Creating Your Account and Setting Up Two-Factor Sign-In

Your BuyCryptoCard account is where your orders, cards and card details live. Because card details are sensitive, every account is protected with two-factor authentication from the start, and it cannot be switched off. Setting it up takes a few minutes. This guide walks through each step and explains what to keep safe afterwards.

What you need before you start

• An email address you can access and that is well protected.
• A phone with an authenticator app — for example Google Authenticator, Microsoft Authenticator, Aegis or a similar app that generates six-digit codes.
• A place to store recovery codes offline, such as paper in a safe place.

You must be at least 18 and not located in a sanctioned country to use the service.

Step 1: Register

Open the registration page from the site's menu and enter your name, email address and a password. Choose a password that is:

• long, such as a passphrase of several random words,
• unique, not used on any other site,
• stored in a password manager if you use one.

Step 2: Confirm your email

We send a confirmation link to your email address. Open it to confirm the address. The link proves the address is yours and makes sure account emails — order updates, card notifications and security notices — reach you.

No email after a few minutes? Look in junk or promotions folders and make sure the address was typed correctly. Only open confirmation links from emails you expect.

Step 3: Connect your authenticator app

Before the dashboard unlocks, the setup screen shows a QR code and a setup key:

1. Open your authenticator app and add a new account.
2. Scan the QR code, or type the setup key if scanning is not possible.
3. The app starts showing a six-digit code for BuyCryptoCard that changes every 30 seconds.
4. Enter the current code on the setup screen to confirm.

Once confirmed, every sign-in asks for your password and a fresh code from the app.

Step 4: Save your recovery codes

After setup, you receive a list of recovery codes. Each one can be used once to sign in if you cannot use your authenticator app — for example, if your phone is lost or broken.

Store them like you would a spare key:

• write them down or print them,
• keep them offline, away from your phone,
• do not store them in email or an online note.

Without the app and without recovery codes, regaining access takes longer, because we have to confirm your identity carefully.

Why two-factor sign-in is mandatory

A password alone is easy to steal through phishing, data breaches or reused passwords. With two-factor sign-in, a stolen password is not enough: an attacker would also need your phone. Because your account can reveal card details, this extra protection applies to every customer and every staff member, and it cannot be disabled. Our guide on keeping your account secure covers the other habits that matter.

Signing in day to day

Each sign-in asks for:

1. your email and password,
2. the current six-digit code from your authenticator app.

Codes change every 30 seconds. If a code is rejected, wait for the next one and try again, and make sure your phone's clock is set automatically — authenticator codes depend on accurate time.

Changing phones

When you get a new phone, move your authenticator accounts before resetting the old one. Many authenticator apps have a transfer or backup feature. If you could not transfer them:

1. Sign in with one of your recovery codes.
2. Open a support ticket asking to reset two-factor authentication.
3. After the reset, connect the authenticator app on your new phone and save the new recovery codes.

If you lose your phone

Sign in with a recovery code, then open a support ticket so we can reset two-factor authentication and you can connect a new phone. If you lost the recovery codes as well, email support from the address on your account so we can confirm it is you. This takes longer by design, to protect your account.

Keeping your email account safe

Your email address receives confirmation links, order updates and security notices, and it is part of how we confirm your identity if you lose access. Protect it accordingly: give it a unique password, turn on two-factor authentication for the email account itself and keep its recovery options up to date. An attacker who controls your inbox has a much easier path to your other accounts, so this step protects far more than your card account.

Other security settings

The security page in your account also lets you:

• change your password, which is worth doing if you ever reused it elsewhere,
• sign out other sessions, for example after using a shared computer,
• update your profile details.

Reviewing these settings every few months takes a minute and keeps your account in good shape.

Regenerating recovery codes

From the security page in your account, you can generate a new set of recovery codes. Do this if you have used several codes or think the old list may have been seen. The old codes stop working when new ones are generated, so store the new list straight away.

What we will never ask for

Nobody from BuyCryptoCard will ask for your password, an authenticator code or your recovery codes — not by email, chat, phone or support ticket. Anyone who asks is attempting to take over your account. See fake support accounts for how these attempts usually look.

After setup

With your account ready, you can order your first card. The how it works page shows the full process, and our guide on ordering your first card walks through the order form.

Frequently asked questions

Can I use SMS codes instead of an authenticator app?

No. The account uses authenticator app codes, which do not depend on your phone number and resist SIM-swap attacks.

Can I turn two-factor authentication off?

No. It is required for every account because accounts can reveal card details.

What if my codes are always rejected?

Check that your phone's date and time are set automatically, then try the next code.

Summary

Create your account with a unique password, confirm your email, connect an authenticator app and save your recovery codes offline. Every sign-in then needs your password and a fresh code. If you change or lose your phone, use a recovery code and open a support ticket. We will never ask for your password, codes or recovery codes.