Protecting your email: the key to all your other accounts

For most online services, including XFasil, your email is where password reset links and confirmation codes arrive. Whoever controls your email can often take over everything else.

Steps that matter most

1. A unique, long password for your email that you do not use anywhere else.
2. Two-factor authentication on the email account itself, preferably with an authenticator app or a security key — see 2FA methods compared.
3. Up-to-date recovery options: a recovery phone number and backup email that you still control.
4. Saved recovery codes stored offline.

Check regularly

• Active sessions and devices — sign out of ones you do not recognise.
• Forwarding rules and filters — attackers sometimes add a rule that forwards or hides security emails.
• Connected apps that have access to your mailbox.
• Security alerts from your email provider.

Phishing aimed at your email

Fake "your mailbox is full" or "unusual sign-in" messages lead to pages that steal your email password. Open your email provider's site from a bookmark, not from a link in a message.

Use a separate address for important accounts

Some people keep a dedicated email address only for financial and crypto services. It is not published anywhere, is not used for newsletters or social networks, and therefore receives far fewer phishing messages.

If you lose access

Restore it with your email provider first. On XFasil, sign-in and withdrawal codes are sent only to your account's email, so without it you cannot confirm these actions; contact the Support Center if recovery is impossible. More in the Security Center.