Security settings: 2FA, devices, anti-phishing code and account recovery

Last updated: 2026-10-15

All of these settings are on the Security page. Most changes ask for a verification code, so nobody can change them with your password alone.

Two-factor authentication (2FA)

• Google Authenticator: scan the QR code with an authenticator app and confirm with a code.
• Email and SMS codes: sent to your verified email or phone (SMS only where the exchange has it switched on).
• Login 2FA: asks for a code every time you log in.

A code is required for sensitive actions, including every withdrawal, adding or deleting withdrawal addresses, changing your password, email or phone, managing API keys, sending gift cards and changing payment methods.

Device verification and device management

With device verification on, logging in from a new device needs a code. Device management lists your logged-in devices; you can log one out, remove it, or log out all other devices at once.

Account activity shows recent logins and security events with the IP address, device and location.

Anti-phishing code

Set a personal anti-phishing code and it appears in the emails we send you. If an email claims to be from Xoibit but does not show your code, do not click its links.

Security questions

Choose up to five security questions. They are used to confirm it is you if you ever need to reset 2FA, your email or your phone.

Lost access to 2FA, email or phone?

Use Security reset:

1. Choose what you need to reset.
2. Confirm with a method you still have, if any.
3. Enter and verify your new email, phone or authenticator.
4. Answer your security questions.

You have a limited number of attempts, and an unfinished request expires after 15 minutes. The request is then approved by the exchange.

Disable your account

If you think someone has access to your account, you can disable it from the Security page (a code is required). Then contact support.