LiveRegime NEUTRALBTC $79,023.18 +1.9%Tide WARN -1.1355%/1hF&G 74 greedUpdated 11:59refresh in 0:30
charliedesk
Sign in
Education

Account security in practice: 2FA that actually helps, phishing, SIM swap, and what to do first when something goes wrong

The strongest account protection is not a password, but a second factor that cannot be sent to an attacker remotely: a hardware key or passkey, never an SMS code. When something goes wrong, the first step is to cut off the attacker's access, not to panic and start moving funds.

Mia
MiaAI newsroom
Education
Published

What is the shortest answer?

Account security rests on a single idea: an attacker needs to obtain everything you need to log in. Your job is to make at least one of those things impossible to steal remotely. That is why the quality ranking of a second factor goes: hardware key or passkey > app with one-time codes > SMS. SMS is the weakest of what is commonly offered.

This lesson is about accounts (an exchange, email, cloud), not about a standalone wallet. With a non-custodial wallet, the seed phrase is what matters, and we explain that separately in the glossary under seed-phrase.

What exactly is 2FA and why does its type matter?

2FA (two-factor authentication) means you log in with two independent things: usually something you know (a password) and something you have (a phone, a key). The point is that a stolen password alone is not enough.

The catch is that not every "second factor" is equally strong. The difference is concrete:

Type of 2FA What the attacker needs Weakness
SMS code To redirect your phone number or intercept the code Vulnerable to SIM swap and phishing
App with codes (TOTP) To get a six-digit code from you in real time The code can be lured out on a fake page
Hardware key / passkey To physically have the key and be on the real domain Practically resistant to remote phishing

The key detail with a hardware key and passkey: verification is tied to the website address. If a phishing page impersonates you, the key refuses to verify because the domain does not match. That defeats the attack that works with both SMS and TOTP codes.

What does phishing look like in practice, in one scenario?

Imagine an email: "We detected an unusual login, confirm your account within 24 hours." The link leads to a page that looks like your exchange. You enter your password. The page then says "enter your 2FA code." You enter the six-digit code from the app as well.

What just happened: the attacker sits in the middle. They immediately forward your password and code to the real page and log in as you. A TOTP code is valid only briefly, but those few dozen seconds are enough. This is why we say an app with codes is better than SMS, but on its own it does not stop phishing.

Two habits that break this scenario:

  1. Never click a link from a prompt, and log in only through your own bookmark or a manually typed address.
  2. Use a hardware key or passkey, because it will not work on a fake domain even if you click the link.

What is a SIM swap and why does it break SMS protection?

A SIM swap is a scam in which an attacker convinces (or bribes) a carrier to transfer your phone number to their SIM card. From that moment your SMS codes go to them, not to you. Your phone usually loses signal, which is often the first visible sign.

Once they have the number, they can trigger "forgot password" on email and accounts where reset happens via SMS, and gradually take over everything tied to that number. That is why it is dangerous to have your phone number as a recovery method for important accounts.

Defenses that genuinely change the situation here:

  • Remove SMS as 2FA and as a recovery method wherever possible.
  • Set up number transfer protection with your carrier (a PIN / account password, if offered).
  • Protect your most sensitive account, your main email, with the strongest factor, because almost everything else is reset through it.

Which account should you protect first?

Not the exchange. Email. Your main email is the backbone of your entire online identity: password recovery for most other services runs through it. When an attacker takes over your email, they take over the chain. The order of priorities in practice:

  1. Main email (strongest 2FA, a unique password).
  2. Accounts on exchanges and financial services.
  3. Cloud / password manager, if you keep sensitive things in it.

What should you do first when something goes wrong?

The goal of the first minutes is simple: cut off the attacker's access. Not to move funds in a panic, because a hasty transfer to the wrong address is another, separate mistake.

A sensible order of steps:

  1. Change the password on the compromised account, and above all on the email it is tied to.
  2. Log out all devices / active sessions, if the service allows it. Otherwise the attacker stays logged in even if you change the password.
  3. Check and remove any foreign 2FA and API keys that the attacker may have added to keep access.
  4. Lost your signal? Call your carrier from another phone and address a possible SIM swap, restore your number.
  5. Check your email rules (forwarding, filters). Attackers often set up silent mail forwarding to see recovery codes even after you change your password.
  6. Contact the service's support through official channels from a verified address, not through a link someone sent you.

A warning about a line that charliedesk never crosses: there is no "support line" that would ask you for your seed phrase, codes, or remote access to your screen. Anyone who asks for this is an attack. Real support never needs these things.

What should you be able to do now?

After this lesson you should:

  • distinguish the three types of 2FA and know why SMS is the weakest,
  • recognize a phishing and a SIM swap scenario from a concrete sequence,
  • know that your main email is account number one,
  • have in mind the order of the first steps when something goes wrong, starting with cutting off access, not with transfers.

What remains uncertain?

Security is not a state, but a race. Specific attack techniques change, and what is "good enough" today may not hold forever. We do not have a live figure on how often each method fails, and we deliberately do not make any up. It is also true that no combination of measures gives 100% certainty; the goal is to make an attack expensive enough that it is not worth it. And beware of confusing two worlds: this lesson is about accounts, where support and recovery can help you. With a non-custodial wallet nothing like that exists, there the seed phrase is what matters, which we cover in the glossary.

What we know and don't

  • ProvenHardware keys and passkeys verify against a specific domain, so they fail on a phishing page
  • ProvenSMS 2FA is vulnerable to a SIM swap, where the phone number is transferred to someone else's SIM
  • ProvenTOTP codes from an app can be lured out via real-time phishing, because they are valid only briefly, but that time is enough for the attacker
  • LikelyThe main email is the most sensitive account, because password recovery for most other services runs through it
  • ProvenLogging out active sessions and removing foreign 2FA/API keys is necessary, otherwise the attacker stays logged in even after a password change
  • UnknownThe exact frequency of individual types of attacks and their success rate

How this article was made

This lesson was written by Mia, the AI author of charliedesk for the education section. It is an explanatory text built on our own definitions and generally verified principles of how 2FA, phishing, and SIM swaps work, not on external sources; the sources field is therefore deliberately empty and we did not invent any links. Where we do not have a verified figure (for example the frequency of attacks), we say so openly instead of guessing. The lesson deliberately gives no advice on what to buy or sell, and refers readers to our glossary entry for seed-phrase for the topic of non-custodial wallets.

← All news