How to configure anti-phishing code in KuCoin security settings?

Understanding Anti-Phishing Code Functionality

1. The anti-phishing code is a user-defined string added to all official KuCoin email notifications as a visual authenticity marker.

2. It does not affect API keys, withdrawal approvals, or two-factor authentication mechanisms.

3. This feature operates independently from Google Authenticator or SMS-based 2FA and serves only as an email verification layer.

4. KuCoin emails containing withdrawal confirmations, login alerts, or security changes will append the code in plain text at the bottom of the message body.

5. If the code is missing or mismatched, users are instructed to treat the email as potentially fraudulent and avoid clicking embedded links.

Navigating KuCoin Security Dashboard

1. Log into your KuCoin account using verified credentials and complete active 2FA verification before accessing settings.

2. Click the user avatar in the top-right corner and select “Security Center” from the dropdown menu.

3. Scroll down to the “Account Protection” section and locate the “Anti-Phishing Code” card.

4. The interface displays current status—“Not Set”, “Enabled”, or “Disabled”—alongside a toggle switch and edit button.

5. Only accounts with completed KYC Level 2 verification and no recent security lockouts may configure this setting.

Setting and Validating the Code

1. Click “Set” or “Edit” to open the configuration modal; input a custom alphanumeric string between 6 and 20 characters.

2. KuCoin prohibits special symbols, spaces, or Unicode characters; only ASCII letters and digits are accepted.

3. After submission, the system sends a confirmation email to the registered address containing the exact code in bold green font.

4. Users must click the verification link within that email within 15 minutes to activate the code permanently.

5. Failure to verify results in automatic deletion of the input string and requires re-entry and re-verification.

Limitations and Operational Constraints

1. The anti-phishing code cannot be changed more than once every 72 hours to prevent abuse during account compromise scenarios.

2. It remains inactive for newly registered accounts until 72 hours post-KYC completion, regardless of verification status.

3. No API endpoint exposes or modifies this value; configuration is strictly UI-bound and session-locked to the authenticated browser instance.

4. Email providers filtering HTML content may truncate or misrender the appended code, requiring plain-text mode inspection.

5. KuCoin support agents never request the anti-phishing code via chat, email, or phone under any circumstance.

Frequently Asked Questions

Q: Does enabling the anti-phishing code prevent SIM-swap attacks?No. It offers zero protection against mobile number hijacking or unauthorized SMS interception. Its scope is limited to email channel integrity.

Q: Can I use the same anti-phishing code across multiple KuCoin accounts?No. Each account enforces strict uniqueness. Attempting duplication triggers immediate rejection with error code ERR_PHISH_07.

Q: What happens if I forget my anti-phishing code?KuCoin does not store or recover it. You must disable and reconfigure a new one through the Security Center after completing identity re-verification.

Q: Why do some official KuCoin emails lack the code even after activation?This occurs when emails originate from non-core notification services—such as marketing campaigns, partnership announcements, or third-party integrations—that bypass the security email pipeline.