Two-factor, withdrawal whitelist, anti-phishing code: set all three while the account is empty

On the day you open the account it holds nothing. That is exactly why this is the right moment for security settings — nothing can be lost, so you can experiment, lock yourself out, and try again. Wait until there is real money in it and you will postpone all of this out of fear of getting it wrong.

Three things, about ten minutes, in this order.

One: two-factor, and not by SMS alone

Use an authenticator app in preference to text messages. The reason is not that SMS is old-fashioned; it is a specific attack — someone presents forged paperwork to a mobile operator, has your number reissued, and your codes start arriving on their phone. This has happened in plenty of places.

During setup you are shown a backup key, or a QR code. That step decides whether you can get back in after losing your phone:

• Write it on paper. Not a screenshot, not a note in your phone, not a message to yourself. Galleries and notes sync to the cloud, and if that account is ever breached your second factor stops being a second factor.
• Store it where you keep documents. With the passport, not in a drawer of receipts.
• Check what you copied. Several character pairs look alike: 0 and O, 1 and l, 8 and B. A miscopied key only reveals itself on the day you need it.

Keep two copies in two places. It sounds excessive, but this string is the last route back in a bad situation, and a second copy costs nothing.

Two: the withdrawal whitelist protects you from yourself

Switch it on and withdrawals can only go to addresses you added in advance; adding a new one usually takes effect after a waiting period. Most guides describe this as anti-hacker protection, which is true, but for a beginner its more frequent job is stopping you from pasting the wrong address.

Pasting the wrong address is easier than it sounds: another app overwrites the clipboard, a character goes missing, two transfer pages get confused. Crypto transfers do not reverse, and no support desk can retrieve one.

Practical advice: add the one or two addresses you actually use and treat the list as fixed. When you do need a new one, the waiting period is not an obstacle — it is time to check the address twice. Genuinely urgent withdrawals barely exist for someone still learning.

Three: the anti-phishing code, cheapest of the lot

Choose a short string only you know, and official emails and texts from the platform will carry it. Any "official" message without it goes in the bin, no thought required.

This one takes the least time and defends against the commonest attack on beginners: a message that looks exactly like the real thing, telling you there is a problem with your account and inviting you to verify via a link. The link leads to a convincing copy, and what you type there goes to somebody else.

Read the format rule before you pick one, or you will waste an attempt: per the Binance help page the code is 6 to 8 characters and has to use at least three of uppercase letters, lowercase letters, digits and underscores, with no special characters. A pet name plus two digits may well be rejected. Beyond that, do not build it from a birthday, a name, or part of a password.

Why this order

Two-factor goes first because the other two often need it to confirm changes. Set it first and the rest go smoothly; do it the other way round and you may repeat a verification step.

The whitelist is second because it is the one directly connected to money leaving. The anti-phishing code is third, not because it is unimportant, but because its job is helping you spot fake messages, and those tend to arrive once an account has something in it.

Then do a ten-minute rehearsal

• Log out and back in using the authenticator. Confirms that the entry in the app really belongs to this account and that the codes work.
• Add an address to the whitelist and observe the rules. If there is a waiting period, learn its length now rather than in a hurry later.
• Find a platform email and confirm the anti-phishing code appears. If it does not, the setting did not save.

The point of rehearsing is that these three do nothing day to day and matter only in an emergency. If they are misconfigured, you want to discover that now.

Three more that are not switches

• A dedicated email address. Not shared with shopping or social accounts. If it leaks elsewhere, phishing arrives targeted; with a dedicated address, anything suspicious stands out.
• A password you have never used anywhere. The real risk is a password reused on some unrelated site being dumped, then tried against every exchange.
• Login and withdrawal notifications on. They are your earliest warning that someone else is moving in your account, and earlier beats any recovery process.

The backup key is the easiest part to get wrong

Turning two-factor on is the easy half. The half that decides whether it helps or hurts you is what you do with the backup key the setup screen shows once.

That string is what restores the authenticator on a new phone. If it is gone, and the phone is gone, you are into an identity-based recovery process with support — possible, but slow, and it happens at whatever moment you least wanted it to.

Three things worth doing while the screen is still open:

• Write it on paper, by hand, and store it away from the phone. A photo in the phone's gallery protects you against nothing, because it disappears with the same device.
• Read it back once. Miscopied characters are only discovered on the day you need them, which is the worst possible day to discover them.
• Do not put it in the same notes app you are logged into on that phone. One compromised account should not hand over both factors.

There is a second, less obvious benefit: once the key is on paper, you stop being nervous about replacing your phone, which makes it far easier to leave the security settings on.

Devices, sessions and the one screen worth revisiting

The three switches are one-time actions. There is one screen worth going back to occasionally, which is the list of devices or sessions currently signed in.

It answers a question no alert will raise for you: is anything logged in that you do not recognise. An old laptop you sold, a browser at a workplace, a session from a country you have not visited — any of those is worth ending, and ending a session costs you nothing but signing in again.

Worth pairing with it: check which email address and phone number the account will send notices to. A changed phone number that the account still has on file quietly turns a recovery route into a dead end.

What these switches cost you

Security is not free, and being honest about the cost is what stops you switching it off later out of irritation.

• Two-factor: a few extra seconds at each login and withdrawal, in exchange for a password alone being useless to an attacker.
• Whitelist: new addresses wait, which feels obstructive when you are in a hurry. For a beginner, though, "in a hurry to send funds to a brand new address" is itself a situation worth distrusting — most scams manufacture exactly that pressure.
• Anti-phishing code: almost no cost, provided you remember the string you chose.

Of the three, the whitelist is the one I would defend hardest, because it guards against the irreversible. A leaked password can be dealt with; coins that have left cannot be recalled.

With all three set, the account is ready to use. The next step is not to fund it, it is to go and drill in the demo environment, where mistakes cost play money.

If you have not got this far yet, the sign-up order and the referral code field are covered in the account article.

Those three anti-phishing rules — the length, the character classes, which notifications carry the code — are not a house rule of ours. They are what the Binance help page on the anti-phishing code specifies; that page was updated 2026-06-10 and we read it in September 2026. Where two-factor and the withdrawal whitelist sit varies between versions, so go by your own account security page.