Your account is a phone number and a six-digit code. That removes the two commonest ways accounts are lost — a reused password, and a leaked one — and leaves a smaller set of risks worth knowing.
The code
Six digits, valid ten minutes, five attempts. After five wrong ones you need a fresh code.
Nobody legitimate will ever ask you for it. Not us, not a seller, not somebody claiming to be support. A code read aloud to a stranger is your account handed over.
The real risks
Somebody with your handset. The code goes to your phone, so physical access is access. Lock your phone.
A SIM swap. Rare, serious, and the reason we do not let a number be moved between accounts automatically.
A convincing message. What a fake looks like.
If you think somebody else has got in
Tell us immediately. Sessions can be ended and the number can be verified again.
Changing your number
Deliberately not self-service. If it were, anybody holding your old handset could move the account to themselves. How to do it.
Questions people ask
Why is there no password?
One more thing to lose, phish or reuse. A code to a verified number is simpler and harder to steal.
Can I use two-factor authentication?
The code to your phone is the factor. There is no password for it to be second to.
What if somebody asks me for my code?
That is an attack. Nobody legitimate needs it.
What if I lose the phone my account is on?
Tell us straight away.
More: why phone verification.