Why did I receive an unexpected notification about a new sign-in location?

When you sign in to your Bitvavo account from a new device or location, we let you know by email and push notification. You can receive two types of notifications:

• New device confirmation: an email asking you to confirm a new device before you can sign in.
• New sign-in location detected: an email and push notification that your account was signed in to from a new device or location. It shows the IP address, country and browser that were used.

Did you sign in yourself? Then you don’t need to do anything.

What to do if you didn’t sign in yourself

If you have received one of these notifications but did not sign in from a new device or location yourself, a third party is trying to log in or has logged in to your account using your login data (and 2FA code). If this happens, follow the steps below immediately.

1. Freeze your crypto withdrawals

Freeze your crypto withdrawals right away, so no crypto can leave your account. You can do this yourself in your account settings. This article explains how.

2. Contact Bitvavo

Contact Bitvavo Support immediately by sending an email to support@bitvavo.com. Name the subject "Urgent". Your request will be prioritized, and your account will be (temporarily) blocked as soon as possible.

3. Change your password

Change the password of your Bitvavo account on the web:

1. Login to your Bitvavo account.
2. Click your name at the top right and choose "Security".
3. Click "Change password".
4. Enter your current and desired password.

A detailed explanation can be found here.

4. Enable 2FA (if you do not already have it)

2FA is an additional security layer, in addition to your credentials, for your Bitvavo account. To enable 2FA on the web:

1. Login to your Bitvavo account.
2. Click your name at the top right and choose "Security".
3. Click the option to enable two-factor authentication.
4. Enter your password.
5. Download the Google Authenticator or Authy app.
6. Scan the QR code with the Google Authenticator or Authy app.
7. Enter the code displayed.

A detailed explanation can be found here.

5. Check your IP activity

You can review from which IP addresses an attempt to log in has been made:

1. Login to your Bitvavo account.
2. Click your name at the top right and choose "Security".
3. Click on "Logs" in the top menu.
4. The most recent IP addresses are now displayed. If one of the IP addresses does not look familiar, you are strongly advised not to confirm the email about the new device.

A detailed explanation can be found here.

6. Change the password of your e-mail account

To ensure that a third party can not confirm the email, it is strongly recommended to (temporarily) change your password for your email account.