# Is SMS 2FA enough to protect your crypto exchange account? The text code follows your phone number, and a SIM swap or port-out can move that number before the authenticator app, the withdrawal allowlist, and the anti-phishing code are on > SMS codes follow the phone number, so a SIM swap can take them. Switch to an authenticator or a passkey, turn on a withdrawal allowlist, and set an anti-phishing code. - **Source:** https://ptycoin.com/en/posts/2026-10-27-exchange-account-2fa-withdrawal-allowlist/ - **Published:** 2026-10-27 - **Category:** Guides - **Author:** Camila - **Tags:** security, exchanges, self-custody, education - **Also published in:** [Español](https://ptycoin.com/es/posts/2026-10-27-exchange-account-2fa-withdrawal-allowlist/) --- The phone on the table drops to No service, and a minute later an email says a new sign-in just hit the exchange. No, a text is a weak second factor once another handset can receive it, so move the login to an authenticator app or a passkey, turn on a withdrawal allowlist, and set an anti-phishing code before a balance stays overnight. Screen labels differ by app, so match them on your own phone, and this walkthrough is not a recommendation to hold savings on an exchange. An exchange account is the counter where pesos, reais, or dollars become crypto and come back out. Savings belong in a wallet whose keys you hold. [Moving crypto off an exchange](/en/posts/2026-06-05-self-custody-101-moving-crypto-off-exchange/) is the exit. [A setup without a single point of failure](/en/posts/2026-08-10-self-custody-without-single-point-of-failure/) is how that wallet survives a bad backup. ## Why does the phone go dark before the login email? The [FTC's SIM-swap alert](https://consumer.ftc.gov/consumer-alerts/2019/10/sim-swap-scams-how-protect-yourself) names the tell: no data, no texts, no calls, and a SIM activated on a new device. The scammer tells the carrier the phone was lost and moves your number onto a SIM they hold. Texts then arrive on their phone. Put a PIN on the line. The [FCC](https://www.fcc.gov/cell-phone-fraud) calls the same theft a port-out. Enough personal data, and the carrier moves the number, calls and texts included. An eSIM cannot be pulled from the phone, but a port-out still works. The [FBI IC3 warning](https://www.ic3.gov/PSA/2022/PSA220208/) says the next move is a password reset. SMS codes for accounts on that number, including virtual-currency accounts, arrive on the new phone. Stronger methods on that list are biometrics, a physical token, or a standalone authenticator app. On No service, if you did not order a new SIM, call the carrier from another phone before you open the login email.
The text follows the number. The authenticator code stays on the app you set up, if the setup key is offline.
## How do you replace SMS with an authenticator or a passkey? Write the setup key on paper before you confirm. Do not photograph it or store it in a cloud note. Anyone with that key can generate the same codes. Do not read a code, the key, or a recovery code to anyone who says they are support. Confirm one new code before you turn SMS off. On a phone change, load the key from the paper and confirm one code before you erase the old phone. [Kraken](https://support.kraken.com/articles/360000911823-how-does-two-factor-authentication-2fa-for-sign-in-work-) recommends a passkey. Turn off cloud sync if the app can send codes to Google, Apple, or Microsoft. [Keep the setup key offline](https://support.kraken.com/articles/13430066489364-how-to-secure-your-account-with-two-factor-authentication-2fa-). Set a Master Key too, under Advanced Settings. Coinbase names Duo, Google Authenticator, and Microsoft Authenticator. Bitso names Google Authenticator and Authy. Use the store that came with the phone. Binance's [app guide](https://www.binance.com/en/support/faq/detail/f3b1adaed1c846bbbba0f3650ad23e45) walks Google Authenticator: 1. Tap the Account icon, the profile, then Security. 2. Tap Authenticator App, then Enable. 3. Copy the setup key onto paper. Do not tap Next until the authenticator shows the account. 4. In Google Authenticator tap +, choose Enter a setup key, paste, name the account, and tap Add. 5. Back in Binance tap Next and enter the 6-digit code. On Kraken open Security. Under Sign-in Two-Factor Authentication (2FA), select Add passkey, or Enable under Authenticator app, then scan or enter the setup key and confirm. Set the Master Key before the lock below. On Coinbase open [2-step verification](https://help.coinbase.com/en/coinbase/getting-started/getting-started-with-coinbase/2-step-verification). SMS is the default and the least secure option. In Available methods, select Set up next to Security Key, Passkey, or Authenticator app. A trusted contact works only after 24 hours, and anyone who asks to be one is likely a scammer. On Bitso, open the [help page](https://support.bitso.com/hc/en-us/articles/7727515008276-How-do-I-activate-2FA-in-my-Bitso-account). Website: Profile, Security, Account security, Activate in 2FA Token, Continue, I already have the app, then the 6-digit code. App: menu, Security, 2FA Authentication, then the same steps. Write down a recovery code if the screen shows one. If the phone and that code are both gone, contact Bitso support. ## How do you stop a withdrawal to a new address? Lock the email and the second factor first. Add your wallet address, check every character, then turn the allowlist on. A new address often has a wait, and you cannot send during it. Pick a day you do not need the money. Generate it in your wallet ([receiving into self-custody](/en/posts/2026-07-14-receive-crypto-safely-self-custody/)). Paste only that fresh copy. [Address poisoning](/en/posts/2026-09-29-address-poisoning-lookalike-wallet-history/) plants lookalikes in the history. Save a tag or memo when the network asks ([the tag guide](/en/posts/2026-09-22-destination-tag-memo-exchange-deposit/)). Send a small test, then the rest ([sending from self-custody](/en/posts/2026-06-30-sending-crypto-safely-from-self-custody/)). A Binance whitelist change may pause withdrawals for 24, 48, or 72 hours. Read the note first. The [FAQ](https://www.binance.com/en/support/faq/detail/1d08944f103b4fc78d3519913b600086): 1. Profile icon, Settings. 2. Withdrawal, Enable next to Withdrawal Whitelist, then Enable again, and a passkey or 2FA. Only listed addresses can receive funds. 3. Address Management, Add, Add address, then the coin and network or a universal address. 4. Check Add Address to Whitelist, then Save and complete 2FA. Leave One-step Withdrawal off. That switch can skip 2FA on a small send to a listed address. Enable Whitelist Withdrawal Limit, pick the period on screen, and Confirm. Binance says to leave the limit on. Turning the whitelist off while the limit is on can pause withdrawals for those same hours. Coinbase sends to a new address after 48 hours. Turning allowlisting off takes 48 hours, unless you do it within 8 hours. The [page](https://help.coinbase.com/en/coinbase/managing-my-account/other/address-book-allowlist) requires 2-step verification to turn it on, off, or use it. At Coinbase.com: profile, Settings, Allow list, Enable Allowlisting, Add address. Use an EVM address for an EVM asset. On Kraken, [add and confirm](https://support.kraken.com/articles/360000672863-adding-and-confirming-a-new-cryptocurrency-withdrawal-address) an address before any send. Transfer then Withdraw, or Portfolio then Withdraw. Click Add new withdrawal address, enter a unique Label, paste into Withdrawal address, and click Add withdrawal address. Do not type the address. A label cannot be reused, even on another coin. A trusted device approves it. Otherwise the email link lasts one hour. After a password change, new addresses wait up to 24 hours if Sign-in 2FA and a Master Key are both missing. [Funding 2FA](https://support.kraken.com/articles/how-does-two-factor-authentication-2fa-for-funding-withdrawals-work) is the code on a withdrawal and on a move to the Futures wallet. Set it before the [Global Settings Lock](https://support.kraken.com/articles/201396877-what-is-the-global-settings-lock-gsl-). That lock blocks a new crypto address, a logged-in password change, an email change, and any 2FA change, including by Support. Save your address and the Master Key first. Without a Master Key, an unlock takes at least 24 hours and up to 30 days, depending on your settings. An unlock emails you. On Bitso: Security, [Cuentas de confianza](https://support.bitso.com/hc/es-mx/articles/45591365374228), save your address, then turn on Enviar cripto solo a cuentas de confianza. No wait is stated. Send a small test. Turning it off asks for an identity check, and any address works again. ## How do you tell a real exchange email from a fake one? Choose a short phrase. Real mail prints it. Stop if a message claims to be the exchange and the phrase is missing. Do not tap its links. Open the app from its icon, or type the address you already use. See [spotting phishing and fake wallet apps](/en/posts/2026-08-11-spot-phishing-fake-wallet-apps/). Binance's [anti-phishing FAQ](https://www.binance.com/en/support/faq/detail/311927d6c4b4478ba094fc6a611d5201) puts the code on genuine emails and SMS. App: menu, profile, Account Info, Security, Anti-Phishing Code, Create. Website: Profile, Account, Security, Advanced Security, Enable. Use 6 to 8 characters and at least three of uppercase, lowercase, digits, and underscores. No special characters. Confirm with 2FA or a passkey. Report a missing or wrong code, and change it if it leaked. Do not tell the phrase to support. Bitso calls it [código de correo seguro](https://support.bitso.com/hc/es-mx/articles/41140848915092). Open Profile, Security, Código de correo seguro. Use 4 to 20 letters or numbers, and do not repeat the old code. Security mail for a sign-in, a new device, a password or phone change, and a cancelled, reviewed, or rejected withdrawal should show it. Skip a security mail that does not. Use the name on your exchange's own help page. If that page does not describe an anti-phishing code, judge the mail by the site you typed yourself. ## What locks after you change a security setting? After some security actions, such as a password change, Binance [holds withdrawals for 24 to 48 hours](https://www.binance.com/en/support/faq/detail/360038583951), and the hold ends by itself. A [2FA-device reset](https://www.binance.com/en/support/faq/detail/2de25ddf8c5b4f59adaebe9452f7b64b) also pauses withdrawals, internal transfers, P2P sales and Binance payment services for up to 48 hours. A password change, or any other account-data change, [blocks Bitso withdrawals for 24 hours](https://support.bitso.com/hc/en-us/articles/23140917371796). Support cannot lift that. Block withdrawals and Unblock withdrawals, under security settings, are a switch you control. Kraken's hold is up to 24 hours on new addresses after a password change, and only when Sign-in 2FA and a Master Key are both missing. Give the mailbox its own long password, different from the exchange and from social accounts. The [FBI](https://www.ic3.gov/PSA/2022/PSA220208/) asks for unique passwords. The [FTC](https://consumer.ftc.gov/articles/creating-strong-passwords-and-other-ways-protect-your-accounts) says to use a password manager, with a strong password on the manager itself. Put 2FA on that inbox, off SMS if an app or a security key is offered. Sign out of phones and browsers you do not recognize, from the app icon or a bookmark. On a new Bitso device, stay on the [same phone and connection](https://support.bitso.com/hc/es-mx/articles/15766479738260) and type the newest code on the open screen. You do not need to open a link. Three wrong codes restrict the account, and you have 30 minutes from sign-in. ## What do you do if the account locks you out? Use the exchange's own site, or the app already on your phone. On Binance, read the hold of up to 48 hours on the confirm screen before you continue. At Log In on the official site, enter the email or phone. On a passkey prompt choose Cancel, then My Passkeys Are Not Available, then the password. On Security Verification Requirements pick the missing method, then Security verification unavailable. Under Review can take up to 24 hours. On Bitso, contact Bitso through its in-app or web chat if the authenticator and the recovery code are both gone. Refuse any chat, call, or support account that asks for a 2FA code, a setup key, a recovery code, or the wallet's seed phrase. [Seed phrases](/en/posts/2026-06-23-seed-phrases-explained/) are the wallet's keys. A stranger with the words has the coins. If the phone still shows No service and the login mail is already there, call the carrier from another line. Then open the exchange from a bookmark and read the device list before you move anything. --- ## Keep reading - [Crypto transaction stuck on pending? A gas bid that is too low, or an older nonce from the same Ethereum account, keeps a MetaMask USDT send from confirming, and Speed up is only one of the fixes](https://ptycoin.com/en/posts/2026-10-20-stuck-pending-transaction-speed-up-cancel/index.md): A pending send of 250 USDT can be a low gas bid or a blocked nonce. Wait, speed it up, or cancel with that same nonce. Do not send the same payment twice. - [USDT sent on the wrong network? A completed transfer is a finished payment on the chain you selected, and the wallet or exchange waiting on a different chain has no new balance to show you](https://ptycoin.com/en/posts/2026-10-13-sent-usdt-wrong-network-recovery/index.md): USDT sent on the wrong network confirms on the chain you picked and stays invisible on the other. Keys you hold on an EVM chain may still reach it. Many exchange deposits do not come back. - [How do you tell if the USDT in your wallet is real? Same name, ticker and logo can sit on a fake airdrop, so you match the token contract to Tether's official list on that network and leave the rest untouched](https://ptycoin.com/en/posts/2026-10-06-fake-usdt-token-verify-contract/index.md): A second USDT line in your wallet can be a same-name fake. Compare the contract to Tether's official list on that network, then hide it. Do not swap or approve it. --- Source: PTYcoin — https://ptycoin.com/en/posts/2026-10-27-exchange-account-2fa-withdrawal-allowlist/. Free to read and cite with attribution to ptycoin.com. AI-usage terms: https://ptycoin.com/en/ai-usage/