Protecting your Blocs account: PINs, devices and recovery

Account security fails in boring ways. Reused passwords, a code read aloud over the phone, an unlocked handset left on a desk. The features below are designed around those realities rather than exotic attacks.

Your PIN protects actions, not just entry

Your Blocs PIN is requested at sign-in and again before money leaves your account. Two separate checks are intentional: an unlocked phone should not be enough to move funds. Changing a PIN always requires the current one first, and repeated wrong attempts trigger a timed lockout rather than an endless guessing window.

Never choose a PIN that appears elsewhere in your life — a card PIN, a birth year, a door code. If you think someone has seen yours, change it from Security settings immediately.

Two-factor authentication

Turning on two-factor sign-in means a stolen password alone is useless. We support an authenticator app or SMS, plus one-time backup codes for the day you change phones. Store the backup codes somewhere that is not your phone.

Devices you can see and revoke

Security settings list every device with an active session. If you no longer recognise one, sign out everywhere — this ends every session at once and forces a fresh sign-in with your PIN.

Incognito accounts and recovery keys

An incognito account has no email attached, which means the account key issued when you create it is the only route back in. We store only a hash of that key, so we genuinely cannot recover it for you. Write it down before you close the screen.

Signals that someone is trying to defraud you

Blocs staff will never ask for your PIN, a two-factor code, or your incognito key — not in chat, not by email, not by phone. Anyone who does is not us. Pressure to act immediately is itself the warning sign.