Account Security

Your sign-in gets you into Fiber. These settings decide what someone could do if they got hold of your phone, your email, or a sign-in code. Turn them on before you hold a meaningful balance.

App Lock

App Lock asks for Face ID, a fingerprint, or your device passcode when you open Fiber and before sensitive actions: sending, withdrawing to a bank, trading, approving or removing devices, and exporting your wallet backup.

Turn it on in Settings > Security > Account security > App lock. It's off by default, it's available in the mobile app only, and it applies to every account on that phone.

• If the phone has no screen lock, the setting shows Not available. Add a passcode or biometrics in your phone's settings first.
• If Face ID is turned off for Fiber, the app asks you to turn it on in your phone's settings.
• If a Face ID check is cancelled, try again or use your device passcode.

Extra protection: passkeys, authenticator, and backup codes

Extra protection adds a second check to the actions that matter. Signing in stays the same.

1. Open Settings > Security > Account security. On the web, it's Settings > Security.
2. Tap Add passkey or Add authenticator. Fiber first confirms it's you with your password, an email code, or a text message.
3. Save your Backup codes somewhere safe. You get 10.

Once it's on, Fiber asks for a passkey, an authenticator code, or a backup code before sends, trades, bank and card actions, changes to your email, phone, or Fibertag, device approvals and removals, and wallet backup exports.

Exporting your wallet backup always needs a fresh check, even with extra protection off. To export, you need a verified email or phone, or a passkey or authenticator. With extra protection on, only a passkey, an authenticator code, or a backup code works.

Approving a new device

Signing in on a new phone or browser usually just works, and Fiber sends you a "New device signed in" alert. When the new device is in a country that doesn't match your residency or your recent sign-ins, Fiber asks you to approve it:

1. Your other devices get a New sign-in request by push, email, and text. This alert can't be turned off.
2. On a device that's already signed in, check the device and location, then tap the code that matches the one on the new device. If it wasn't you, tap Deny — this wasn't me.
3. The new device's code expires after 5 minutes. If time runs out, start again.

Instead of using another device, the new device can approve itself with Use passkey, Use authenticator app, or Use backup codes, if you set those up.

If you don't have your other device

On the approval screen, tap I don't have my other device to start device recovery.

• Recovery has a 24-hour waiting period. The new device shows a countdown, and Fiber sends reminders while you wait.
• When the wait ends, the new device signs in and every other device is signed out.
• Opening Fiber on a phone that's still signed in cancels the recovery. This protects you if someone else started it.
• After recovery, your passkeys, authenticator, and backup codes are removed. Extra protection stays off until you add a new method.

Logged in devices

Settings > Security > Logged in devices lists every device on your account as Active, Pending, or Revoked. The device you're using is marked. On the web, it's Settings > Security > Devices.

To sign a device out, revoke it. There's no single "sign out everywhere" button, so revoke each device you don't recognize.

The mobile app stays signed in until you sign out. On the web, Trust this browser until I sign out is on by default. Turn it off on shared computers, and the session ends after 10 minutes of inactivity.

Security alerts

These alerts are always sent and can't be turned off:

• New sign-in request: a new device is waiting for your approval.
• New device signed in: a device joined your account without needing approval.
• Device recovery started, plus reminders while it runs: someone is recovering access on a new device. If it wasn't you, open Fiber on a signed-in phone to cancel it.
• Wallet seed exported: someone exported your encrypted wallet backup from a named device. If it wasn't you, revoke that device in Logged in devices right away and contact support.

Avoiding scams

Fiber will never ask you for:

• Passwords or one-time verification codes
• Your wallet backup file or its password
• Private keys, or anything a recovery tool shows you

Fiber's official websites are fiber.so, app.fiber.so, and docs.fiber.so. Fiber's social accounts are X (@fiber_evm) and LinkedIn. Support talks to you in the assistant chat inside the app, or by email from support@fiber.so. See Assistant & Support.

Onchain transactions can't be reversed. Check every address and network before you confirm.