Every account is verified by email at signup. You can switch on Google Authenticator 2FA, set a personal anti-phishing code that appears in every official email we send, get login alerts for new devices, restrict payouts to a withdrawal address whitelist, and review or revoke every active session under
Settings → Sessions & Devices. Passwords are stored as bcrypt hashes only.