Skip to main content

​
Password

Changing the password signs your other devices out; the one you change it from stays signed in. Resetting it from the sign-in page closes every open session.

​
Two-factor authentication

A code from an authenticator app, on top of the password. It is required before a first deposit and before any withdrawal, and asked again for the changes that touch your money or your access. A passkey signs you in with your device’s own lock, your face, your fingerprint or its PIN. It works only on this site, so a copied page gets nothing from it, and it stands for the two-factor code. Recovery codes are ten single-use codes that open the account if you lose your authenticator. Store them when they are shown: they are not shown again, and a new set replaces the old one. Losing the authenticator without a recovery code starts a recovery of the second factor, which removes it after a waiting period announced by email. Withdrawals then wait 24 hours, as after any change to your security: a password changed or reset, an email change, two-factor turned on or removed, a passkey added, a recovery code used, the address book turned off, or a freeze lifted.

​
Connected devices

The security page lists every device signed in, with the browser, the system and the date, and lets you sign any of them out, or every other device at once. A session ended from another device also stops the browser notifications of that device.

​
Security history

Every sign-in and every change to the account’s security over the last 90 days is listed, newest first: the account opened, two-factor turned on, a wrong code entered, a recovery code used, a device signed out, an email change. If you do not recognise one, change your password now.

​
Freeze withdrawals

One control stops every withdrawal and signs every device out, this one included. Positions and money stay where they are. Lifting the freeze takes a password reset, a sign-in, and the lift in the security settings; withdrawals then wait one more day. See Withdrawals.

​
Identity

Opening an account and depositing take an email address, a password and two-factor authentication. Xblu does not ask for identity documents today.

​
Closing the account

An account is closed from the settings once it is empty: no money, no open position or order, and no deposit or withdrawal in progress. Closing is final: every device is signed out and the account can no longer be signed in to.