Anti-Phishing Code

An anti-phishing code is a short phrase a user sets inside an account, which the platform then includes in every genuine email or notification it sends. Its purpose is to make forgery detectable at a glance: an attacker who copies the wording, logo and sender name of a real message cannot know the phrase, because it exists only inside the account. A message that lacks the phrase, or carries a different one, was not sent by the platform whatever the address in the from field says. The feature only works if it is set before it is needed and if the user actually checks it, and it protects the inbox rather than the account — it says nothing about whether a link is safe once a fake message has been believed. Not every venue offers one, and the name varies.