Lock Down Your Binance Account Before You Trade
Opening a Binance account is the easy part. Keeping it safe is what actually protects your funds. This checklist covers the settings every new user should switch on — 2FA, an anti-phishing code, a withdrawal whitelist, and the habits that stop the scams that empty accounts. If you have not created the account yet, pair this with our registration guide, and keep our referral code handy so you attach SHZB888 before you start.
Why account security is not optional
Crypto is irreversible. Once funds leave your account to an attacker's wallet, there is usually no chargeback and no support ticket that reverses it. Binance runs its own platform security, but the weakest link is almost always the account holder: a reused password, an SMS code intercepted through a SIM swap, or a fake support message that tricks you into giving up a code. The steps below close those gaps. None of them take more than a few minutes, and together they remove the most common ways accounts get drained.
Step 1 — Turn on two-factor authentication (2FA)
2FA means a second proof of identity is required on top of your password. Binance supports several methods, but you should use an authenticator app — Google Authenticator, Authy, or Binance's own — rather than SMS. SMS is vulnerable to SIM-swap attacks, where a thief convinces your mobile carrier to move your number to a new SIM and then receives your codes. Enrol the app, write down the backup key on paper (not in a screenshot), and keep that paper offline. If you ever lose your phone, the backup key is the only reliable way back in.
Related guides
Step 2 — Set an anti-phishing code
The anti-phishing code is a short phrase you choose that Binance then includes in every genuine email it sends you. If an email claims to be from Binance but does not show your code, you know it is fake before you click anything. Scammers send convincing copies of withdrawal alerts and verification requests; the code is the fastest way to tell real from spoofed. Set it under Security > Anti-Phishing Code, and train yourself to check it on every Binance email you receive.
Step 3 — Whitelist your withdrawal addresses
A withdrawal whitelist restricts withdrawals to wallet addresses you have pre-approved. Once enabled, even if an attacker gets into your account, they cannot send funds to a wallet you have not listed — and adding a new address is locked behind a withdrawal cool-down and your 2FA. This single control stops the most damaging step of any account breach. Add only addresses you truly control, and review the list whenever you change wallets.
Step 4 — Manage devices and active sessions
Binance lets you see every device and session logged into your account. Periodically open Security > Devices and sign out anything you do not recognise. Public or shared computers are a particular risk: always log out completely and never tick "remember this device" on a machine that is not yours. A stale session on a borrowed laptop is an open door. Make this a habit after travelling or using a coworking space.
Step 5 — Control API keys and third-party apps
Many traders connect Binance to tax tools, bots, or portfolio trackers through API keys. Each key is a potential entry point. Create keys with the narrowest permissions you need, never enable "allow withdrawal" on a trading bot key, and delete keys for apps you no longer use. The same discipline applies to anything that asks for your API secret — treat it like a password, and never paste it into a website you cannot fully trust.
Step 6 — Recognise the scams that actually drain accounts
Almost every breach starts with a message. The patterns are consistent: a "Binance support" account that DMs you first, a fake verification page that asks for your 2FA code, a giveaway that wants you to "send to receive", or a recruiter offering a job that involves moving crypto. Binance staff will never message you first, never ask for your password or 2FA code, and never run a giveaway that requires a deposit. If a message creates urgency and asks for a secret, it is a scam. Report it and move on. You can read our KYC guide to understand why verification never happens through chat.
The checklist at a glance
| Setting | Where to find it | Why it matters |
|---|---|---|
| 2FA via authenticator app | Security > 2FA | Blocks SIM-swap and password-only access |
| Anti-phishing code | Security > Anti-Phishing Code | Identifies fake Binance emails instantly |
| Withdrawal whitelist | Security > Address Management | Stops theft even after a breach |
| Device & session review | Security > Devices | Closes stale or unknown sessions |
| API key hygiene | Profile > API Management | Removes unused third-party entry points |
| Scam awareness | Habit | Stops the message that starts most breaches |
Treat the withdrawal whitelist and 2FA as non-negotiable. The rest are fast, high-value additions that take minutes.
Frequently asked questions
Is an authenticator app safer than SMS 2FA on Binance?
Yes. SMS 2FA can be defeated with a SIM-swap attack, where a thief moves your phone number to a new SIM and receives your codes. An authenticator app generates codes on your device and is not tied to your phone number, so a SIM swap does not compromise it.
What is the Binance anti-phishing code and why set it?
It is a phrase you choose that Binance includes in every genuine email it sends. If an email claims to be from Binance but omits your code, you know it is fake before clicking anything. It is the fastest way to spot spoofed emails.
How does a withdrawal whitelist protect my funds?
It restricts withdrawals to wallet addresses you have pre-approved. Even if an attacker gets into your account, they cannot send funds to a new wallet, and adding a fresh address is locked behind your 2FA and a cool-down period.
Can Binance support reset my 2FA or ask for my code?
No. Real Binance staff never message you first, never ask for your password or 2FA code, and never run a giveaway that needs a deposit. Anyone doing those is a scammer, regardless of how official the message looks.
Should I let a trading bot use withdrawal permission on its API key?
Never. Create API keys with the narrowest permissions required, keep "allow withdrawal" off for any bot or third-party tool, and delete keys you no longer use. A trading key should only read and place orders, never move funds.
What should I do if I lose the phone with my 2FA app?
Use the backup key you wrote down when enrolling 2FA to restore access on a new device. That is why the backup key should be stored on paper, offline, and never as a screenshot or cloud note.
Does a strong security setup affect my referral code or fee discount?
No. SHZB888 still applies at sign-up and the 20% rebate is independent of your security settings. Good security just protects the account that earns the discount.
How often should I review my account security on Binance?
Check active devices and sessions at least monthly, and immediately after using a shared or public computer. Review your withdrawal whitelist whenever you change wallets, and rotate or delete API keys when you stop using a tool.
Is Binance available in my country, and does that matter for security?
Binance does not operate in the United States and is restricted in several other jurisdictions. Confirm availability where you live before registering, and never use a VPN to bypass regional restrictions, which can trigger account review.
Registration guide
Open the account before you secure it.
KYC guide
Verify identity, then lock the account down.