SMS codes, authenticator apps, and passkeys

The password is the part a site can email you

An exchange login is an account at a company. The company can reset the password, lock the account, or ask for another check before a withdrawal. That is different from a recovery phrase, which the company does not hold and cannot reset. This page is about the login. The page on exchange balances and self-custody is about who can move the coins after you are in.

A password proves that someone knows a string. People reuse strings, and phishing pages collect them. A second factor is a separate check so that the string alone is not enough. The useful question is what that second check is tied to: a phone number, an app on one phone, a small hardware key, or a passkey bound to the site's own name.

Four checks that get called two-factor

SMS and voice codes are sent to a phone number. Whoever receives the number receives the code. An authenticator app, sometimes called TOTP, shows a short code that changes every half minute. The secret that generates the code was shown as a QR code when you turned the feature on, and it lives in the app, not at the phone carrier. A security key is a small device you tap or plug in. A passkey is a key pair the browser or the phone creates for one site. The site stores the public half. The private half is not a code you type.

These are not the same strength wearing different logos. SMS fails when the number moves. An authenticator fails when the phone is lost and you did not save the setup secret, or when you type the code into a lookalike site that asks for it in the same minute. A security key and a passkey are checked against the site name in the browser, which is why a copied login page has a harder time using them. None of them stop you from signing a bad transaction inside a wallet you already unlocked. That is a drainer problem, and it has its own page.

What a SIM swap changes

Your mobile carrier maps a phone number to a SIM card, or to the eSIM profile in the phone. A SIM swap is that map changing. The number starts ringing and texting on a SIM the attacker controls. Your phone shows no service, or it shows service but texts to that number do not arrive. From the carrier's point of view the number still belongs to the account. From the exchange's point of view the SMS code is still going to the right number.

The path is ordinary account recovery, not a break-in of the exchange's servers. An attacker who already has the email password, or who can reset the email because the email account also uses SMS, asks the exchange for a login code or a password reset. The code arrives on the new SIM. Withdrawal hold, if the exchange has one, is then the remaining delay. Some exchanges add a wait after a two-factor change. That wait only helps if you notice the number died and you can still reach support by another path you set up in advance.

This page does not describe how to persuade a carrier, which documents a store accepts, or which carriers are easier to talk into a port. Those details are the attack. The defense is to stop using the phone number as the only second factor on the email account and on the exchange, and to notice a dead phone as an emergency rather than as a network glitch you will look at tomorrow.

An authenticator app

When you enable an authenticator, the site shows a QR code and usually a text secret under it. The app stores that secret and computes the six-digit code from the current time. The exchange stores the same secret. A matching code means the app and the server share it. The carrier is not in that conversation.

Write the setup secret down, or save the backup codes the site offers, before you close the screen. A new phone does not inherit the app's secrets unless you used that app's own encrypted backup and you still know its password. A photo of the QR code in a camera roll is a copy of the secret. Treat it like a password. If the site lets you register a second authenticator, do that on a second device you control, then store one device somewhere other than the bag you commute with.

Codes can still be phished. A lookalike site asks for the email, the password, and the current six digits, then uses them on the real site immediately. The code expires quickly, which is why the fake page submits it at once. An authenticator does not look at the address bar. You do. The URL page walks through that check. If the exchange offers a security key or a passkey as well, prefer that for the login and keep the authenticator as the backup you can still use when the key is at home.

A security key

A security key speaks a protocol the browser already understands, usually WebAuthn. The exchange registers the key. Later, the login page asks the browser for a signature from that key. You tap the key, or enter its PIN. The signature is tied to the site name the browser believes it is talking to. A page at a different domain does not get a signature that the real exchange will accept for its own name.

Register two keys if the exchange allows two. Keep the second in a drawer, not on the same keyring as the first. If the exchange allows only one, the authenticator backup codes are the spare, and you should know where they are before the key goes through a wash. A key you bought from a random marketplace listing is a worse bet than a key from a known maker. This site does not rank those makers and does not quote prices.

The key does not hold your bitcoin. It holds a login credential for a website. Losing it does not by itself move coins. Losing it can lock you out of the exchange until support, or your backup factor, lets you back in. That lockout is the trade for making a SIM swap insufficient.

Passkeys follow the site name

A passkey is a login credential created on the device. The private key stays in the phone, the computer, a hardware key, or a password manager that syncs it. The website stores the public key and an identifier. On the next visit the site asks for a signature. You unlock the device with the same PIN, face check, or fingerprint you already use. There is no six-digit code to read aloud to a caller.

The binding that matters is the site's domain. A passkey created for the exchange's real hostname is not offered to a different hostname. A password can still be typed into a lookalike, and an authenticator code can be typed anywhere. A passkey prompt that never appears on a page claiming to be your exchange is a signal that the hostname is wrong.

Synced passkeys move the recovery problem. If the passkey copies itself through an Apple, Google, or password-manager account, anyone who can open that account may be able to use it. Protect that account with a non-SMS factor. A passkey that lives only on a hardware key does not sync, and it does not reappear on a new laptop until you register another key. This site has not tested each exchange's settings screen and does not claim which venues offer a passkey. If the setting exists, it does not use your phone number. If the only choice is SMS, the number is still the second factor.

The email account is upstream

Password resets, withdrawal notices, and two-factor changes go to email. An exchange key is useless if a reset through an SMS-only inbox can remove it. Open the email provider, add an authenticator or a security key, and delete recovery numbers you no longer control. Read login alerts from a bookmark. A button inside the mail can point at a copy of the site.

Backup codes and a dead phone

Most exchanges show a set of one-time backup codes when you turn on two-factor. Each code works once. They exist so a lost phone is an inconvenience rather than a support ticket in which you are trying to prove you are yourself while someone else is holding the SMS channel. Print them or write them. Do not store the only copy in the same email account you are trying to protect, and do not store it in a screenshot folder that syncs to a cloud you have not thought about.

If the phone goes dark and you suspect the number has moved, use the backup code or the spare key from a network that is not the dead phone. Change the email password. Remove SMS as a factor if the site still has it registered. Do that before you spend the afternoon at the carrier store. Coins still on the exchange can be withdrawn as soon as the reset finishes. Coins already in a wallet you control are not moved by an exchange login.

An order that does not depend on one brand

Do this while you still have the phone, not after the number fails. Write down the backup codes the exchange shows, and store them offline. Turn on an authenticator app, a security key, or a passkey, whichever the account actually offers. Confirm you can log out and log back in with the new factor before you disable SMS. If you disable SMS first and the new factor was a mis-scan of the QR code, you have locked yourself out. Then remove SMS, including any 'backup SMS' the settings page hid under a toggle. Repeat the same sequence on the email account.

Set a withdrawal allowlist if the exchange has one, so a new address cannot be paid immediately. Read the hold time on that page. Alerts to the phone number are weak during a SIM swap, because that number just moved. Alerts to the hardened email account still arrive. A password manager is where the long unique password lives. The security tools page mentions NordPass, with the affiliate disclosure beside the link. This guide does not review it, and a manager does not replace the second factor.

What a stronger login leaves untouched

Two-factor does not review a token contract. It does not notice a poisoned address in your history. It does not stop a signature you approve in a wallet. It does not make an exchange solvent. It does not recover a recovery phrase you typed into a form. People who have just been SIM-swapped are often told by a stranger in their inbox that a 'recovery agent' can reverse the withdrawal for a fee. That fee is a second theft. The exchange's own support, reached from a bookmark, is the only party that can talk about an account they operate. On-chain withdrawals do not have a chargeback desk.

If you want a second opinion on a token someone sent you while the account noise was happening, paste the contract address into the token checker. Do not paste a seed, a password, a backup code, or a two-factor secret. The checker rejects phrases. It still does not need them, and a page that asks for them is not this one.

Questions

Is SMS better than no second factor at all? Yes, against a password that leaked in an old dump and nothing else. No, against someone who is willing to move the phone number. If the account can hold an amount you would notice losing, SMS should not be the only extra check, and it should not be the backup that support will accept after you thought you had turned it off.

Will an authenticator app survive a SIM swap? The codes keep working, because they do not use the SIM. The risk is the reset flow around the app. If the attacker can turn two-factor off using email and SMS, the app on your phone is a device you are holding while the account ignores it. Disable that reset path.

Are passkeys safe if they sync? They are safer than a password against a fake website, because the fake hostname does not receive the credential. They are not safer than a hardware key against takeover of the account that stores the sync. Read whether the passkey syncs, and put a non-SMS factor on that store.

What if support asks me to read a code aloud? That code is a login. Reading it to a caller gives them the current session. Exchange support does not need your password, your backup codes, or a seed phrase. End the call and open the exchange from a bookmark if you want to check a real ticket.