Account security and protection

Two-factor authentication adds a separate proof of access to a password. Providers may support authenticator apps, hardware security keys, device-based passkeys or other methods. SMS can be offered by some services, but a telephone number can be affected by account takeover or a SIM change.

Check the methods, whether MFA is mandatory and the actions it protects in the actual provider settings. Enable the strongest method you can use reliably and test it before logging out. Secure your email account as well because a weak recovery channel can undermine a strong trading-account login.

Save backup codes in a secure place away from the device that generates your regular codes. Find out how device replacement works and whether a recovery request temporarily restricts trading or withdrawals. Support may ask you to prove identity, but it should not require you to reveal a current authentication code to a caller.

The public website is westrelaine.ca and the support address is [email protected]. Verify the complete domain rather than a display name, shortened link or logo. If a separate service is introduced, ask for its official address and legal identity before following an account link.

Be cautious about urgent requests, guaranteed returns, private payment instructions or demands to pay a tax or unlock charge to an unfamiliar wallet. Independently contact the team using the address on this website. Do not use a telephone number supplied only by the suspicious message as your verification route.

Some providers offer an anti-phishing code in official emails. Use it if available, but check the domain and request as well. Westrelaine does not publish a verified anti-phishing-code feature for every connected service. Never give someone remote control of your device merely because they claim to be a manager.

A session is an authenticated connection that may remain active after a login. Where your provider offers a session list, review the device, time and approximate location. Sign out sessions you no longer need and use the option to end all sessions if a device has been lost.

Review application permissions as well as browser sessions. A revoked login session may not revoke an API key or connected app. Check each access route separately and confirm that the change is reflected in the provider’s settings.

Create a separate key for each integration so that its permissions can be reviewed or revoked independently. Read-only access is generally the starting point for monitoring. Trading permission allows a wider range of actions and needs clear limits. Withdrawal access is unnecessary for ordinary analysis and should remain disabled.

Where supported, use IP allowlists and regularly review the age and purpose of keys. Do not paste a secret into an email or include it in an error screenshot. If exposure is suspected, revoke the key at the exchange rather than waiting for an analysis tool to stop using it.

An activity or audit log may show logins, connections, orders and configuration changes. The scope and retention period depend on the system. Compare a strategy change with the exchange’s execution records and retain relevant identifiers when asking support to investigate. A website enquiry record is not a complete trading audit trail.

Protection schemes cover different types of property and events. CDIC insures eligible deposits at member institutions within its coverage rules; it does not insure cryptoassets. CIPF concerns eligible property missing when a member firm becomes insolvent and does not compensate ordinary market losses. Direct cryptoassets held by a member firm are not eligible for CIPF coverage.

Do not infer protection from the word Canada, a bank transfer or the presence of a regulator’s name on a page. Confirm the institution, the account structure and the asset type with the provider. The same dashboard can display items that have different legal treatment.