Account security and two-factor authentication
This account can move money and control where it goes. What to secure, in the order that matters.
Your account holds client relationships and, for experts, a payout destination. That makes it worth attacking, and it makes account takeover — not a platform breach — the most likely way you would lose money here. The good news is that the defences are short and mostly one-time.
- Use a long, unique password that exists nowhere else. Reuse is how most accounts are lost: the breach happens on some other site, and the attacker simply tries the same pair here.
- Turn on two-factor authentication. This is the single highest-value action available to you, and it takes about two minutes.
- Save your backup codes somewhere you can reach without your phone. A safe with the key inside it is not a safe.
- Never share a one-time code. Not with support, not with a client, not with anyone — there is no legitimate reason for another person to need it.
Choosing a second factor
| Method | Strength | Use it when |
|---|---|---|
| Authenticator app (TOTP) | Strongest offered | Almost always — it works offline and cannot be intercepted in transit |
| Email codes | Better than nothing | You cannot use an app; note that it inherits your email account’s security |
| Backup codes | One-time escape hatch | You have lost access to your second factor |
Where to set it up
Settings → Security. You can enable an authenticator app, switch to email codes, view or regenerate backup codes, and turn it off again if you must.
What we will never ask you for
- Your password, in any channel, for any reason.
- A 2FA code or a backup code.
- Payment to release your own escrow or payout. That is never a thing.
- A transfer to a "verification" account, or a fee to unlock your earnings.
The realistic scam
Someone messages you as a client, moves you to email, and sends a link to a page that looks like our sign-in. Check the address bar before you type, and be sceptical of any urgency about your money — urgency is the tool, not a symptom.
Experts: your payout destination is frozen while you have active work or held escrow. That restriction is annoying for you exactly once, and it is the control that stops an attacker redirecting a funded project.
34 articles · Ask a question