Not as safe as a TOTP app. SMS is vulnerable to SIM swap attacks — scammers convince your carrier to transfer your number to their SIM and intercept all codes. Prioritize Google Authenticator/Authy, or a hardware security key if available.

What if I lose my phone with 2FA installed?

You need the recovery key saved during 2FA setup to restore it on a new device. If you didn't save it, you'll have to go through account recovery with the exchange — time-consuming and may temporarily lock withdrawals for safety reasons.

Does the withdrawal allowlist slow down my withdrawals?

The first time you add a new address, a waiting period (usually 24–48 hours) applies. After that, withdrawals to addresses already on your list proceed normally. This is a fair trade-off: a one-time delay to permanently block scenarios where an attacker withdraws to their wallet.

What permissions should I grant an API key?

Grant minimum permissions: enable trading if the bot needs it, disable withdrawal permissions unless mandatory, and IP-limit the key. A leaked key without withdrawal rights causes almost no asset damage.

What should I do first if I suspect my account is compromised?

Act in order: change your password, log out of all sessions, revoke all API keys, freeze withdrawals if the exchange supports it, then contact support. The faster you act, the more you limit damage, as on-chain transactions are irreversible.