6.1 Password Requirements and Password Managers

Our system enforces the following minimum requirements when creating a password. Any password that does not meet these criteria will be rejected by the form:

• Minimum length: 12 characters
• At least 1 uppercase letter (A–Z)
• At least 1 lowercase letter (a–z)
• At least 1 number (0–9)
• At least 1 special character (! @ # $ % ^ & * ( ) _ + - = [ ] { } ; ' : " , . < > ? /)
• No sequences such as 123456, abcdef, or keyboard patterns like qwerty
• No name, date of birth, or email components within the password

Why 12 characters? An 8-character password using uppercase and lowercase letters plus numbers has a search space of approximately 218 trillion combinations. With modern GPUs capable of computing billions of hashes per second, that can be cracked within hours. A 12-character password with special characters expands the search space to over 475 quadrillion combinations — even with dedicated hardware, a brute-force attack would take decades.

Recommended Password Managers Compared

We recommend Bitwarden or KeePassXC for users who value transparency and control. Bitwarden is open source and independently audited; KeePassXC stores the database exclusively on your local device, eliminating cloud-based attack vectors.

6.2 Two-Factor Authentication (2FA) — Step-by-Step Setup

2FA adds a second layer of security: even if your password is compromised, no one can log in without the second factor. We support TOTP-based authenticator apps (Time-based One-Time Password, RFC 6238).

Enabling 2FA — Exact Steps

1. Log in and navigate to Account → Security → Two-Factor Authentication.
2. Click "Enable 2FA". A QR code will be displayed.
3. Open your TOTP app (see recommendations in the table below) and select "Add Account" → "Scan QR Code".
4. Scan the QR code. The app will immediately generate a 6-digit code that refreshes every 30 seconds.
5. Enter the current code in the confirmation field and click "Verify". 2FA is now active.
6. Save your backup codes: The system generates 8 single-use backup codes. Download them, print them out, or store them in your password manager. Each code can only be used once.

TOTP Apps Compared

What to Do If You Lose Your Phone

If you lose your phone and can no longer access your TOTP app, follow these steps:

1. Open the login page and click "Lost 2FA Code".
2. Enter one of your saved backup codes. This will allow you to log in once.
3. Immediately navigate to Account → Security and disable 2FA using the backup code you just used.
4. Set up 2FA again on your new device (steps 1–6 above).
5. If no backup codes are available: Contact our support team with a photo ID and your account details. The identity verification process typically takes 2–5 business days.

6.3 SSL/TLS Encryption and Data Storage

All connections between your browser and our servers are encrypted using TLS 1.2 and TLS 1.3. TLS 1.3 reduces the handshake to a single round trip (compared to two with TLS 1.2), which decreases both connection latency and the attack surface for man-in-the-middle attacks. Outdated protocols (SSL 3.0, TLS 1.0, TLS 1.1) are disabled on our servers.

Passwords are never stored in plain text. We use bcrypt with a work factor of at least 12, meaning that even direct database access would not yield usable passwords. Financial data (card numbers, account details) is not stored on our servers — all processing is handled exclusively by PCI-DSS-certified payment providers.

Personal data (name, address, ID document copies) is stored in encrypted databases. Access is restricted to authorized compliance personnel and is fully logged. KYC documents are deleted in accordance with statutory retention periods.

6.4 8-Point Security Checklist for Your Account

Run through this checklist after registration and then once a month. Each item includes a specific action to take.

6.5 Phishing and Fraud Protection

Phishing attacks aim to steal your login credentials through fake websites or emails. The following tactics are commonly used by fraudsters — and are never used by us:

Report suspicious contact: If you receive an email, phone call, or message claiming to be from Verde that seems suspicious, report it through the support section in your account. Do not click any links in the suspicious message.

6.6 What Happens When Your Account Is Locked — Exact Process

An account lock can be triggered by various events. The following process documents what happens technically after a lock and what steps are required to restore access.

Triggers for an Automatic Lock

• 5 consecutive failed login attempts: Temporary lock for 30 minutes. Afterwards, an unlock email is sent to the registered address.
• Login from an unknown IP/device without 2FA: Additional verification required via email.
• Suspicious account activity (unusual transactions): The compliance team locks the account as a precaution and contacts you within 24 hours.
• KYC deadline exceeded: Withdrawals are blocked until documents have been uploaded and reviewed.

Unlock Process After 5 Failed Login Attempts — Timeline

1. Immediately (0 min): Account is locked for 30 minutes. The login page shows a countdown.
2. After 30 minutes: Automatic unlock. You may attempt to log in again.
3. Alternatively, immediately: Request an unlock email via the "Unlock Account" link on the login page. The email typically arrives within 2–5 minutes.
4. After unlocking: We recommend changing your password immediately and enabling 2FA if you haven't already.
5. If you suspect your account has been compromised: Contact support — your account can be frozen upon request until the matter is resolved.