2FA and passkeys for crypto accounts

For 2FA on a crypto account, use a passkey or a hardware security key where the service offers one, an authenticator app where it does not, and SMS codes only as a last resort. The difference is phishing: a passkey or security key is tied to the real website and simply will not work on a fake one, while a six-digit code can be typed into a fake page as easily as the real one.

Two-factor authentication, ranked

SMS codes — weakest. A code sent by text can be stolen by a SIM swap, where an attacker convinces your mobile carrier to move your number to their SIM. Crypto holders are a favourite target of it. SMS is better than nothing, and it should not guard anything you would hate to lose.

Authenticator apps (TOTP) — good. An app generates a fresh six-digit code every 30 seconds from a secret stored on your phone. No carrier is involved, so SIM swaps do not work. A stolen password alone is no longer enough, but a fake site can still ask for the code and relay it to the real one within those 30 seconds. Save the setup codes offline: if the phone is lost, they are how you get back in.

Hardware security keys — strong. A small USB or NFC key that you tap to sign in, using the FIDO2 standard. The key checks which website is asking, so a look-alike domain gets nothing. Register two keys and keep the spare somewhere safe.

Passkeys — strong, and easier. A passkey is the same FIDO idea kept by your phone, computer or password manager, unlocked with your fingerprint, face or device PIN. It can replace the password altogether, it is bound to the real site's domain, and there is nothing to type into a fake page. The FIDO Alliance explains how they work. If a service offers passkeys, use them.

The settings that matter as much

• Withdrawal address whitelist. Many exchanges let you allow withdrawals only to addresses you added earlier, often with a waiting period for new ones. If someone gets into the account, they cannot send coins to themselves straight away.
• Your email account. Password resets go to your email, so it needs the same protection: a strong unique password and a passkey or security key.
• Anti-phishing code. Some exchanges let you set a word that appears in every genuine email from them. An email without it is not from them.
• Unique passwords. Use a password manager and a different password everywhere, so one breached site does not open the rest.
• API keys. If you created exchange API keys for a bot or tracker, delete those you no longer use, and never give one withdrawal rights.

Setting it up, in order

• Email first. Give your email account a strong unique password and a passkey or security key, since every other reset goes through it.
• Then each exchange. Add a passkey or security key where offered, otherwise an authenticator app.
• Save the backup codes each service shows you, on paper, with your other offline backups.
• Remove SMS as a fallback once a stronger method works, where the service lets you.
• Turn on the withdrawal whitelist and add the addresses of your own wallets.

What 2FA does not protect

2FA protects accounts: exchanges, email, trackers. It does nothing for a wallet you control yourself, where the seed phrase is the only key that matters — how to store it. And it does not stop you from approving a transfer you were tricked into; common crypto scams covers the tricks.

This guide explains how things work. It is not financial, investment or tax advice. Something wrong? Write to hi@perly.io and we will correct it.