What "account security" covers
An Exness account has several layers that someone could attack:
- The Personal Area login. This is the email and password you use to sign in to the Personal Area, the web dashboard where you manage accounts, deposits and withdrawals. See Personal Area.
- Trading account passwords. Each MT4 or MT5 trading account has its own login and password for the trading platform.
- Your email inbox and phone. Codes and password-reset links reach you there. If someone controls your email or SIM, they can often reset other passwords.
- Your payment accounts. These are the bank, wallet or card you use for deposits and withdrawals.
A weak point in any of these layers can expose the others. Securing an Exness account means securing all of them.
Habits that keep your account safe
- Type the broker's address yourself or use a bookmark; do not sign in from links in messages.
- Turn on two-factor authentication (2FA).
- Never share codes from SMS or the authenticator app: real support never asks for them.
- Use a unique password for your trading account and for your email.
- Check the address bar before you enter a password.
- Pay only to payment details shown inside your own personal area.
Exness 2FA and security codes
2FA (a second check besides your password) means that a login or sensitive action needs both your password and a code sent to you or generated on your device.
Exness lists OTP among its payment security measures, along with segregated accounts, PCI DSS and 3D Secure (segregated accounts, OTP, PCI DSS, 3D Secure). OTP means a one-time password, a short code that works for a single action. Exness states that it is PCI DSS certified. PCI DSS is the card industry's data security standard. 3D Secure is the extra bank confirmation step for card payments.
Our sources do not list which security types Exness offers for logging in, such as email codes, SMS codes or an authenticator app, or how to switch between them. Check the security settings in your Personal Area or on the official Exness site. Use the strongest option shown to you. In general:
| Method | Main weakness |
|---|---|
| Email code | Only as safe as your email account |
| SMS code | Exposed to SIM swap fraud and lost phones |
| Authenticator app | Codes are lost with the phone unless you keep backup codes |
Whichever method you use, never pass a code to another person. A code is only useful to a scammer while it is still valid, which is why fraudsters push you to act quickly.
Strong passwords
A strong password is long, unique and not guessable from your life.
- Use a long passphrase. Several unrelated words are hard to guess and still easy to type. Avoid names, birthdays, phone numbers, CNIC digits and cricket teams.
- Use a different password for each account. Your email, Personal Area and trading accounts should never share a password. When a site leaks its passwords, attackers try those passwords on other services.
- Protect your email first. Give your email account a strong password and turn on its own second-factor login. Most account takeovers start with the inbox.
- Use a password manager if you have many accounts. It generates and stores unique passwords for you.
- Do not save passwords on shared devices. On shared or office computers, log out after each session and do not let the browser remember the password.
To change your Personal Area or trading passwords, see Account settings.
Phishing and fake support on Telegram and WhatsApp
Phishing means a fake message or website that imitates a real company in order to steal your login, codes or money. In Pakistan, scams often arrive through WhatsApp groups, Telegram channels, Facebook pages and direct messages.
The SECP has issued public warnings about illegal investment and trading platforms, which it says are often promoted through WhatsApp and social media. Those press releases name platforms such as Quotex and look-alikes of real brokers (SECP warnings by press release naming platforms (Quotex 09.04.2025; IBKR look-alikes, IGIL Securities, BMA Capital No.108 etc. 22.05.2025; Hillhouse Capital, S-169 Wharton 13.01.2026), none of which names Exness).
Common warning signs:
- An "account manager" or "support agent" contacts you first on Telegram or WhatsApp.
- Someone asks for your password, OTP or verification code, or asks for screen sharing or remote access to your phone or computer.
- You are asked to send money to a personal bank account, a JazzCash or Easypaisa number, or a crypto wallet "to unlock a withdrawal" or "pay tax first".
- Someone offers to "manage" your account, promises fixed profits or sells signals.
- A login link leads to an address that looks like the official site but is spelled slightly differently.
- Messages push you to act now, or say your account will be blocked.
Treat anyone who asks for your password or a security code as a scammer, whoever they claim to be.
Safe habits:
- Type the official site address yourself or use a saved bookmark. Do not follow login links from messages.
- Install apps only from the Google Play Store, the Apple App Store or the official Exness site. See Exness Trade app and Login.
- Contact support only through the channels listed on the official site or inside the Personal Area. See Customer support.
What to keep to yourself
Whoever contacts you, do not share:
- Your Personal Area password or trading account passwords
- Any OTP, SMS or email code, or authenticator code
- Remote access to your device
- Card PINs, CVV codes or bank app logins
- Photos of your CNIC or other documents, sent anywhere other than the official verification process in the Personal Area (see Verification)
Never send deposits to a person, a personal account or a wallet address that someone gave you in a chat. The payment methods available to you are shown only in the Personal Area; depends on registered region.
How withdrawals limit the damage
Exness states that funds can be withdrawn to own personal payment accounts only. This means a withdrawal should go to a payment account in your own name, not to a stranger's account. Even so, an intruder can still do damage. They can open or close trades and change your settings. If your email or phone is also compromised, they may try to add payment details.
To see which Exness entity your account is registered with, look at the information shown in the Personal Area footer. Knowing the entity helps when you contact support or check which terms apply to you. See Entities and regulators.
Ready to try it on a real or demo account?
Partner link · trading carries a high risk of loss
What to do if your account is compromised
Act in this order:
- Secure your email. Change the email password from a clean device, log out all other sessions and turn on the email provider's second-factor login.
- Secure your phone number. If your SIM stopped working without explanation, contact your mobile operator at once. This can be a sign of SIM swap fraud.
- Change your Personal Area password and trading account passwords. Use new, unique passwords. See Account settings.
- Review your security settings. In the Personal Area, check the login and security options and use the strongest one available.
- Contact Exness support through official channels. Say what happened and when, and ask them to review recent logins, trades and transaction requests. See Customer support.
- Check your history. Look through your trading history, deposits and withdrawals for anything you did not do.
- Inform your bank or wallet provider if card or account details may have been exposed.
- Scan your devices for malware. Remove remote-access apps you did not install yourself.
Do not pay anyone who offers to "recover" your account or funds for a fee. Recovery offers are a common second-round scam.
Security and risk are separate issues
A secure login protects your account from other people. It does not protect you from market losses. Leveraged CFD and forex trading can lose money fast, sometimes faster than you can react. Read Risk management and Margin call and stop out.
There is also a legal side for Pakistani residents. On offshore platforms: per the SECP, offshore platforms have no Pakistani licence or oversight and offer no legal protection or recourse. On buying these products: per the SBP, the purchase of offshore forex/margin/CFD products by Pakistani residents violates section 4(1) of FERA 1947. Read Is Exness legal and Is Exness safe before you deposit.
Frequent questions
Does Exness have 2FA?
Exness lists OTP among its security measures. Our sources do not specify which login security types are offered. Check the security settings in your Personal Area.
Can I use an authenticator app instead of SMS?
Check the current options in your Personal Area or on the official Exness site. Our sources do not confirm this.
Someone from "Exness support" messaged me on WhatsApp. Is it real?
Do not reply with any details. Contact support only through the channels shown on the official site or in the Personal Area, and ask there.
Can a scammer withdraw my money to their account?
Exness states that withdrawals go to own personal payment accounts only. An intruder can still trade on your account or change your settings, so secure it right away.
Is my card data protected?
Exness states that it is PCI DSS certified and uses 3D Secure for major cards. You still need to keep your card PIN and CVV private.
Where do I download the app safely?
Download it only from the Google Play Store, the Apple App Store or the official Exness site. See Platforms and apps.