Security

Account security

Set up two-factor authentication and passkeys, manage signed-in devices and sessions, recognise phishing, and report a security issue to Fundly.

Your Fundly account is protected by your password, a second factor, and the controls on this page. Take five minutes to set them up properly.

Two-factor authentication

Two-factor authentication (2FA) means a second code is needed to sign in or confirm a sensitive action, on top of your password. At launch, 2FA is required for all accounts.

Method	Recommended	Notes
Authenticator app (TOTP)	Yes	Works offline, cannot be intercepted by a SIM swap
Passkey	Yes	Uses your device's fingerprint, face or PIN, and resists phishing
SMS code	Only as a backup	Vulnerable to SIM swap attacks

Set up an authenticator app

Sign in to the Fundly web app at app.fundly.xyz and go to Profile, then Security.
Tap Two-factor authentication, then Authenticator app.
Scan the QR code with an app such as Aegis, Google Authenticator or 1Password.
Enter the six-digit code shown by the app to confirm.
Save the backup codes somewhere safe and offline. Each one can be used once if you lose your phone.

Add a passkey

Under Security, select Passkeys, then Add passkey.
Follow your browser's prompt to save it with your fingerprint, face or PIN.
Add a second passkey on another device if you can, so that losing one device does not lock you out.

Warning

If you lose your authenticator app and your backup codes, recovering your account requires a fresh identity check and can take several days. Store the backup codes now.

Devices and sessions

Every browser you sign in from creates a session. You can see all of them under Security, then Devices and sessions, with the browser, approximate location and last activity.

Tap any session to sign it out remotely.
Tap Sign out everywhere if you think someone else has access. This also asks you to change your password.
Sensitive actions such as adding a payee always ask for 2FA again.

Phishing and scams

Fundly staff will never ask for your password, your 2FA code, your backup codes, or the seed phrase or private key of any wallet. Anyone who asks for these is not Fundly.

Common patterns to recognise:

A message that your account is "suspended" with a link to a site that looks like Fundly. Always type app.fundly.xyz yourself instead of following links.
A "support agent" on Telegram, X or Discord offering to fix a deposit. Fundly support only works through the in-app support chat.
A "job" or "investment" that requires you to deposit crypto to Fundly and send the balance onward. Do not do this; it is money laundering and it will cost you your account.

Tip

Turn on real-time notifications for card payments and sign-ins. A notification you did not expect is the earliest warning you will get.

If something is wrong

Freeze your card from Cards. See Card controls and freezing.
Tap Sign out everywhere and change your password.
Contact the in-app support chat and describe what happened. If you cannot sign in, use the Cannot access my account link on the sign-in page.

If you have found a vulnerability in Fundly's web app or systems, email security@fundly.xyz with the details and steps to reproduce. Do not test against other users' accounts or real funds. We reply within 3 business days and welcome good-faith research.

How your funds are held