What to do if your JAFX account has been hacked

Contact us straight away, then lock the attacker out. Secure your email first, then change your portal password and every trading account password, turn on 2FA, revoke any API keys and disconnect AI apps you don't recognise. Do these steps in the order below.

Contact us straight away

• Live chat: select Chat in the client portal (app.jafx.com). On a phone, open Menu, then Human Support. You always chat with a real person, 24/7.
• Email: write to support@jafx.com from the email address registered on your JAFX account.

Tell us what you noticed. If a transaction is involved, include its transaction ID. We may suspend your account while we check it. We will ask questions to confirm you are the account owner. See How JAFX support confirms it's really you.

Our staff will never ask for your portal password, trading account password, 2FA code or any one-time code.

Secure your email account first

Password reset links and new trading account passwords are sent to your registered email address. If someone else can read that mailbox, they can reset your JAFX passwords too.

1. Change the password of your personal email account.
2. Turn on your email provider's two-step sign-in if it offers one.
3. Only then reset your JAFX passwords.

If you can no longer get into that mailbox, see I can't get into the email address registered on my JAFX account.

Change your portal password

If you can still sign in:

1. Go to Settings → Security → Change password.
2. Select Email me a reset link.
3. Open the link in the email and choose a new password. Use at least 8 characters, and do not use a password you use anywhere else.

If you can't sign in, select Forgot password? on the sign-in page, enter your email and select Send reset link. If 2FA is on, the reset page also asks for your Authentication code. See Signing in, forgotten password and password expiry.

Reset the password of every trading account

Your trading accounts have their own passwords, separate from your portal password.

1. Go to Trading Accounts.
2. On the account card, select Reset pwd, then confirm with Reset Password.
3. Repeat for every trading account you hold.

The new password is emailed to you. Any JAFX Terminal signed in to that account is signed out. See Trading account passwords: reset, forgotten password and investor password.

Turn on 2FA

Two-factor authentication means a stolen password is not enough to sign in.

1. Go to Settings → Security → Enable 2FA.
2. Scan the QR code with an authenticator app, such as Authy or Google Authenticator. Save your Secret key somewhere safe.
3. Enter the 6-digit code in Verification code and select Activate 2FA.

If 2FA is now blocking you, for example because someone else turned it on, you can't reset it yourself. Email support@jafx.com from your registered email address. See Two-factor authentication (2FA): turning it on, signing in with it and turning it off.

Stop API trading and revoke your keys

API keys keep working after you log out of the JAFX Terminal. Logging out does not stop them.

1. Sign in to the JAFX Terminal at terminal.jafx.com and open the Developers page.
2. Select Stop API trading now.
3. Select Revoke on every key you don't recognise or that may have leaked. A revoked key stops working within seconds.
4. Under Connected apps on the same page, select Disconnect on every AI app you don't recognise. A disconnected app loses access within seconds.

If you added your own AI provider key to JAFX AI, remove it with Manage, then Remove key. Then cancel that key with the provider that issued it. See API keys in the JAFX Terminal: create, roll and revoke.

Check your positions and Transaction History

• In the JAFX Terminal, check your open positions and orders. Close or cancel anything you don't want to keep. See Closing positions and managing pending orders in the JAFX Terminal: partial close, Close all and Cancel all.
• In the portal, open Transaction History and look for deposits, withdrawals or transfers you didn't make.
• If you find a pending withdrawal you didn't request, open it from History and select Cancel withdrawal while the button is shown. If the button is not there, contact us at once. See How to cancel a withdrawal.
• Send us the transaction ID of anything you don't recognise. See Where to find your withdrawal history, status and transaction ID.

Your options afterwards: withdraw and open a new account, keep the account, or close it

Depending on what we find, we may recommend one of these:

• Withdraw your funds and open a new account with a new email address. Your registered email address can't be changed, so a new account needs a new address. You complete verification again on the new account. We may ask you to confirm the withdrawal by email first.
• Keep the same account. Do this only once you have changed your email, portal and trading account passwords. We also recommend 2FA.
• Close the account if it holds no funds, and open a new one.

Withdrawals are paid only from a wallet. If your money is in a trading account, move it to your wallet first on Internal Transfers. See How to transfer funds between your wallet and trading accounts.

If your identity is not verified, you can withdraw up to $4,000 a day. Withdrawals are usually processed within minutes, but we advise allowing up to 24 hours in case any additional security checks are needed.

What we can't do

• We can't reverse trades or losses made on your account.
• We can't reverse a crypto payment once it has been sent on the blockchain.
• We can't change the email address registered on your account.
• We can't share account details until we have confirmed you are the account owner.

For more on keeping your account safe, see Account security FAQ: support PIN, 2FA, locked and suspended accounts.

We are available 24/7 via live chat or email (support@jafx.com).