November 5, 2026 - 6 min read

By PhishClean Research Team

What is an anti-phishing code, and how far can you trust it?

Crypto exchanges let you set a secret word that appears in their real emails. It's a good feature with a narrow job, and it fails in ways people don't expect. Coldcard's anti-phishing words solve a different problem.

An anti-phishing code is a word or string you choose in your account settings. From then on, the service includes it in the emails it sends you. Fake emails shouldn't have it, because the scammer doesn't know what you picked. Binance says the code will appear in every legitimate email and SMS message it sends you, in supported cases. Crypto.com says that once it's on, all emails from its App and Exchange include the code.

How to set one up

• Binance app: Profile, then Account Info, then Security, then Anti-Phishing Code.
• Crypto.com App: Settings, then Security, then Anti-Phishing Code. Crypto.com's Exchange has this under Security in the dashboard and requires two-factor authentication first. Its NFT product has a separate code.
• Other exchanges: most big ones have an equivalent. Search for it in the account security settings.

Menus change, so go by what your app shows. Pick something you'll recognize but that has no connection to your other passwords. Binance says to treat it as sensitive and never to share it with anyone, staff included. Crypto.com recommends updating it every 30 days.

What the code proves, and what it doesn't

The code authenticates one thing: an email. It's not a password, and it doesn't verify a person or a web page.

How a code can leak

A thread on r/Crypto_com titled "Anti-Phishing Code Leak" argued that scammers got a user's code by triggering a remote login, which made Crypto.com generate a legitimate email. We couldn't verify that report, and we found no statement from Crypto.com about it, so treat it as one person's account. Here's what can be said with confidence about how it would have to work.

A genuine alert goes to your inbox, so triggering one doesn't show the attacker your code by itself. They'd need something more. These are the realistic routes:

• Your mailbox is compromised. Your code is in every message from the service. If someone can read your email, they have it.
• Your exchange account is compromised. The code sits in the settings of an account they've logged in to.
• You shared it. A fake support agent asks you to forward an email or send a screenshot "to verify". The code goes with it.
• The service or an email vendor was breached. Your code has to be stored somewhere readable, so it can be added to emails. Unlike a password, it can't be stored as a one-way hash.

There's also a trick that doesn't need the code at all. An attacker with your stolen password attempts a login, so the exchange sends you a real security alert. Minutes later, a "support agent" calls: "You just got an email about a login from abroad, with your code in it. That was us alerting you. Let's secure your account." The email was real, so the story feels true. Every exchange that sends alerts is exposed to this pattern. The code did its job, and it wasn't enough.

If you think your code has leaked

1. Treat your email account as the likely source. Change its password from a clean device, sign out other sessions, and look for forwarding rules you didn't set. Our hacked email guide has the full steps.
2. Change your exchange password, and move to a passkey or hardware key if it's offered. Check withdrawal whitelists and active API keys.
3. Set a new anti-phishing code.
4. Report suspicious messages to the exchange through its app.

Coldcard's anti-phishing words solve a different problem

The r/coldcard crowd means something else by this term, and the two get mixed up in search results. Coldcard is a Bitcoin hardware wallet. Its anti-phishing words protect you from a tampered or swapped device, not a fake email.

The PIN has two parts: a prefix and a suffix. After you enter the prefix, the device shows two words unique to that specific Coldcard and that prefix. You write them down during setup. On every login, you check that the words match before you enter the suffix. Coldcard's documentation is clear about what to do if they don't: stop, and don't enter the suffix. Words that don't match suggest a tampered or swapped device, or simply a mistyped prefix. The words change when you change your prefix, so update your written record if you do.

Coinkite recommends four digits plus four digits in the PIN, and notes that shorter combinations might allow brute-force attacks.

What actually keeps crypto safe from phishing

Use the code, since it costs nothing. Just don't lean on it. Bookmark your exchange and sign in only from the bookmark or the app. Use a passkey or hardware key (see phishing-resistant MFA). And never type a recovery phrase into any website, for any reason.

That last one is what PhishClean's paid Paste Guard is for: a warning before you paste a recovery phrase into any website. The free tier blocks reported phishing sites, and the 7-day trial includes lookalike warnings for exchange and wallet brands.

Frequently asked questions

What is an anti-phishing code?

A word or string you choose in your account settings that the service includes in its real emails. An email claiming to be from the service without your code is likely fake.

Can an anti-phishing code be faked or stolen?

A scammer can't guess it easily, but it can leak if your mailbox or account is compromised, if you forward or screenshot an email, or if the service is breached. If that happens, fake emails can include the correct code.

Does an email with the right code mean it's safe to click?

It's a good sign, but sign in through the app or a bookmark anyway. The code only tells you about the email. It doesn't verify a caller, a chat message or a website.

What are Coldcard anti-phishing words?

Two words a Coldcard hardware wallet shows after you enter the first part of your PIN. They're unique to your device and prefix. If they don't match your record, stop, because the device may have been tampered with or you may have mistyped the prefix.

Sources

• Binance: What is an anti-phishing code?
• Crypto.com Help Center: Anti-phishing code
• Crypto.com Help Center: All about anti-phishing
• Coldcard documentation: PINs
• Coldcard: Anti-phishing words

Last updated: 5 November 2026