Running a DCA plan on several exchanges? Lock the logins down first
Dollar-cost averaging is meant to be boring. You set up a recurring buy, check in now and then, and let time do the work. The catch is that an account you rarely open is also an account you rarely watch. If it is protected only by a password and an SMS code, it becomes an easy target, and you may not notice a problem for weeks. Before the next recurring purchase runs, spend fifteen minutes making each login stronger.
Take stock of every account in the plan
List each exchange where a recurring buy is active, together with the email used, the current second factor and the last date you logged in. Many people discover an old account they forgot existed, still with a balance. For each one, open the security page and note whether it supports passkeys, an authenticator app or only SMS. That list is your to-do list for the rest of this guide.
Add a passkey where it is offered
Binance, OKX, Bybit and Bitget all offer passkeys in their security settings, although the exact menu name differs. A passkey uses your phone's or computer's screen lock instead of a password and cannot be typed into a fake website, which makes it strong against phishing. Create one on your main device, then add a second on another device you own, so losing one phone does not lock you out of an account you only open once a month.
Use an authenticator instead of SMS
Where you still need a code, switch from SMS to an authenticator app. SIM swap fraud lets someone take over your phone number, and with it your SMS codes, without touching your phone. When you set up the authenticator, store the backup key or recovery codes offline. Then, if the exchange allows it, remove SMS as a sign-in factor. Test the new setup by signing out and back in before you close the security page.
Make a quarterly check part of the plan
Add a short security review to the calendar alongside your DCA schedule, perhaps every three months. Sign in to each account, look at the device list and active sessions, confirm the passkeys still have the right names and check that withdrawal whitelisting is still on. It takes ten minutes, and it means the accounts holding your slow, steady savings are watched as closely as an active trading account.
Risk boundary: BTC Pulse
Digital assets are volatile and derivatives can amplify losses. This website has no login, wallet connection, deposit form or customer-support chat. A referral link only records attribution; it does not guarantee access, pricing, rewards, approval or investment results. Availability can differ by residence, legal entity and product, so no regional access is assumed from language or branding alone.
Scenario checkpoint
- List every exchange account in your DCA plan with its current second factor.
- Create a passkey on your main device and a backup passkey on a second device.
- Replace SMS with an authenticator app and store the recovery codes offline.
- Schedule a quarterly check of devices, sessions and withdrawal whitelisting.