Spotting fake Bybit support messages with the anti-phishing code and authenticity check
Impersonation is the most common way crypto accounts are emptied, and it rarely involves clever hacking. Someone poses as support, a listing manager or a friendly community moderator, and persuades you to type a code, approve a login or move funds. Bybit gives you two simple tools against this: an anti-phishing code that appears in genuine emails, and an authenticity check where you can test a link, email address or social handle. Setting both up takes a few minutes.
Set the anti-phishing code
In the Bybit app, open your profile, go to Account and Security and find the anti-phishing code option. Choose a word or phrase only you would recognise and confirm with your authenticator. From then on, genuine Bybit emails include that code. An email that claims to be from Bybit without it, or with the wrong one, should be deleted unread. Do not choose something that appears on your social profiles.
Use the authenticity check before you reply
Bybit provides an authenticity check page where you paste a URL, email address, phone number or social account and the tool tells you whether it belongs to Bybit. Open it from the help center while logged in, rather than from a link in the message you are checking. If the tool says the sender is not verified, stop the conversation. Genuine staff do not mind you checking.
Know the scripts scammers use
Typical messages say your account will be frozen unless you verify now, that a withdrawal needs your approval code, or that you have won an airdrop that requires connecting a wallet. Other versions arrive as search ads for fake help pages. Real Bybit support never asks for your password, two-factor codes or seed phrase, and never asks you to transfer funds to a safe account.
If you already clicked or typed something
Change your password immediately from inside the app, reset your authenticator if you shared a code, and review the device list in Account and Security, removing anything unfamiliar. Check that your withdrawal whitelist has no new addresses. Then report the message through the in-app chat. Acting within minutes often makes the difference.
Risk boundary: Bybit Italy Guide
Digital assets are volatile and derivatives can amplify losses. This website has no login, wallet connection, deposit form or customer-support chat. A referral link only records attribution; it does not guarantee access, pricing, rewards, approval or investment results. Availability can differ by residence, legal entity and product, so no regional access is assumed from language or branding alone.
Scenario checkpoint
- Set a private anti-phishing code and delete any Bybit email that lacks it
- Paste unknown links or handles into the authenticity check opened from the help center
- Never share passwords, authenticator codes or a seed phrase with anyone claiming to be support