You must have received this kind of email before — the title says "Unusual Login Alert", the body claims someone from an overseas location tried to access your account, with a big blue button at the bottom: "Click here to verify your identity and block the login".
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
We know you might want to click that button. This guide covers one critical rule: When you receive such alerts, no matter how urgent they seem, here is the safe way to verify the situation.
First, understand this core logic: No legitimate platform will ask you to complete security actions via email links
The system design logic of all formal platforms is: Alerts are just notifications, all security operations must be done inside the official platform. They can send you an email notifying that "someone tried to log in from XX IP", but they will never put a button in the email asking you to "click to confirm you are the account owner". All operations related to account security must be completed on the official platform itself.
The reason is simple: Emails are transmitted in plain text, links can be hijacked, and phishing fake pages can look almost identical to the official site. No legitimate platform will ever place security operation entrances in emails.
You never need to prove "it's me" through a link in an email. All you need to do is: Log into the official platform yourself, and check the real situation in person.
Step 1: Close the email, open your official app manually
Goal: Cut off all risky paths from email links.
How to do it: Do not click any buttons, links or QR codes in the alert email. Close your email app completely. Open the official exchange mobile app (make sure it is the official version, not a random web page). Or manually type the official website address into your browser to access it.
Completion check: You successfully logged into the app or official website, and the login process runs normally (no wrong password prompt, no account lockout notification).
Common risky mistake: Many people think "I just click to take a quick look, I can exit if it's not real" — this thought is extremely dangerous. Phishing pages can collect your device fingerprint, IP address, and even steal other information on your phone the moment you click to open it. Do not click anything in the email, even for a quick glance.
Step 2: Find "Device Management" or "Login History" in the app
Goal: Check the actual login devices and login locations recorded by the official platform.
Operation guide for different platforms:
Binance users: Tap "Profile" at the bottom right of the app → "Security" → "Device Management". It will show the full list of all devices that have logged into your account, including device name, type, login time and IP location.
OKX users: Tap "Profile" at the bottom right of the app → "Security Center" → "Login Devices". You will get the same full device list.
KuCoin users: Tap "Personal Center" at the bottom right of the app → "Security Settings" → "Device Management".
Completion check: You can see the complete device list. Check for any unfamiliar devices, unknown login times, or entries that do not match your current device model.
Step 3: Cross check with the email content to verify if the alert is real
Goal: Confirm whether the "unusual login" mentioned in the email is real.
How to do it: Compare the "login time", "IP location", and "device type" mentioned in the email one by one with the records in the official app device list.
Scenario A: None of the information in the email matches the records in your app, for example the email says "login from a Shanghai IP" but there is no such record in your app at all. This email is a fake phishing scam, delete it directly.
Scenario B: The information in the email exactly matches one of the records in your app, for example there is indeed a login record from a strange city in your device list. Your account does have security risks. Do not panic, follow the next steps.
Completion check: You can clearly confirm whether the email is a real alert or a scam.
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
Step 4 (If real unusual login occurs): Force log out all devices, change password, and unbind unknown API keys
Goal: Kick all unauthorized intruders out of your account completely.
Follow this step-by-step order:
Force log out all devices: On the "Device Management" page, click "Log out all devices" or "Sign out all active sessions". This will immediately make all previously logged in devices invalid.
Change your login password: Set a new strong password completely different from your old one (mix uppercase and lowercase letters, numbers and symbols, at least 12 characters long).
Check and revoke unknown API keys: Go to the "API Management" page, check if there are any API keys you do not recognize. Revoke them immediately if you find any.
Completion check: After finishing these 3 steps, log in again with your new password to confirm normal access. Go back to Device Management to confirm only your current device is shown in the list.
High Risk Reminder: There is a more hidden threat than unusual login — if you have enabled "withdrawal whitelist" or "anti-phishing code" for your account, attackers may not directly withdraw your assets, but create unauthorized API keys in your account, to secretly trade or transfer assets in the background via API. So after changing your password, you must check the API Management page, this is a step many advanced users miss.
Final verification: You have confirmed the real login records through the in-app device list, and completed all 3 actions: log out all devices, change password, and check API keys. Keep an eye on your account's login records and transaction records for the next 24 hours.
Recommended follow-up action: Take a screenshot of the "Login Device Management" page in your app security center and save it. Next time you receive a similar "unusual login" email, you can compare it with this saved screenshot directly, which is far safer than clicking around in the email.
