Account security FAQ: support PIN, 2FA, locked and suspended accounts

Updated 13 November 2026

Why does support ask for my support PIN?

Your support PIN is an 8-digit code in the client portal. It proves you are the account holder. We ask for it only when you are talking to one of our agents live and are not signed in to the portal. You don't need it in live chat, because you are already signed in there. You also don't need it for requests by email, or for general questions such as how JAFX works or which deposit methods we offer.

Where to find your PIN

Sign in to the client portal at app.jafx.com.
Go to Settings.
On the Support PIN card, click the eye icon to reveal the PIN.
Click Copy and give the PIN to the agent.

The PIN is hidden (" ** ** ") until you click the eye icon. Click Hide to cover it again. Copy shows "Copied!" when it has worked.

"Failed to get support pin.": the portal could not load the PIN. Reload the page and click the eye icon again.
"Cannot copy to clipboard.": your browser blocked the copy. Read the PIN from the card and type it instead.

The PIN expires after about 5 minutes. The card shows "Pin will expire in: mm:ss". Only reveal it when an agent asks for it. Give it only to JAFX support, and only when you have contacted us.

My support PIN doesn't match. How do I reset it?

The PIN has usually expired or a newer one has been generated.

Go to Settings → Support PIN.
Click the eye icon, then click Renew and confirm with Yes, renew.
Give the agent the new PIN shown on the card before the timer runs out.

If it still doesn't match, tell the agent. They will confirm your identity another way.

I lost my phone or authenticator app. How do I reset 2FA?

You can't reset two-factor authentication (2FA) yourself. Our team resets it for you.

Email support@jafx.com from the email address registered on your JAFX account. We can't accept requests from other addresses.
Say that you need 2FA reset and why.
We confirm your identity with security questions about your account. Sometimes we also ask for a photo of you holding your ID.
We email you when the reset is done. This is normally done within minutes of your reply with the information we ask for.
Sign in and turn 2FA back on: Settings → Security → Enable 2FA. Scan the new QR code with your authenticator app, enter the 6-digit code and click Activate 2FA.

If you also need to reset your password, get 2FA reset first. The password reset page asks for your 6-digit code when 2FA is on.

Client portal (app.jafx.com)

Use your portal email and password, not your trading account login number and password.

"That email and password don't match.": click Forgot password? and follow the emailed link.
"You are required to change your password…": your password has expired. Use Forgot password? to choose a new one.
"Your session has expired. Please sign in again.": you were probably signed in somewhere else. Only one session can be active at a time. Sign in again.
"Too many tries. Please wait a minute and try again." (the wait shown can be longer): you tried to sign in too many times in a short period. Wait for the time shown, then try again. If you are not sure of your password, use Forgot password? instead of guessing.

Failed sign-in attempts do not lock or suspend your portal account. If you still can't sign in, email support@jafx.com from your registered email address.

See Signing in, forgotten password and password expiry.

Web trader (terminal.jafx.com)

If you see "Too many login attempts" or "Please wait N seconds before trying again", wait for the time shown and try again. Check your trading account number (digits only) and its password.

Why was my account suspended, and how do I get it back?

We may suspend an account to protect it:

if we see unusual activity
if you tell us your account may be compromised

To get your account back:

Email support@jafx.com from your registered email address and ask us to lift the suspension.
Confirm that the request is genuine. Depending on the reason, we ask you to reply to a confirmation email, answer security questions or send identification documents.
We lift the suspension once you have confirmed.

If the account needs further review, this takes longer. We aim to reply within 24 hours, but a full review may take more time.

I think my account was hacked. What should I do?

Contact us straight away by live chat or at support@jafx.com. We may suspend the account while we check it.
Secure your accounts: - Change your portal password: Settings → Security → Change password → Email me a reset link. If you can't sign in, use Forgot password? on the sign-in page. - Change the password of your personal email account. - Reset your trading account password: Trading Accounts → Reset pwd on the account card, then confirm with Reset Password. The new password is emailed to you, and any terminal signed in to that account is signed out. See Trading account passwords: reset, forgotten password and investor password. - Turn on 2FA: Settings → Security → Enable 2FA. - Check your open positions and Transaction History for anything you don't recognise.
Answer our questions about your account so we can confirm you are the owner.
Secure your API keys, even if you don't use them. Anyone who has your trading account password can create one. Open the Developers page of the web trader, select Stop API trading now, then Revoke every key you do not recognise or that may have leaked. A revoked key stops working within seconds. Logging out of the web trader does not stop your API keys. If you added your own AI provider key to JAFX AI, remove it (Manage, then Remove key) and cancel it with the provider that issued it. JAFX never asks for your password or your API key.
Disconnect AI apps you don't recognise. On the Developers page of the web trader, under Connected apps, select Disconnect on each one. A disconnected app loses access within seconds.

Depending on what we find, we may recommend that you:

withdraw your funds and open a new account with a new email address. You complete verification again for the new account. We may ask you to confirm the withdrawal by email first.
keep the same account, once all your passwords are changed. We also recommend turning on 2FA.
close the account if it holds no funds, and open a new one.

We can't reverse trades or losses made on your account. JAFX is not liable for any losses made on a compromised account.

No. Your portal login, trading account password, 2FA codes and support PIN are for you only.

You are responsible for keeping your login details secure. Anyone with them can see your data, trade on your account and request transactions.
We deal only with the account holder. If we think someone else is using your account, we may ask for a photo of you holding your ID, taken at the time of the request, showing the current date and a phrase our team gives you.
Our staff will never ask for your portal password, trading password, 2FA code or one-time password (OTP).

Security tips

Use a strong portal password that you don't use anywhere else. The minimum is 8 characters.
Turn on 2FA.
Keep your email account secure. Password reset links are sent there.
Sign out on shared devices. Only one portal session can be active, so an unexpected sign-out can be a warning sign.
Contact us at once if you see activity you don't recognise.

Was this article helpful?