You can protect your account and balances with several independent security layers.

Enable two-factor authentication

You can require 2FA every time you log in to the mobile app or web app, and for account updates, such as changing your personal info or closing your account. Go to “Account”, then “Security”, and toggle “Enable 2FA”.

To configure a passkey or security key:

  1. Follow your device’s instructions or insert your security key
  2. Add, rename, or remove keys anytime under “Manage passkeys”

To use an authenticator app like Google Authenticator or Authy:

  1. Scan the QR code or paste the setup key in your authenticator app
  2. Enter the generated 6-digit code
  3. Save your recovery codes as a backup if you lose access to the authenticator app

To disable an authentication method you no longer have access to, contact support.

To protect you from account takeovers, disabling 2FA, removing your only passkey, or removing “Account updates” from protected actions takes effect after a 5-day delay. No one can shorten the wait, not even the Strike team. Until it ends, your current settings stay enforced, and you can cancel the change from the notifications you get or by turning the setting back on in the app.

Set a PIN and biometrics

You can require a PIN every time you open the mobile app or log in to the web app. Set a PIN on the mobile app:

  1. Tap “Account”
  2. Tap “Security”
  3. Toggle “Enable PIN”
  4. Enter 4 digits
  5. Re-enter the same PIN to confirm
  6. Toggle Face ID or Touch ID on mobile devices that support it if you want to skip entering the PIN

You can change your PIN anytime by entering your current one. Like disabling 2FA, turning off your PIN takes 5 days, and you can cancel the change until then. If you forget your PIN, contact support.

Verify your anti-phishing code

Your anti-phishing code is unique to your account and included in every email you receive from Strike after you verify your identity. It’s a simple way to confirm an email is really from Strike and not a phishing attempt. If you receive an email that appears to come from Strike but doesn’t show your code, it’s not from us.

To find your current code and see when it was last updated, go to “Account” and “Security”.

You can rotate your anti-phishing code as many times as you want, with a 24-hour interval between each rotation. We recommend rotating it periodically, and immediately if you think someone else may have seen it. Strike may also refresh your code on your behalf if we detect a security concern. Once refreshed, you’ll receive a confirmation email that won’t contain the code and, from then on, all future emails from Strike will include the new code.

Email apps that verify senders, such as Gmail, Apple Mail, and Yahoo Mail, also show Strike’s logo and a checkmark next to the sender name, another sign an email is really from Strike.

Manage logged-in devices

You can log out of devices remotely at any time on the mobile or web app. Remote logouts require 2FA when it is on. The mobile app automatically logs you out if you don’t access your account for 30 days.

Control how much you can send

Learn how to safeguard your balance with a custom send limit.