A guide to securing online accounts

Editor’s note: This article was originally published in July 2019 and updated in August 2026.

Entering the bitcoin space can be exciting. It also comes with responsibilities, including securing the accounts, devices, and wallets you use to access it.

Online security matters for everyone, but it deserves extra attention when an account can be used to move money or digital assets. The steps below can help reduce the risk of unauthorized access.

Our goal in this series is to look at the many aspects of online security, such as having strong and unique passwords, enabling 2-factor authentication, protecting your email account, and secondary online phone numbers.

Why care about online security

A journalist for WIRED learned the hard way.

In the space of an hour, a takeover of his email account led to his social media accounts, digital devices, email, and other online accounts being totally hijacked and controlled by attackers.

Nothing was spared. His laptop was remotely wiped, erasing the first year and a half of pictures of his newborn daughter. In this case, the hackers didn't even want bitcoin—just his short and unique Twitter handle.

The scary part: The attack didn’t rely on brute force. The attackers used social engineering to trick support staff.

The Wired journalist noted: Had two-factor authentication been implemented, it's possible that "none of this would have happened." Two-factor authentication might have reduced the risk, but no single security measure is infallible.

Two-factor authentication, or 2FA, adds another verification step when you sign in. It can involve something you know, such as a password; something you have, such as a phone or security key; or something you are, such as a fingerprint or face scan.

Note: While two-factor authentication is effective, like most risks, is not infallible and users should remain vigilant against potential security threats.

Two-factor authentication and crypto

In the world of crypto, security is crucial.

Crypto wallets are often targets for cybercriminals due to the value and somewhat anonymous nature of digital currencies. Introducing a second layer of verification in addition to a password aims to improve security and make it that much more difficult for unauthorized individuals to gain access to your accounts.

Bitcoin is powerful, but comes with responsibility

Bitcoin is considered by many to be the future of finance. Bitcoin lets you transfer value over a global network. Your level of control depends on how you hold it: a hosted account and a self-custody wallet have different responsibilities.

But with great features come great security concerns. Bitcoin’s security depends on the network, the wallet, and how access is managed. Good security practices matter whether you use a hosted account or self-custody.

If you self-custody, protect your private keys

In a self-custody wallet, private keys or a recovery phrase control access to the funds. Anyone who obtains them may be able to move the bitcoin.

Keep recovery phrases and private keys private and offline. Don’t photograph them, email them, or share them with anyone. Make sure you understand how you would recover access before transferring a significant amount.

Review account security as your needs change

As the value or importance of an account changes, review its security settings. Use strong sign-in protection, secure your email account, and make sure you know how to recover access.

Confirm transactions before sending

Bitcoin transactions are generally irreversible once confirmed. Check the recipient address, network, and amount carefully before sending.

If you use a self-custody wallet, consider starting with a small test transaction before sending a larger amount.

Unlike many money transfer protocols (wire transfers, cheques, credit cards), once a transaction is on the blockchain with enough confirmations it cannot be reserved.

This finality is one of Bitcoin’s strengths. It makes transactions cheaper and more reliable. But it also places full responsibility on the user.

Because of these properties, securing your online accounts and wallets isn’t optional—it’s essential. A single security lapse can lead to account or fund loss, so use several layers of protection.

For the latest Shakepay-specific recommendations, review Account security at Shakepay. Shakepay currently supports 2FA, device lock, email confirmations for crypto withdrawals, and passkeys. SMS-based 2FA is enabled by default, but Shakepay recommends switching to an authenticator app. 

Want to learn more? Check out this exploration of passwords and password managers