Skip to main content
Category: Hacks → Account Takeover (CEX, Email, SIM Swap)HacksAccount Takeover2FA BypassReading time: 10 minutes
Risk level: High
Target audience: Exchange users, support chat users

​
Meet Blessing

Blessing has strong security on her Binance account:
  • Long, unique password.
  • 2FA enabled (TOTP via Google Authenticator).
  • Email verified.
One day, she gets a message on Telegram from someone claiming to be “Binance Support”:
“Hi, we noticed unusual activity on your account. For your security, we need to verify your identity. Can you confirm your current password?”
Blessing is suspicious (legitimate support never asks for passwords) and ignores the message. A few days later, she gets a similar message from what appears to be an official Binance support account (with a Binance-looking profile picture and name like “BinanceSupport_Official”). This time, the message says:
“Your account is locked due to multiple failed login attempts. Click here to unlock.”
Blessing clicks and is taken to a login page. She enters her credentials out of concern. The page then asks for her 2FA code (saying it’s needed to “unlock the account”). She enters the 2FA code from her authenticator app.

​
What Happened

​
Step 1: The Phishing and 2FA Code Capture

The attacker has now captured:
  • Blessing’s password
  • Her 2FA code (which is valid for 30 seconds)

​
Step 2: The Rapid Takeover

The attacker immediately:
  1. Goes to Binance’s login page (the real one).
  2. Enters Blessing’s email and password.
  3. When prompted for 2FA, enters the code she provided (it’s still within the 30-second window).
  4. Logs in successfully.
  5. Disables 2FA.
  6. Withdraws all funds.
By the time Blessing checks her account, it’s empty.

​
Where the Scammer Won

  • Phishing site: The fake login page looked legitimate and captured credentials.
  • 2FA code timing: The attacker used the 2FA code within its 30-second validity window.
  • Social engineering: The “account locked” message created urgency and bypassed skepticism.
  • Fake support account: The impersonated support account looked official.

​
Red Flags Blessing Should Have Heeded

  • Unsolicited messages asking for credentials or 2FA codes.
  • Legitimate support never asks for passwords or 2FA codes.
  • “Account locked” urgency messages are common phishing tactics.
  • Telegram DMs from “support” are almost always scams.

​
How 2FA Bypass via Social Engineering Works

What happens: Attacker creates fake login page that looks like legitimate exchange site.
What happens: Attacker sends message claiming account is locked or needs verification, creating urgency.
What happens: Victim enters password and 2FA code on fake site, which attacker captures.
What happens: Attacker immediately uses captured credentials and 2FA code (within 30-second window) to log into real site.
What happens: Attacker disables 2FA and withdraws all funds.

​
Prevention

Never enter 2FA codes on websites (except the official login page).
Block unsolicited support messages. Report them immediately.
Contact support independently (via official website) if you need help.
Assume any DM offering help is a scam.
Verify URLs carefully: Always check the domain before entering credentials.

​
If You Already Entered Credentials on a Fake Site

1

Change Password Immediately

Change your exchange password immediately from the official site.
2

Regenerate 2FA

Disable and re-enable 2FA to generate new codes.
3

Check Account Activity

Review all recent transactions and withdrawals for unauthorized activity.
4

Report the Phishing Site

Report the fake site to the exchange and browser security teams.
5

Report Unauthorized Access

If funds were stolen, report to exchange support and law enforcement.

Social Support Impersonation

How fake support accounts target users

Hacks Category

Explore all types of account takeover attacks

Check Your Wallet

Verify if addresses are reported as malicious

​
References

  1. 2FA security best practices
  2. Phishing detection and prevention
  3. Exchange support verification guidelines