Exchange security checklist and fake-support warning signs

1. Protect recovery before adding funds

Your email may receive login alerts and recovery messages. Give it a unique password, multifactor authentication and recovery methods you still control. Inspect its unfamiliar sessions and forwarding rules.

A password manager can help maintain different passwords across services. Store recovery codes securely and accessibly; do not share them in messages or publish them in cloud documents.

2. Understand the limits of authentication

CISA recommends phishing-resistant multifactor authentication. Supported FIDO/WebAuthn methods, such as appropriate passkeys or security keys, reduce the risk of authentication being relayed through a fake login site.

Authenticator codes can still be phished in real time, and text-message authentication faces SIM-swap risks. Enabling MFA does not make every login link safe. Review recovery options before relying on a single device.

3. Review the account settings

1. Use a unique exchange password, separate from your email and other services.
2. Enable supported strong authentication and understand lost-device recovery.
3. Inspect login sessions and security activity; revoke unfamiliar access.
4. If available, set an anti-phishing code, but do not treat its presence as proof that a message is genuine.
5. Understand withdrawal allowlists and any waiting periods before enabling them.
6. Avoid creating API keys you do not need; review and revoke unknown permissions.

4. Recognize fake customer support

Common danger signals include 'move funds to a safe address', 'share your screen to verify', 'pay first to unlock withdrawal' or 'send the code so we can fix it'. An avatar, caller ID, staff-number screenshot or group-admin role is not identity verification.

Do not validate a suspicious message using a link supplied by that same message. Open the official application yourself and contact support there. If the platform offers a channel-verification tool, reach it through that trusted entry point.

1. Never give a caller or chat contact passwords, one-time codes, private keys or seed phrases.
2. Do not install remote-control software or expose account operations through screen sharing for an unsolicited helper.
3. Do not pay a stranger who guarantees recovery of lost funds.

5. If you already interacted

Record whether you merely opened a page, entered credentials, approved access or sent funds. These have different consequences. Stop interacting with the suspect page.

From a trusted device, secure linked email, change compromised passwords and revoke unfamiliar sessions. If unauthorized activity is suspected, use the platform's available freeze or emergency-support options; inspect API permissions and withdrawal history.

Preserve messages and transaction records. On-chain transfers are generally not something you can reverse yourself. Report through official support and, where appropriate, local law enforcement; recovery is not guaranteed.

Frequently asked questions

Official references

• OKX: false customer service fraud
• OKX: account security
• CISA: phishing-resistant MFA