Two-factor authentication in the app

Two-factor authentication (2FA) means that signing in needs a code as well as your password, so someone who learns your password still cannot get in. This page covers it in the mobile app: setting it up, signing in with it, the codes asked for when you move money, and what to do when a code will not work.

How do I turn on two-factor authentication in the app?

1. On Home, tap the gear icon at the top right to open Profile.

2. In the Settings card, tap Security.

3. Tap Two-Factor Authentication. While it is off, the row says Disabled - Set up 2FA to secure your account.

4. On Choose Your Method, pick how you want to receive codes — Authenticator App, SMS Messages or Email — and tap Continue. For SMS, enter your Phone Number first, with the country code.

5. Set the method up:

   • Authenticator App: scan the QR code with an app such as Google Authenticator or Authy. If you cannot scan it, tap Copy Secret and paste the key into the authenticator app by hand.
   • SMS Messages or Email: the app sends a code to your phone or email address.

   Then tap I've Set It Up.

6. On Verify Your Setup, type the 6-digit code from your authenticator app, text message or email, and tap Verify & Enable.

7. The app shows Two-Factor Authentication Enabled! and your Recovery Codes. Tap Copy Codes and store them somewhere safe before you tap Complete Setup — see the next question.

From then on the Security page shows Enabled with and the method you chose. If a step fails, the message on screen says why.

What are recovery codes and why do they matter?

Recovery codes are your way back in if you lose the phone with your authenticator app, change your phone number, or cannot get codes for any other reason. You get them once, at the end of setup, on the Two-Factor Authentication Enabled! screen.

• They look like XXXX-XXXX-XXXX — letters and numbers in three groups of four.
• Each code works once. After you use one, cross it off.
• The app does not show them again. When you tap Copy Codes, it reminds you: Recovery codes copied. Paste them somewhere safe — you will not be shown them again.

Keep them somewhere other than the phone you use for codes: a password manager, or written down and put away safely. Do not send them to anyone, including someone who says they work for the exchange — the exchange's team never needs them.

If you have lost both your codes and your recovery codes, contact the exchange's support, and be ready to prove who you are. Nobody can read your recovery codes back to you: the exchange does not keep them in a form anyone can read.

How do I sign in when two-factor is on?

Sign in with your email address and password, or with Google, as usual. The next screen is Verification Required, and it tells you where your code is:

• Enter the code from your authenticator app — open your authenticator app and use the current code shown for this account.
• Enter the 6-digit code sent to your phone or Enter the 6-digit code sent to your email — a code has just been sent to you.

Type the six digits into the boxes. The app checks the code as soon as you type the sixth digit; you can also tap Verify Code.

For codes by text message or email, Didn't receive the code? Resend sends a new one. Use the newest code you received.

A code can only be used once. If you have just used an authenticator code — to sign in on another device, for example — wait for the app to show the next one.

If an authenticator code is refused although you typed it correctly, check that your phone's date and time are set automatically. Authenticator codes are worked out from the time, so a phone clock that is off gives codes the exchange does not accept.

I lost my phone or cannot get a code — how do I sign in?

Use one of your recovery codes on the Verification Required screen:

1. Tap Can't get a code? Use a recovery code under the Verify Code button.
2. Type one of your recovery codes into the Recovery code field. You can type it with or without the dashes.
3. Tap Verify Code.

Each recovery code works once, so cross off the one you used. To go back to the six boxes, tap Use a verification code instead.

Once you are in, it is a good idea to set up two-factor again on your new phone or number: turn it off and on again as described below, and keep the new recovery codes you are given.

If you have no recovery codes left, contact the exchange's support.

Older versions of the app show only the six boxes. If you cannot see Can't get a code? Use a recovery code, update the app from your app store.

Why does the app ask for a code when I withdraw or release crypto?

Some exchanges ask for a two-factor code to confirm a withdrawal, or to confirm releasing crypto on a P2P trade. The app asks when you confirm, not when you sign in.

Withdrawals. After you tap Confirm Withdrawal and confirm the amount, a box titled Confirm this withdrawal asks for a Verification code — from your authenticator app, or sent to your email or phone. Type it and tap Confirm. Resend sends a new code by email or text message; Cancel takes you back to the amount without losing what you typed. You can type a recovery code here instead.

If your account has no two-factor method the exchange accepts for withdrawals, the app shows Two-factor authentication required and names the methods accepted. Turn one on in Profile > Security, then withdraw again.

P2P release. When you release crypto on a P2P trade you are selling, a box titled Confirm the release may ask for your code. For email and text message, the code is sent as soon as the box opens, and Send a new code sends another. You can type a recovery code here too.

What happens if I enter the wrong code too many times?

The limit is five wrong codes in a short time, and what happens next depends on where you are:

• Signing in: further attempts are refused with Too many 2FA attempts. Please try again in a few minutes. Wait, then sign in again. If the app says Invalid or expired 2FA challenge. Please log in again., go back and sign in from the start.
• Withdrawals: each wrong code shows That code is incorrect. You have N attempts left. After the last one the app says That code is incorrect, and that was the last attempt. Try again in and how long to wait. You stay signed in.
• P2P release: each wrong code shows how many attempts are left. After the last one the exchange signs you out for safety, and the sign-in screen says Signed out after 5 incorrect codes. Sign in again to continue — you can confirm the release again in and how long to wait. Sign in again, then release the crypto once the wait is over.

If you keep getting codes refused and you are sure they are right, check your phone's date and time, or use a recovery code.

How do I turn two-factor authentication off?

1. Open Profile (the gear icon at the top right of Home), then Security.
2. Tap Two-Factor Authentication. The box Disable Two-Factor Authentication opens.
3. Confirm it is you with either your Account password or a Current two-factor code. If you sign in with Google and have no password, use a code.
4. Tap Disable.

Your account is then protected by your password alone, and the Security page shows two-factor as disabled. To switch to a different method, turn two-factor off and set it up again with the new one — and keep the new recovery codes.

Some exchanges require two-factor for withdrawals. If yours does, turning it off means the app asks you to turn it on again before your next withdrawal.