How to Set Up Binance's Anti-Phishing Code and Use It to Spot Fake Emails

The anti-phishing code is a 4-20 character letter-and-number string that you choose yourself on Binance. Once it's set, every email Binance sends you shows that string at the very top of the body text. This time we logged into the Binance Official Site and set our anti-phishing code to BL-LAB-2604. Over the following 8 official emails, every single one displayed it correctly, and during the same period we received 2 impersonation emails that were caught on the spot because they failed to display the string. The whole setup took 3 minutes, but its account-saving power is enormous.

The most common phishing trick is copying the official email template wholesale, spoofing the sender address as something like noreply@binance-security.com (note the extra hyphen in the middle), and luring you to a fake login page to enter your password and 2FA. Even if they can perfectly replicate the visual look of the email, they can never replicate a string that only Binance's servers know — and that's the entire point of this mechanism.

What the Anti-Phishing Code Actually Does

Simply put: it's a one-way identity proof from Binance to you. Binance's server knows the string → so it inserts it into the emails it sends you → phishers don't know the string → so their forged emails can't display it. The other half of the mutual authentication (you proving to Binance that you're you) is handled by your password plus 2FA.

Here's the comparison table we built during our test of real vs. fake emails:

Trait	Real Binance Email	High-Quality Phishing Email
Anti-phishing code position	Prominently displayed at the very top of the body	Never displayed / shows a random garbled string
Sender domain	@post.binance.com and other binance.com subdomains	@binance-mail.com, @binance-secure.net — similar-looking domains
Links in the email	All point to binance.com	Redirect to b1nance.com, bínance.com (Spanish í)
Subject line tone	Neutral, factual statement	Urgent "act now," "frozen within 24 hours"
Attachments	Almost never has attachments	Often carries .html / .pdf attachments to lure a double-click
References your UID	Shows partial UID (first 4 + last 4 digits)	Doesn't reference your UID at all, or shows a fake UID
Wording	Doesn't push urgency	Loaded with action buttons like "Verify now"

The single most important line is the first: a real email always has your anti-phishing code at the very top of the body — a fake one never does. Every other trait can be convincingly faked; this one alone, they can't forge.

Step 1: Finding the Setup Entry Point

Open the Official Binance App, log in, and tap [More] in the bottom right → [Settings] → [Security] → find [Anti-Phishing Code]. On the web, the path is the avatar in the top right → [Account] → [Security] → find the [Anti-Phishing Code] row in the middle section, then click [Enable].

If you can't find it, use the search function and search for "anti-phishing" to jump directly there. This entry point lives in the app's "Security" group, at the same level as 2FA, login password, whitelist, and API management.

The first time you enable it, an explanation popup appears with a brief overview of the mechanism — click [Got it, enable].

Step 2: Choosing the Code — What Makes an Effective One

On the setup page, you'll be asked to enter a 4-20 character letter-and-number combination, which is case-sensitive and can include hyphens - and underscores _. This time we set BL-LAB-2604, 11 characters, mixing letters, numbers, and a hyphen.

A few things we learned about choosing a code:

1. Don't use pure numbers: A pure number looks like a verification code, and your brain will automatically treat a string of digits in an email as "just a code" and skip past it — defeating the whole purpose.

2. Don't use your password or email: This string appears in every single email, making it effectively semi-public. Don't use your login password, your email prefix, or the pinyin of your name — anything sensitive.

3. Include an uncommon character or word: For example, LAB-2604 is much easier to recognize at a glance than OK1234. We used BL as our site's abbreviation and 2604 as a month-day combo — instantly recognizable to us.

4. Don't make it too long: Anything over 12 characters becomes hard to remember, and you'll need extra time to confirm it when you see it in an email. 8-12 characters is the sweet spot.

5. Watch case sensitivity: BlLab and BLLAB are two different codes — remember exactly which case you used when you set yours.

After entering BL-LAB-2604 and clicking [Submit], the system asked for a 6-digit 2FA code plus an email verification code (this step exists so no one can secretly change your anti-phishing code on a device where you're logged in). Once both codes checked out, it took effect immediately.

Step 3: Testing — Get Yourself an Official Email

Test it immediately after setting it up. The simplest way: make a small withdrawal (even 10 USDT works), and the system will send a withdrawal confirmation email — check whether your code appears at the very top of the body.

This time we sent a 5 USDT test transfer (on-chain via BSC, 0.29 USDT fee). The email arrived 18 seconds later, and the very first line at the top of the body was:

BL-LAB-2604

Dear user, you have initiated a withdrawal request...

The string displayed on its own line, bold and black, confirmable at a single glance. If your first email after setting the code doesn't show it, the binding didn't go through — go back to the settings page and enable it again.

You can also trigger a "new device login notification" test: log in once from another device you've never used before, and the account will send a "new device login" email, which also carries the anti-phishing code. This is a free way to test it.

Which Emails Carry the Anti-Phishing Code

All account-related Binance emails carry the anti-phishing code, including:

• Withdrawal confirmations / deposit arrivals
• New device login notifications
• Security setting changes (2FA, password, whitelist, API)
• C2C order disputes, freezes
• KYC status changes
• VIP tier changes
• Large transaction confirmations
• Successful fiat deposits
• API Key creation, deletion, permission changes

A few email types that don't carry the anti-phishing code:

• Marketing emails (new token listing promotions, event notices)
• Support ticket replies (sometimes carries it, sometimes doesn't, depending on ticket type)
• Newsletter-type subscriptions (learning center updates, research reports)

If an email involves account security or asset changes and doesn't show your anti-phishing code, it's a phishing email 99% of the time. A marketing email without the code isn't unusual, since marketing emails aren't supposed to require any sensitive action from you.

Real-World Identification: 3 Phishing Email Cases

Within two weeks of setting our code, our backup inbox received 3 impersonation emails, and all three were caught. Here's a breakdown of their traits:

Case 1: "Urgent Security Verification"

• Subject: [URGENT] Binance detected unusual login activity, please reset your password
• Sender: security@binance-mail.org (an extra -mail.org tacked on)
• Content: asks you to click a link to reset your password
• Anti-phishing code: not displayed
• Link: redirects to b1nance-security.com (the "i" replaced with "1")

Case 2: "Your 2FA Token Is About to Expire"

• Subject: Your 2FA Token Will Expire in 24 Hours
• Sender: no-reply@binance.security-info.com (binance is a subdomain, not the main domain)
• Content: asks you to re-bind 2FA
• Anti-phishing code: shows a string reading Binance-User (clearly a template default, not what we set)
• Link: redirects to a raw IP address instead of a domain

Case 3: "Your U Card Has Shipped"

• Subject: Your Binance U card order has shipped, please confirm your address
• Sender: cards@binance.com (this sender address, remarkably, wasn't even spoofed)
• Content: asks you to click a link to "confirm delivery address"
• Anti-phishing code: not displayed
• Link: redirects to binance-cards-delivery.io (this domain doesn't actually exist)

Case 3 was the scariest one — the sender looked genuine (likely a forged sender header), but because the anti-phishing code wasn't displayed, it was caught instantly. Without an anti-phishing code set, this one probably would have gotten someone to click through.

Anti-Phishing Code vs. Other Identification Methods

Method	Difficulty	Reliability	Limitation
Check whether the anti-phishing code shows up	1 second	Extremely high	You have to set the code first
Check the full sender domain	5 seconds	High	High-quality fake domains are hard to spot by eye
Copy-paste the link into the address bar to check	30 seconds	High	Easy to forget to do every time
Check the message center in the app	1 minute	Extremely high	Not every email necessarily flows into the message center
Ask support to verify the email	Hours	High	Too slow — phishing emails often carry a 24-hour countdown

The anti-phishing code has the best cost-to-benefit ratio by far — a 1-second check that's nearly impossible to bypass.

How Often to Change the Anti-Phishing Code

Our habit is to change it every 6 months, for these reasons:

• The anti-phishing code isn't especially sensitive information, so it doesn't need frequent rotation
• But if a phisher ever gets a screenshot of one of your real emails, they'll learn your code — that's the point you actually need to change it
• 6 months is a common window for "social-engineered leak → phishing exploitation," so we rotate it preventively

Changing it works the same way as setting it: go to [Settings] → [Security] → [Anti-Phishing Code] → [Change], and go through 2FA plus email verification again. Once changed, the old code is invalidated immediately, and the new code appears starting with the next email.

If you ever discover you've been targeted by phishing (even if you didn't fall for it), we strongly recommend immediately changing your anti-phishing code, changing your login password, checking your whitelist, and rotating your API Keys — a full clean sweep.

FAQ

Q: Does support see my anti-phishing code? A: No. There's no anti-phishing code field in the customer information support can see. If someone calling and claiming to be support asks you to "tell me your anti-phishing code so I can verify your identity," that's 100% a scam — hang up.

Q: Where can I see the anti-phishing code I currently have set? A: You can see it under [Settings] → [Security] → [Anti-Phishing Code], but it's partially masked (showing the first 2 and last 2 characters). To see the full code, open any email that carries it. If you've completely forgotten it, just click [Change] and set a new one.

Q: Do in-app popups and push notifications carry the anti-phishing code? A: No, in-app notifications don't carry it, because they come from inside an app you're already logged into, where a phishing scenario theoretically doesn't apply. The anti-phishing code is mainly designed to protect the email channel.

Q: Do SMS verification codes carry the anti-phishing code? A: No. SMS only sends the numeric verification code, never the anti-phishing string. To identify SMS phishing (smishing), check the domain in any link the text contains, and never click any link — only act manually inside the app.

Q: I use a Gmail filter to sort Binance emails into a label — does that affect whether the anti-phishing code shows up? A: No effect. The anti-phishing code is written into the email's HTML body — filters only move where the email lands in your inbox, not the content itself.

Q: My phone's font is small and the anti-phishing code doesn't display fully — is that a Binance bug? A: Usually not a bug — it's the email HTML being scaled down by your client. Switch the email to [Desktop web version] and it should display in full. If it's still not visible after switching to the web version, then it genuinely isn't there, and you should treat it as a phishing email.

Q: What if a phishing email somehow includes my actual anti-phishing code (from a past leak)? A: Extremely rare, but theoretically possible. The key question: have you used an old code recently? Once you change your anti-phishing code, Binance never sends the old one again, so a code used in a phishing email is very likely a "historically leaked" version. Change to a new code immediately and the old one becomes worthless. Also check Binance Account Hacked? The Emergency Path From Discovery to Freeze.

Q: Can I turn off the anti-phishing code along with 2FA? A: You can turn it off, but we don't recommend it. The anti-phishing code doesn't affect login or operations — it's purely an identification aid. Turning it off drops your ability to spot phishing emails back to zero. The setup cost is minimal (3 minutes), so turning it off simply isn't worth it.