Lock It Down: 2FA, Test Transfers, and What To Do If It Goes Wrong

Your Password Alone Is Not Enough

Here's what should worry you: passwords get leaked in data breaches, guessed through social engineering, or stolen through phishing. If your exchange account is protected only by a password, it's a matter of time.

Two-Factor Authentication (2FA) adds a second lock to your account. Even if someone steals your password, they still can't get in without the second factor. This lesson shows you how to set it up properly, and the common mistakes that make 2FA useless.

What Is 2FA and Why Does It Matter?

2FA means you need two things to log in:

1. Something you know: your password
2. Something you have: a code from your phone (changes every 30 seconds)

An attacker who steals your password still needs your physical phone to generate the code. This single step blocks the vast majority of account takeovers.

The Three Types of 2FA (Not All Are Equal)

SMS OTP (Weak, avoid if possible) A code sent via text message to your phone number. Better than nothing, but vulnerable to SIM swapping, where an attacker convinces your mobile carrier to move your number onto a SIM they control.

Authenticator App (Strong, use this) Apps like Google Authenticator or Microsoft Authenticator generate a new 6-digit code every 30 seconds. The code is generated on your device, never sent over the network. This is the sweet spot of security and convenience.

Hardware Security Key (Strongest, for high-value accounts) Physical USB devices like YubiKey. You plug it in or tap it to authenticate. Nearly impossible to phish. Overkill for most beginners, but worth it for accounts holding large amounts.

Step-by-Step: Setting Up Google Authenticator

1. Install Google Authenticator from Play Store or App Store
2. Open your exchange (app or website) and go to Security Settings
3. Find "2FA" or "Two-Step Verification" and select "Authenticator App"
4. Scan the QR code shown by the exchange with Google Authenticator
5. Save the backup code the exchange gives you: write it on paper and keep it apart from your seed phrase
6. Enter the 6-digit code from the authenticator to confirm setup

Critical: When the exchange shows you a backup/recovery code during 2FA setup, write it down on paper. If you lose your phone, it is the quickest way back in. Without it, you can be locked out of your own account until the exchange's support verifies who you are, which can be slow.

Account Hardening Checklist

Beyond 2FA, lock down your exchange account with these steps:

Email security:

• Use a dedicated email address for crypto exchanges (not your daily Gmail)
• Enable 2FA on the email account too, because if someone hacks your email, they can reset your exchange password

Password hygiene:

• Use a unique, strong password for each exchange (never reuse passwords)
• Use a password manager (Bitwarden is free and excellent) instead of remembering them
• Never share passwords over WhatsApp, Telegram, or email

Device security:

• Enable screen lock on your phone (biometric + PIN)
• Keep your phone OS and apps updated
• Don't install APKs from unknown sources
• Review app permissions. No app needs access to your SMS unless it's doing OTP verification

Withdrawal settings:

• Enable withdrawal address whitelisting, if your exchange offers it
• Turn on a waiting period for new withdrawal addresses, if your exchange offers one
• These mean even if someone accesses your account, they can't instantly withdraw to their own wallet

The SIM Swap Threat (India-Specific)

SIM swapping is a real threat in India. Here's how it works:

1. Attacker gathers your personal info (name, Aadhaar number, phone number) from a data leak or social engineering
2. They visit a telecom store or call customer care, claiming to be you
3. They get your number transferred to a new SIM
4. They now receive all your SMS OTPs, and can reset passwords on every account linked to that number

Protection:

• Switch from SMS 2FA to Authenticator app 2FA on every account
• Treat a sudden loss of mobile signal as an alarm: call your operator from another phone and check your accounts
• Enable email-based recovery as a backup, not SMS-based

Quick Recap

• 2FA adds a second lock that blocks most account takeovers
• Use an authenticator app, not SMS
• Save your 2FA backup codes on paper, because losing your phone without them means losing access
• Use a dedicated email for crypto, with its own 2FA
• Enable withdrawal whitelisting and waiting periods where your exchange offers them
• Protect against SIM swap by avoiding SMS-based 2FA, and act fast if your signal suddenly drops