Anti-phishing code
An anti-phishing code is a secret word you set in your exchange settings. It appears in every genuine email from the exchange, so an email without it can be treated as fake.
How it works
Scammers send emails that look like exchange notifications: "confirm your withdrawal", "account locked", "update your 2FA". They are hard to tell apart by design. So many exchanges let you set your own code that only you and the exchange know.
Once set, every official email includes the code, usually at the top or in the subject line. If the code is missing or wrong, the email is not from the exchange and you should not click its links. Some platforms also show the code in SMS or in-app notifications.
The code only protects against fake emails, not fake websites or calls. If you land on a phishing site from a search result, the code tells you nothing. That is why it is used together with 2FA, a bookmark to the real site and a withdrawal whitelist.
You set the anti-phishing code "Cactus77". An email arrives with the exchange logo: "Suspicious login, verify your account now", but there is no "Cactus77" in it. You delete it, open the exchange from your bookmark and see no unusual logins.
The mistake is setting a code and then never looking for it, or choosing something obvious like your name or the exchange's name. Pick a word nobody could guess and train yourself to find it in every email before clicking anything. Even with the right code, it is safer to open the site yourself than to click links.
Questions and answers
What is an anti-phishing code in simple terms?
It is your own secret word that the exchange uses to sign its emails. No word means the email is fake.
Where do I set an anti-phishing code?
Usually in the account security section of the exchange. The name and location depend on the platform, and some do not offer it.
Does an anti-phishing code protect against every attack?
No, only against fake emails and notifications. For phishing sites, calls and SIM swaps you need other measures: app-based 2FA, bookmarks and a withdrawal whitelist.
Related terms
Read next
Six settings that close the most common ways exchange accounts get taken over. It takes about half an hour.
Read →How to store your seed phrase and keys: a simple schemeYour seed phrase gives full access to a wallet. Where to keep it and what never to do.
Read →Custodial vs non-custodial walletA custodial wallet means a company, such as an exchange, holds the keys to your coins. A non-custodial wallet means…
Updated: 2026-10-19