OKX The anti-phishing code is a supplementary safeguard that displays the phrase chosen by the user in their security settings in OKX outgoing emails, helping identify unfamiliar messages. It can be configured in the app menu under Security → Anti-Phishing Code or checked in the security settings of the web account. However, you should not trust links in an email merely because the code is displayed. Independently verify the sender's address and the link's actual destination, and if anything seems suspicious, close the email and contact customer support through the official website, which you access by entering the address directly.
The anti-phishing code helps verify emails, but you must independently verify the sender, link, and account status.
Reviewed on 26 October 2026. This independent AKEYX security guide is based on four official OKX help articles. Menu names, features and availability can vary by app version, region and account.
What is the anti-phishing code, and where can I set it?
The anti-phishing code is not a transaction password or a one-time verification code. It is a marker consisting of a phrase predetermined by the account owner and included in official outgoing emails, allowing you to compare whether messages in your inbox have the expected form. OKX's official phishing-prevention guidance directs users to Menu → Security → Anti-Phishing Code in the app. Separate account security guidance explains that you can select and configure or check Profile → Security Settings → Advanced Security → Anti-Phishing Code on the web. If the screen names change, do not follow buttons in an email; find the setting through the security menu of the OKX app or official website that you open directly.
When setting it up for the first time, choose a phrase that others cannot easily guess, and do not reuse passwords, recovery phrases, or verification codes from other sites. Complete the identity verification required by the account, then check again on the security screen that the setting has been saved. Do not mistake the code itself for something you should send in an email reply or provide to a support agent. To review additional security measures, you can also consult the OKX2FA and authentication app setup guide and the passkey setup guide.
Separate setup from checking that it was saved
- Open the existing official app or type the official website address yourself, without using an email button. In the app, look for Menu → Security → Anti-phishing code; on the web, look under Security settings → Advanced security. Names can vary by account and version.
- Choose a separate identification phrase, not a reused password, recovery phrase or one-time code. Complete only the verification requested by the official settings process you started. The anti-phishing phrase and SMS, email or authenticator one-time codes are different information.
- Reopen the same security setting to check that it was saved. This guide does not assume an immediate test-email function. Compare the marker on later emails, but check the sender and requested action separately. If the marker is missing or different, stop interacting with that email.
Enter a verification code only in the relevant field of an official app or website process you personally started. Do not tell it to an agent or send it by email reply, phone or messenger. If the setting is missing or saving is unclear, contact official support; do not bypass regional or eligibility restrictions.
What to check when you receive an email: Do not stop at the code
Subject lines urging you to act, such as “Account restricted,” “Immediate KYC reverification required,” or “Bonus expiring,” should prompt you to pause and read carefully. The sender name or logo is not proof of the actual sender. The following steps assume that you do not click links or attachments even while opening and reading the email.
| Verification step | What should you check? · What to do if suspicious |
|---|---|
| ① Anti-phishing code | Whether the phrase I set is present and matches what I remember What to do if suspicious: If it is missing or different, stop clicking and replying |
| ② Sender address | The full email address and domain, not the display name What to do if suspicious: OKX Independently verify it using the official channel verification tool |
| ③ Link destination | The actual URL and domain before clicking, including unfamiliar subdomains What to do if suspicious: Use the official address entered directly instead of the link in the email |
| ④ Request details | Whether a password, OTP, seed phrase, transfer, or QR scan is requested What to do if suspicious: Stop sharing information and transferring funds; contact official customer support. |
| ⑤ Technical verification | If necessary, the SPF, DKIM, and DMARC results from the original EML file What to do if suspicious: Reconfirm failed results or inconsistencies through a support consultation |
The key point of the table is not to rely on just one indicator. If the code is missing or different, you can strongly suspect that it is fake, but the presence of a code does not mean that the remaining steps can be skipped. An attacker may have seen a previous email screen or code and may imitate the sender display and button wording. It is safer to develop the habit of accessing www.okx.com by entering it directly into the browser address bar without clicking the email’s “Log in” button.
Compare the actual address, destination, and independent verification results rather than the displayed sender name and button wording.
OKX How do I use the official channel verification tool?
OKX provides guidance to the official channel verification page, where you can check suspicious email addresses, phone numbers, and URL. When accessing it, do not click the “Verify” button in the email body. Instead, first open OKX directly and navigate to the customer support or channel verification page on the official site. Even if the address you entered is displayed as an official channel, that result does not guarantee that the contents or all links in the email are safe. If the address appears correct but the message requests a transfer, QR scan, or re-entry of your login details, investigate further.
In particular, email addresses may be From forged in appearance. OKX warns about spellings similar to the actual address, different domains, and links to third-party sites in the email body. Do not memorize only specific examples of sender addresses. Official sending domains may change and may vary by region and type, so prioritize the official channel verification results and customer support’s response for that day. “The domain looks similar” and “OKX confirms it” are entirely different.
If the sender address appears correct but still seems suspicious: Check the original EML file
Inspect the email service’s original-message view or a downloaded EML in a text editor; do not run a suspicious attachment. Finding the words pass or fail somewhere in a file does not by itself identify its sender. Review the authentication results shown by the mail service, and consult independently opened official support if their source or meaning is unclear. Passing authentication does not authorize a transfer, login link or disclosure of secrets.
OKX’s official help explains that if the content seems suspicious even when the sender address is displayed as official, you should check the email’s original file (.eml) and authentication results. Download the EML using your mail service’s “Download original” or “Save message” function, but do not confuse this with opening a suspicious attachment or executable file. Check the SPF, DKIM, and DMARC statuses in the authentication results of the original file. spf=fail, dkim=fail, dmarc=failIf a failure such as this is shown, do not trust the email and confirm with official support.
However, this value is an authentication clue from the email server, not a ruling that “the account action is legitimate.” Even if authentication passes, it does not mean that the transfer, link navigation, or password entry instructed in the body is safe. If you are a beginner, do not try to make a definitive judgment about email headers on your own. Instead, contact OKX customer support after accessing it directly, without clicking any links in the suspicious email. The complete original file may contain personal information, so do not post it on public forums or unfamiliar support channels.
Requests requiring particular caution in fake emails
The phishing prevention materials from OKX emphasize that official customer support will never request one-time codes from SMS, email, or an authenticator app. Requests to send your password, seed phrase, private key, or identification documents by email cannot be trusted either. Messages urging you to change your withdrawal address or send assets to a specific wallet, as well as instructions to log in after scanning a QR code, are extremely dangerous. If you want to restrict withdrawal destinations separately from account security, see the OKX withdrawal address allowlist guide. An allowlist also does not completely eliminate phishing.
For example, if you receive an email stating, “Your account will be closed if you do not verify within 30 minutes,” you do not need to determine whether the deadline is genuine first. Ignore all buttons, phone numbers, and QR codes in the email, and check for actual notifications and your account status through the official app you have saved or a website you access by entering the address directly. If the email and app contain different information or you cannot verify the details, contact official customer support. Because some features may be unavailable or identity verification may be required depending on your region, do not look for workarounds.
If you have already clicked a link or entered information
If you only opened the link, do not proceed further; close the window and check the address and account activity. If you entered your password, change it at OKX, which you access directly rather than through the suspicious page. If you used the same password on other services, change it separately there as well. If you submitted OTP or an authenticator app code, or modified your withdrawal address, notify official customer support of the situation without delay. Check connected devices and authorized apps in your security settings, and revoke unknown sessions and permissions through the proper procedures. OKX advises considering a password change or account freeze when there is unusual activity.
If your seed phrase or private key has been exposed, your wallet assets may be at risk independently of any exchange login issue. Do not send additional authentication information to anyone, and review the guidance from official support and the relevant wallet. Direct messages from paid “recovery experts” who promise to recover your assets may be a second scam. Assets you have already transferred may be difficult to recover, so preserve the evidence and use the official reporting channel appropriate to the type of damage.
| Exposure | Safe next step |
|---|---|
| Only opened a link, without entering information or installing anything | Stop further clicks, downloads and permission approvals. Do not assume that merely viewing a page is harmless. Use a trusted device to review account activity and whether anything was downloaded. |
| Entered a password or exposed a reused password | Use directly opened official security settings to review the password, linked devices and authorizations. Protect other services using that password separately. If installation or remote control was allowed, do not enter further secrets on the potentially compromised device. |
| Shared a one-time code or noticed unknown activity or withdrawals | Contact official support promptly and check the warnings for the available official response procedures, such as password changes or account freezing. Do not pay a supposed unfreezing or recovery fee. |
This is AKEYX’s practical checklist by exposure type. Account freezing or verification resets can affect access and recovery procedures, so follow the actual account warning and official support guidance. Neither the article nor the illustration guarantees asset recovery.
Practical example: Why you must verify again even when the wording is identical
First, someone can copy a screenshot of a legitimate email received in the past and attach the same phishing prevention code as an image. In this case, the code may appear correct, but the sending server of the current email and the site it links to may be different. Second, it is not difficult to change the displayed sender name to “OKX Security Team.” You should open and inspect the full address rather than relying on the one-line summary in your inbox. Third, a button may say “Official Center” while linking to a site whose destination differs by only one letter in the spelling. On mobile devices, there is still a risk of tapping incorrectly even when using a long press or link preview, so it is safer to leave the email and handle important account actions in the official app.
Even when several elements appear to overlap and make an email look legitimate, separately verify whether “the same action is required through the official channel you opened directly.” The urgency of an email or the fear of missing out on a benefit is not an authentication method. If a verification code is requested during the verification process, enter it only for a procedure that you personally initiated through the official app or website.
Settings and receipt verification checklist
- I set the phishing prevention code on the security screen accessed directly through the app or website and confirmed that it was saved.
- If the email does not contain the code or the code is different, do not click links, open attachments, or scan QR codes.
- Even when the code is displayed, separately verify the full sender address and the actual link destination.
- Verify suspicious addresses using the OKX official channel verification tool, and contact official customer support if anything seems unusual.
- Do not send passwords, one-time codes, seed phrases, or private keys in email replies or messages.
- Review the account’s 2FA, passkey, connected-device, and withdrawal-address protection settings together.
Frequently Asked Questions
Is an email automatically fake if it does not contain the phishing prevention code?
If the code you configured is not visible in an email that should contain it, suspect that it may be fake and do not click any links. Do not make assumptions about possible exceptions based on the email type or account settings; verify them through the official app’s security settings and customer support.
If the code is correct, can I click the login button in the email?
No. The code is a supplementary clue. Verify the sender address and the actual link destination separately, and log in through the official site opened by entering the address directly in the address bar or through the existing official app.
Does the anti-phishing code replace OTP·passkeys?
No. The anti-phishing code helps identify emails, while OTP and passkeys are separate methods that protect account authentication for logins and security changes. They do not replace one another.
The official channel verification says the address is correct, but the content seems suspicious.
The sender information may have been spoofed, or the message's link or request may be malicious. Reverify the email itself using the EML verification instructions in OKX and official customer support. Do not approve a transfer or provide information based on just one verification result.
I received a suspicious email. Is it okay to send it to AKEYX?
AKEYX is not the official customer support of OKX. Do not send sensitive email originals, verification codes, passwords, or private keys to AKEYX either; instead, check the customer support procedure on the OKX official website.
Is a code required during setup different from an agent asking me to share it?
Yes. Entering a code in the official settings process you started is different from sharing it with an agent by email, phone or messenger. An anti-phishing phrase also does not replace a login OTP. Stop if you did not start the process or cannot identify the screen, and verify through official support.
Official sources and the scope of this article
- OKX: How can you protect yourself from a phishing attack? — App settings paths, email verification, and scam types. Official document updated 2026-08-26.
- OKX: How do I secure my exchange account? — Web security settings, anti-phishing codes, and responding to unusual activity. Official document updated 2026-08-26.
- OKX: How to prevent phishing emails? — Checking the sender, links, and sensitive information. Official document updated 2026-08-26.
- OKX: How do I check if an email is officially from OKX via EML file? — EML and authentication results. Official document updated 2026-09-01.
The settings paths and technical explanations above are official guidance from OKX, while the process and examples for checking multiple clues together are an educational compilation by AKEYX. Anti-phishing codes do not completely prevent scams or guarantee recovery of losses. This article is not professional investment, legal, or security advice. Service availability may vary by region and account.
When creating a new account or changing security settings, make your decision based on the official app opened directly and the address entered directly, rather than shortcuts in emails. Even when sign-up or usage benefits are displayed, you should check the actual eligibility conditions on the sign-up screen and in My Rewards for your account, as they may vary by account, region, VIP status, and campaign. Confirming a safe access path takes priority over any discount or bonus.
The four linked official guides were rechecked on 26 October 2026 for app and web security paths, phishing-email checks and EML explanations. Their publication or update dates are not AKEYX’s review date. No personal-account settings or asset-recovery process was tested. The situation table and checking sequence are AKEYX’s educational synthesis of those sources.