Security tips

The security of your Paribu account depends on the security tools provided as well as on your habit of using them correctly. A strong password, layered authentication, secure device usage and regular checks help keep your account protected.

Raise your security level

On Paribu, your account security is evaluated in three levels based on the verification steps you have enabled. You can see your current level at the top of the Security settings screen and move up by completing the recommended steps.

Level	Condition
Critical	None of the three steps is active
Medium	One or two of the three steps are active
Secure	All three steps are active

To raise your level to Secure, you need to complete three steps:

1. Two-factor authentication (2FA) — Generating a one-time code with an authentication app
2. Passkey — Verifying with your face, fingerprint or device password in the sign-in step
3. Biometric authentication — Unlocking the app with Face ID or a fingerprint

Note: The three steps protect different places: two-factor authentication covers operations that require a security confirmation, a passkey covers the sign-in step, and biometric authentication covers the app lock. For details, you can check the What is the account security level and how to raise it article.

Create a strong password

Your password is the first layer of access to your account; it should be hard to guess and unique to you. These are the rules Paribu applies:

• At least 8 characters (at most 64 characters)
• An uppercase letter, a lowercase letter and a number
• No sequential digits — such as 123 or 210
• The same character cannot be used three times in a row — such as aaa or 111
• It must be different from your current password and from the passwords you used before

On top of these rules, there are three things you can add through your own habits:

• Do not use easily guessed information such as your date of birth, Turkish ID number or phone number as your password
• Choose a Paribu password that is different from the passwords you use on other platforms
• Change your password at regular intervals

Warning: After you change or reset your password, no crypto asset withdrawal can be made for 48 hours, for your security. The same restriction also applies after an email address change. This restriction protects your account against withdrawal attempts following unauthorized access.

If you forgot your password, you can follow the reset steps in the Forgot my password, what should I do? article.

Never share your sign-in details

Your Paribu password, the code in your authentication app, the SMS verification code and the email verification code are information that belongs only to you. They should not be shared even with people you trust, and should not be sent through other channels.

• Never share your password, your verification codes or your passkey confirmation with anyone
• Avoid keeping this information written down physically
• People claiming to be a Paribu representative never ask for this information

If you come across a suspicious message or request for information, you can check the How to protect against phishing and fraud article.

Pay attention to session and device security

Keeping the devices and sessions you sign in from secure prevents your information from falling into the hands of third parties. Avoid signing in from internet cafes and similar publicly available devices; use a secure network and a device you know.

• Use Paribu only from your own device or a device you trust
• Sign out when you are done with your transactions
• Do not sign in to your account on unsecured Wi-Fi networks; use a personal mobile data connection where possible
• Check the devices that have access to your account regularly from the Manage devices section on the Security settings screen
• End the session on devices you do not recognize or no longer use

The device list shows the date, IP address and location for each device. When you notice a suspicious session, you can close only that session with the device's Delete device action, or close the sessions on all registered devices with the End sessions on all devices button.

Keep track of incorrect login attempts

The Incorrect logins section on the Security settings screen shows the incorrect login attempts made on your account in the last 7 days with their date and IP address. Checking this information regularly lets you detect unauthorized access attempts on your account early.

• Review your incorrect login history at regular intervals
• If you see attempts from an IP address you do not recognize, or repeated attempts, change your password and enable 2FA
• If there is activity you find suspicious, contact Paribu Support

Protect your account in a suspicious situation

When you notice unusual activity on your account or suspect it has been compromised, you can quickly secure your account by sending an SMS with the text KİLİTLE to 0850 303 60 00 from the phone number registered to your Paribu account. After the message, your account is temporarily closed to actions.

If you do not receive a confirmation message, do not wait: report the situation directly by calling the same number or by connecting to the live support chat through Paribu Support. Once your account is secured, you can learn the steps required to reopen it from the support team.

---

Frequently asked questions

How can I check my security level?

When you go to the Security settings screen, your current security level (Critical, Medium or Secure) and the number of steps you have completed appear at the top. You can also track which steps are active in the Security steps list on the same screen.

How often should I change my password?

Changing your password at least once every 3-6 months is recommended. Change your password right away if you notice suspicious activity, if you also used the same password on another platform, or if you lost your device.

Can I sign in to my Paribu account on more than one device?

Yes. You can see the devices that have access to your account from the Manage devices screen and end their sessions whenever you want. When a sign-in is made from a device it does not recognize, Paribu also asks for approval by email.

What exactly does the IP address shown for incorrect login attempts mean?

An IP address is the identifier of the internet connection the sign-in attempt was made from. Single attempts from a connection you recognize may come from mistyping your password. If you see repeated attempts from an IP address you do not recognize, change your password and enable 2FA.

I locked my account, how can I reopen it?

Once your account has been closed with the KİLİTLE SMS, you can create a reopening request by starting the live support chat through Paribu Support. The support team reopens your account for use after the identity verification steps.

---

Related articles

• What is the account security level and how to raise it — Security level and the three steps
• How to protect against phishing and fraud — Protecting against phishing and fraud
• How to set up two-factor authentication (2FA) — 2FA setup
• What is device management and how to use it — Managing linked devices
• How to view failed sign-in history — Viewing failed sign-in records