India (FIU-IND)

• security
• 2fa