Security: Spotting Fake Sites, Phishing and Account Takeovers

How fake exchange sites actually work#

A phishing site is a copy of a real login page hosted on a domain that looks almost right. The address might swap two letters, add a word like login or support, or replace the dot with a similar character, and it often arrives through a paid advertisement that sits above the real result in a search engine. You type your email and password, the page reports a network error, and your credentials are already gone.

The same pattern appears in mobile form. Sideloaded applications from a link in a chat group ask for permissions a trading app never needs, and the fake support agent who told you to install it then asks for your two-factor code or your wallet seed phrase. Both requests are a confession: legitimate staff never need either, because they can help you without them.

Verify the domain before you type a password#

The single most effective habit in crypto is checking the domain before entering anything. Binance's official website is binance.com and nothing else; a hyphenated variant, a different top-level domain or a lookalike spelling is not the official site, regardless of how polished it looks or what a message claims.

You can also use the official-domain checker on this site to test a suspicious address, and install mobile applications only from the links on the official download page or from the official App Store and Google Play listings. There is no legitimate reason for anyone to send you an installation file directly.

Two-factor authentication: pick the stronger option#

Two-factor authentication is not a single thing. A code generated by an authenticator application on your own device, and especially a hardware security key, resists phishing far better than a code sent by SMS, which can be intercepted through SIM swapping or read from a compromised phone. Passkeys, where the platform supports them, bind the login to a device in a way that does not involve typing a shared secret at all.

Whichever method you use, save the backup codes offline at the moment you enable it. Recovery codes are the difference between a stressful afternoon and a permanent loss, and they deserve to be printed or stored in a password manager rather than left in a screenshot. Also review active sessions and API keys periodically: an unused key with withdrawal permission is a standing invitation.

Withdrawal allowlists and address hygiene#

Credentials can be stolen; an allowlist is what stops the theft from becoming a transfer. When an allowlist, sometimes called an address book with a delay, is enabled, withdrawals can only go to addresses you approved in advance, and adding a new address usually takes effect only after a waiting period. That delay is the point: it gives you time to notice and lock the account.

Address hygiene matters for the same reason. Clipboard malware silently swaps an address the moment you copy it, so always compare the first and last characters of the destination against the address you intended, and send a small test amount the first time you send to a new address. Matching the network label matters too, because sending on the wrong network can make funds unrecoverable.

If you think you have been compromised#

Speed matters more than tidiness. Work through the recovery steps in order, and contact support only through the official website, never through a link or phone number someone sent you.

Keep a record of what happened with timestamps, because support will ask, and be wary of anyone who appears in your messages offering to recover funds for a fee. Recovery services that approach first are almost always a second attempt at the same theft.

1. Log in from a clean device and change your password immediately.
2. Revoke active sessions, API keys and any connected third-party authorisations.
3. Re-check your two-factor settings and regenerate backup codes.
4. Review withdrawal records and contact official support through the official website.
5. Run a malware scan on every device that has accessed the account.

Red flags worth memorising#

Most scams reuse a small set of pressure tactics. Recognising the pattern takes seconds and is worth more than any single tool.

• Urgency: an account will be closed, a bonus will expire, or funds are at risk within minutes.
• Secrecy: you are told not to involve official support or to keep the matter private.
• Off-platform contact: support moves to a personal messaging account.
• Requests for secrets: password, two-factor code, seed phrase or a remote-screen session.
• A payment demand before any money is released, including for tax or verification.
• A domain that is nearly, but not exactly, the official one.