What is an anti-phishing code and how do I set one?
Set a phrase only you know. It appears in every email we send, so you can spot fake emails pretending to be us.
What it’s for
Scammers may send emails pretending to be us, trying to get you to click a link or enter your password or a code. Once you set an anti-phishing code, every email we send you shows it. An email with no code, or the wrong code, is a fake.
How to set it
Open the Anti-phishing code page
Go to Settings → Sign-in & security and choose Anti-phishing code under Devices and email safety.
Enter a new code
Type a phrase only you know into the new code field. The allowed length and characters are shown below the field. Don’t use your password or anything you use elsewhere.
Save
Choose Save. For security, you may need to enter your password again, and complete two-step verification if it’s on. You’ll see a confirmation once it’s saved.
To change it later, choose Change code on the same page; to stop using it, choose Remove. After removing it, our emails no longer show a code.
Got a suspicious email?
Wrong code means a fake email
Don’t click any links in it or enter your password or codes. Type the site address into your browser yourself, sign in and check your in-app notifications instead.
If you’ve already entered your password on a suspicious page, change your password immediately and check Signed-in devices and security log for anything you don’t recognize. See View signed-in devices, sign out other devices and lock your account.
Updated 2026-11-10 · 1 min read
Was this article helpful?
Still stuck?
Submit a ticket or contact support and we’ll get back to you soon.