Dated, not eternal
Every specific claim about how a platform behaves is tied to the date the page was read. Interfaces change. A guide that states a setting as permanent fact is wrong within months and never admits it.
Source policy
Read it, date it, or leave the gap.
Security writing is full of confident numbers with no origin. This page exists so that you can see which parts of these guides rest on a document we opened, and which parts are reasoning that you are free to disagree with.
Four rules
What gets written down and what does not.
More than one platform
Where a control exists on several exchanges, this page lists more than one of them, and the standards body or regulator behind it where there is one. A claim checked against a single vendor's help page is a claim about that vendor, not about the thing.
No borrowed statistics
Figures on how much is stolen, how many people are targeted, or how long a review takes are not used here unless we can trace them to a source we would stand behind. In several guides that means there is no number at all, which is the honest outcome.
No invented experience
We have not logged into a customer account to write any of this, and we do not claim to have. Where a guide describes what a process feels like, it is describing the documented process, not a test we ran.
Pages we read
Where they are usedOfficial pages and standards these guides are based on
| Type | Document | Read | Used in |
|---|---|---|---|
| HELP PAGE | What is an anti-phishing code and how to set it up. The page reported itself as updated 28 August 2026 | 19 Sep 2026; re-read 3 Oct 2026 | Anti-phishing codes; the settings guide |
| HELP PAGE | How to manage withdrawal settings for my account. Source of the whitelist, the separate Whitelist Withdrawal Limit (24, 48 or 72 hours on newly added addresses), the suspension on switching the whitelist off, and one-step withdrawal. Last updated 3 March 2025 | 19 Sep 2026; re-read 3 Oct 2026 | Withdrawal whitelists; the first hour |
| HELP PAGE | How to use the exchange authenticator app for two-factor verification | 19 Sep 2026 | Second factors; SIM swaps; the opening guide |
| SIGN-UP PAGE | The public account registration form, captured as shown to a visitor with no account | 19 Sep 2026 | Opening a Binance account |
| HELP PAGE | How to create API keys. Source of the prerequisites, the menu path, and the rule that an unrestricted HMAC key can only read. Last updated 20 March 2025 | 19 Sep 2026; re-read 3 Oct 2026 | API key permissions |
| HELP PAGE | How to view your login history. One platform's version of the record every exchange keeps | 19 Sep 2026 | Checking login history and devices |
| INDEX PAGE | The support centre's security section. Where the reporting and impersonation articles live | 19 Sep 2026 | Giving a scammer a verification code |
| SPECIFICATION | Web Authentication: an API for accessing public key credentials, Level 2. W3C. Source of the claim that a passkey signature is bound to the site's own domain | 19 Sep 2026 | Choosing a second factor |
| HELP PAGE | Securing an account with two-factor authentication. Kraken. Used as the second-vendor check that two-factor is set up separately for each action (sign-in, trading, funding) | 19 Sep 2026; re-read 3 Oct 2026 | Choosing a second factor |
| HELP PAGE | Address book and crypto withdrawal address whitelisting. Coinbase. Used to compare how two platforms frame the same control | 19 Sep 2026 | Withdrawal whitelists |
| REGULATOR | SIM swap scams: how to protect yourself. US Federal Trade Commission; and Cell phone fraud. Federal Communications Commission | 19 Sep 2026 | SIM swaps and phone numbers |
| REGULATOR | Refund and recovery scams. US Federal Trade Commission. Source of the point that this approach long predates crypto | 19 Sep 2026 | Crypto recovery services |
| HELP PAGE | Binance.US safety and security tips. Source of "will never call you" and "will never ask you for your password", for that platform only | 3 Oct 2026 | Fake support calls; scam message checker |
| LOOKUP PAGE | Binance Verify. What it can check (links, email addresses, phone numbers, Telegram and social accounts), and the statement that Binance will never request funds or tokens via private communications | 3 Oct 2026 | Checking an exchange email; fake support calls; opening a Binance account |
| GUIDE | How to reset 2FA when I can't access my Binance account. Source of the "Security verification unavailable?" route, the review of up to 48 hours and the 48-hour withdrawal hold after a reset | 3 Oct 2026 | Authenticator on a new phone; the first hour; restrictions; opening a Binance account |
| HELP PAGE | Binance.US security. Source of the 24-hour withdrawal block after a password change, for that platform | 3 Oct 2026 | Authenticator on a new phone |
| HELP PAGE | How to disable your Binance.US account. Read alongside the Binance help page on disabling an account (screenshot in the first-hour guide, updated 24 November 2025) | 3 Oct 2026 | The first hour; hacked account plan |
| HELP PAGE | Sign in with backup codes. Google. Source of the single-use behaviour of backup codes and of a new set cancelling the old one | 3 Oct 2026 | Backup codes |
Screenshots on this site are of public pages only. Nothing here shows a balance, a holding, an identity document or any part of a signed-in account, and none of it has been staged.
A note on the gaps
Some questions have no citable answer.
How long an appeal takes, how often a particular scam succeeds, what proportion of stolen funds is ever recovered: these are asked constantly and answered confidently across the web, usually by copying a figure whose origin nobody checks. Where we could not find a source worth trusting, the guide says so rather than filling the space. If you find a good primary source for any of them, tell us and it will be added to this page.
