An exchange account security checklist covers the settings you change on the exchange itself, not on your laptop. The goal is narrow: stop someone else from logging in, moving your yen, or resetting your password. For a Tokyo trader on bitFlyer, that means confirming your 2FA method, locking withdrawal addresses, checking login history, and knowing what happens when your phone goes missing. Most people only think about this after a bad night. Here is how to get ahead of it.
Pick the right second factor
Two-factor authentication is the most useful control you have, but the type you choose matters more than most guides admit. A code generated by an authenticator app or a hardware key lives on your device. An SMS code lives on your phone number, and a SIM-swap attack can move that number to an attacker's SIM without touching your handset. For an account holding yen you would miss, use an app or a hardware key.
Then generate backup codes, print them, and store them somewhere that is not your email inbox. If your phone is lost and the backup codes sit in an email account an attacker already controls, you have handed over both factors at once.
Separate login protection from withdrawal protection
Login protection stops someone reading your balance. Withdrawal protection stops them taking it. These are different settings, and a checklist that covers only the first one leaves the money exposed.
- Whitelist withdrawal addresses. bitFlyer and most Japanese exchanges let you register approved crypto addresses. New addresses often trigger a waiting period before they work, and that delay is the point.
- Require 2FA on every withdrawal. Check that the setting is on for withdrawals, not just for login.
- Set a daily withdrawal cap you could absorb as a loss. A capped account stings less than an uncapped one.
- Review your registered bank account for yen withdrawals. If those details change without your knowledge, act on it the same day.
Consider how this plays out. A trader in Nakano gets a phishing email styled as a bitFlyer security notice. He enters his password on a lookalike page, and the attacker now has his login. The attacker still cannot withdraw, because the address whitelist is on and the new address is stuck in its waiting period. Withdrawal 2FA blocks the attempt as well. The attacker leaves with nothing. That is what a working checklist feels like from the inside.
Audit devices, sessions, and reset emails
End sessions you do not recognise
Most exchanges list active sessions and recent logins. Open that page once a month. A login from a city you have never visited, or a device you do not own, means you end the session and change your password immediately.
Treat unrequested reset emails as a warning
A password-reset email you did not trigger means someone has your address and is trying. Do not click the link. Open the app or type the URL yourself, then check whether your email account has 2FA enabled, because that inbox is the real weak point.
Fortify the email account behind the exchange
Your exchange account is only as strong as the email tied to it. Anyone who owns your inbox can reset your exchange password. Turn on 2FA for that email, give it a password you use nowhere else, and consider a separate address reserved for financial accounts. The friction is small, and it pays off the moment a breach elsewhere exposes your usual address.
Frequently asked questions
Do I need a hardware security key for a bitFlyer account?
Not strictly, but it is the strongest option if you hold meaningful balances. A hardware key cannot be phished the way a typed code can, because it checks the actual site you are logging into. If a key feels like overkill, an authenticator app is a solid middle ground, provided your backup codes are stored offline.
How often should I run this checklist?
Do a full pass when you open the account, then a quick review every month or two. Settings drift: you add a device, change a phone number, register a new withdrawal address. A ten-minute monthly check catches those changes before someone else exploits them.
What should I do if I think my account is compromised?
Change your exchange password and your email password first, then end all active sessions, then contact the exchange's support team through its official channel. Do not use links from any email that prompted the worry. If yen or crypto has already moved, report it to the exchange and, in Japan, to the police. Speed matters here.
Open your exchange's security settings page now and confirm three things: 2FA is on for login and withdrawal, your address whitelist is active, and your backup codes are stored offline. Do that today, then put a ten-minute review on your calendar for next month.