iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
If you entered your exchange password, 2FA code, recovery phrase, or other details on a phishing site, assume the account and the email address behind it are exposed. Stop using the page, lock or freeze the exchange account from a clean device, change both passwords, revoke every session and API credential, replace the compromised second factor, and inspect withdrawals before doing anything else.
Do this first: contain the compromise
Speed matters, but do not continue interacting with the phishing page. Close it and do not click follow-up links, reply to the sender, install software, or call a number supplied in the message. Keep the original message, URL, screenshots, timestamps, browser history, and exchange alerts. Those details help the exchange and law enforcement identify what happened.
- Move to a clean device. Use a phone or computer that has current operating-system and browser updates and is not showing signs of malware. If the device used for the phishing page is your only option, disconnect it from the network and use another trusted device for account recovery.
- Open the exchange directly. Launch the official mobile app or type the address you already saved as a bookmark. Do not use a search advertisement, a link in the message, or a link sent by an alleged support agent.
- Lock the account if that feature exists. Coinbase’s official guidance summarizes the priority as “Lock first, ask later.” A lock or freeze can stop withdrawals while you investigate. The exact name and location vary by exchange.
- Contact official support through the exchange’s published help center. Tell support that credentials or authentication codes were entered on a phishing site, provide the preserved evidence, and request an account hold while they review activity.
If you see a withdrawal, trade, API call, or profile change that you did not make, treat the event as an active account takeover. Do not wait to finish every security change before reporting it.
Why changing only the password is not enough
An attacker may already have an active session, a valid 2FA code, an API key, a trusted-device token, access to your email, or a withdrawal address saved in the account. A new password does not automatically remove those footholds. Kraken warns that a compromised registered email can be used to obtain the username, reset the password, and approve withdrawals. Coinbase’s security guidance likewise tells users to remove unauthorized applications, sessions, and devices.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Email access: lets an attacker receive password-reset messages and account alerts.
- Active sessions and trusted devices: may continue working after a password change unless explicitly revoked.
- API keys: can permit trading or account-data access, and some permissions may allow withdrawals.
- Recovery methods: an attacker can add a phone number, email address, authenticator, or other method and use it later.
- Withdrawal settings: a new address or changed allowlist can redirect funds after you believe the account is secure.
Complete recovery sequence
1. Change the exchange password
From the official app or site, open the account’s security settings and change the password to a long, randomly generated value that has never been used elsewhere. The Federal Trade Commission’s hacked-account guidance says to change the account password and create one that is hard to guess. Do not reuse the old password on email, banking, cloud storage, or any other service. A password manager can generate and store a unique credential without requiring you to memorize it.
If the exchange refuses the change, repeatedly rejects a correct password, or says the email or phone has changed, stop trying random recovery links. Use the platform’s official account-recovery process and tell support that phishing may have enabled an attacker to alter the profile.
2. Secure the email account before relying on it for recovery
Use the email provider’s official app or a saved bookmark. Change the email password to a separate, unique value, then inspect the account for persistence mechanisms:
- Forwarding addresses and automatic forwarding rules
- Filters that hide exchange alerts or delete security messages
- Recovery email addresses and phone numbers
- Authorized apps, connected devices, and active sessions
- Recent sign-in locations and unfamiliar security events
Remove anything you did not create and sign out of every other device. If the same password was used on other services, change it everywhere it was reused. Email is part of exchange security, not a separate concern: whoever controls the inbox may be able to reset the exchange account or approve a withdrawal.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
3. Sign out every exchange session
In the exchange’s security or device-management page, choose the option that signs out all devices or all sessions. Then review the remaining device list one by one. Remove browsers, phones, desktop apps, and locations you do not recognize. The FTC explicitly advises users to “Sign out of all devices.” Do not assume that changing the password performs this step; many services leave existing sessions active.
4. Revoke applications and API keys
Open the connected-apps, API, or developer-settings area. Delete every key you do not recognize and recreate legitimate keys after the incident. For keys you keep, disable withdrawal permission and limit trading, read, and transfer permissions to the minimum required. Check both personal API keys and keys created by portfolio, tax, trading, or automation software. An unfamiliar key is evidence of access even if no unauthorized transaction is visible yet.
5. Replace exposed 2FA and recovery factors
If you typed a one-time code into the phishing page, regard that factor as compromised. Generate new authenticator secrets, remove the old authenticator enrollment, and regenerate backup or recovery codes. If a phishing page captured a phone number, recovery code, or security-question answer, replace that information wherever possible.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Prefer a passkey or FIDO hardware security key. Coinbase states that “Hardware keys are best” and recommends “the strongest type of 2FA the platform allows, ideally a Yubikey or similar hardware security key.” A hardware key or passkey verifies the legitimate site’s origin, making it substantially harder for a look-alike domain to relay the authentication.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Use an authenticator-app TOTP code when a passkey or hardware key is unavailable. Treat SMS as a weaker fallback because an attacker who completes a SIM swap may receive text messages. Protect the email account with the same strongest factor it supports; securing only the exchange leaves the reset channel vulnerable.
Second-factor choices after phishing
| Factor | Phishing resistance | Recovery and backup considerations | Practical use |
|---|---|---|---|
| Passkey | Strong; bound to the legitimate service and device ecosystem | Plan how you will recover if every enrolled device is lost; keep more than one trusted device where the platform permits | Best for exchanges and email when supported |
| FIDO hardware key | Strong; the key does not disclose a reusable code to a fake site | Buy or enroll a spare and store it safely; confirm the exchange and email both support the model | High-value accounts and recovery-resistant protection |
| Authenticator-app TOTP | Better than a password alone, but a real-time phishing site can trick you into entering the code | Protect or securely back up the authenticator seed; regenerate it after exposure | Fallback when passkeys or keys are unavailable |
| SMS | Weakest of these options because of SIM-swap and number-porting risk | Keep carrier account protections and a carrier PIN; do not rely on SMS as the only factor | Last-resort fallback or recovery channel |
Audit money movement before declaring victory
Review withdrawals, deposits, and trades
Export or screenshot recent activity, then compare every deposit, conversion, trade, withdrawal, and address-book change with your own records. Look beyond completed transactions: a pending withdrawal or newly created order can still be stopped. Ask official support to freeze or reverse an unauthorized transfer immediately; blockchain transfers are generally difficult or impossible to reverse once confirmed.
Check withdrawal addresses and allowlists
Open the withdrawal-address book and remove unfamiliar entries. If the exchange offers an address allowlist, enable it after you have verified the list. An allowlist can restrict withdrawals to addresses you approved in advance, although the exact delay and approval rules differ by platform. A changed allowlist is itself a sign that the attacker reached account settings.
Inspect trading and withdrawal controls
Turn on transaction-level 2FA and withdrawal confirmations where available. Check whether the exchange separates trading permissions from withdrawals and whether a new address triggers a time delay or an email confirmation. These controls are useful only if the email account and 2FA factor are also secure.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How to report and document the incident
When contacting support, use only the exchange’s official help center, in-app support, or published support address. Include the account email, approximate timeline, transaction IDs, destination addresses, screenshots, phishing URL, and the device and browser involved. Never send a password, one-time code, recovery phrase, private key, or cryptocurrency to “verify” ownership.
Scammers often impersonate support after a phishing event. An alleged agent who asks for remote-access software, a screen-sharing session, a seed phrase, or a transfer is not helping you. End the conversation and reopen support through the official channel. Preserve the scammer’s messages and payment addresses for the exchange and appropriate authorities.
If you entered a seed phrase or private key
A seed phrase or private key is different from an exchange password. If it was exposed, assume the associated wallet is permanently compromised. From a clean device, create a new wallet with a new seed phrase, move remaining assets to it, and stop using the old wallet. Never paste the old phrase into a “recovery” form or give it to support. If the phrase controls assets held through an exchange-connected wallet, tell official support exactly what was exposed so they can advise on account and custody steps.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePlatform controls to look for
Names and availability vary by exchange, region, account type, and app version. Use this checklist rather than assuming every platform offers every control.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
| Control | What to verify | Why it matters after phishing |
|---|---|---|
| Account lock or freeze | Can you stop withdrawals immediately from the app or security page? | Buys time while credentials and sessions are investigated |
| Session and device view | Are locations, browsers, login times, and trusted devices listed? | Reveals and removes persistent access |
| Application and API management | Can keys be deleted and permissions limited by function? | Stops automated trading or transfer access |
| Withdrawal allowlisting | Can withdrawals be limited to preapproved addresses, with a delay for changes? | Reduces the chance of an instant transfer to a new address |
| Transaction 2FA | Does a withdrawal or security change require a strong second factor? | Adds a barrier beyond login credentials |
| Anti-phishing code | Can a private code appear in genuine exchange emails? | Helps distinguish authentic alerts from look-alikes |
| Support escalation | Is there an official path for account takeover and unauthorized transfers? | Gets the incident to a team that can place holds and investigate |
Monitor the account after recovery
For the next several weeks, review login alerts, security-setting changes, API activity, deposits, trades, and withdrawals. Keep notifications enabled for every event the exchange offers. Check the email account at the same time; attackers may wait until attention fades before using a forwarding rule or recovery method.
Scan the clean device with its built-in security tools, install operating-system and browser updates, remove unknown extensions, and uninstall remote-access software you did not intentionally install. If malware is suspected, reset the device or have a qualified technician examine it before using it for financial accounts again.
Build stronger protection once the incident is contained
- Use a dedicated email address for exchange accounts and protect it with a passkey or hardware key.
- Store unique, randomly generated passwords in a reputable password manager.
- Enroll two hardware keys or passkeys where the service supports a backup, keeping the spare separately and securely.
- Enable withdrawal allowlisting, transaction 2FA, login alerts, and anti-phishing codes offered by the exchange.
- Bookmark the official exchange and email login pages; never rely on ads or unsolicited links.
- Keep only the API permissions and connected applications you actively need.
- Separate long-term assets from an actively traded exchange balance when your custody plan allows it.
A concise post-phishing checklist
- Stop using the phishing page and preserve its evidence.
- Open the exchange from its official app or a trusted bookmark on a clean device.
- Lock or freeze the account and alert official support.
- Change the exchange password and the linked email password to two different, unique values.
- Sign out every exchange and email session; remove unknown devices.
- Delete unfamiliar applications and API keys; restrict legitimate keys.
- Replace exposed 2FA enrollments and recovery codes, choosing a passkey or hardware key when possible.
- Inspect forwarding rules, recovery details, withdrawals, trades, addresses, and allowlists.
- Report unauthorized transfers with transaction evidence immediately.
- Keep monitoring alerts and harden the account with allowlisting and anti-phishing controls.
What a successful recovery looks like
You are not finished when the password works again. Recovery is complete only after the email account is clean, all old sessions are revoked, unknown apps and API keys are removed, exposed factors are replaced, withdrawal settings match your records, and official support has reviewed any suspicious transfer. The lasting lesson is that an exchange login is a chain: email, device, session, authentication factor, API access, and withdrawal controls all need to be secured.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
