- What it is
- A short second secret a market requires before a withdrawal, a payment or a change to a payout destination is allowed through.
- How you get one
- You set it during account setup or in the security settings, choosing a value unrelated to the passphrase you just chose.
- Where to keep it
- Somewhere the passphrase is not, so that one careless moment cannot deliver both of them to the same person.
- How it goes wrong
- Trouble starts when the value is a slice of the passphrase, a birth year, or the code that unlocks your phone.
- What fails without it
- The account opens and reads normally right up to the moment a balance has to move, and then stops dead.
- Time to acquire
- Setting one is a minute. Deciding where the second copy lives takes rather longer.
Two secrets doing two different jobs
The first secret proves you are the account holder at the door. The second proves you are the account holder at the moment value moves. These are not the same claim, and a market that asks twice is drawing a line between reading and spending on purpose.
The line only means anything if the two secrets fail separately. A PIN derived from the passphrase, stored in the same manager entry, written on the same line of the same page, is not a second secret. It is the first secret in a smaller font. Whoever obtains one obtains both, and the market ends up asking a question it has already been handed the answer to.
What the separation actually buys
Consider what an attacker with only the passphrase can do. They can read your messages, see your order history, learn who you buy from and study how you write. That is bad. What they cannot do is empty a balance or redirect a payout, and that difference is the whole return on keeping the second secret elsewhere.
Now consider the more common case, which is not an attacker at all. It is you, on a machine that logs keystrokes because of something you installed months ago, or on a session you left open in a shared room. The passphrase goes first, because it is typed at the door every time. The PIN is typed rarely and, if it lives somewhere else, may not be typed on that machine at all.
| Held by someone else | What that gets them |
|---|---|
| Passphrase only | Your correspondence, your order history and a good picture of your habits. |
| Spend PIN only | Nothing on its own, because there is no door it opens. |
| Both, from one place | The account and the balance, in a single sitting, with no second question to answer. |
Choosing a value that is not a slice of something else
A PIN is short, so people reach for something meaningful to remember it. That instinct is the failure. Dates, house numbers, phone unlock codes and the numeric part of an old password are all guessable by anyone who knows a little about you, and the pool of candidates is small enough to work through.
Generate it the same way you generated the passphrase, from something outside yourself, and accept that you will have to look it up rather than recall it. Looking it up is fine. The PIN is used rarely, and a value you have to check is a value you did not build out of your own life.
Recognising one that has drifted
This artifact is listed as keeping rather than going stale, because a PIN you set stays the PIN until you change it. What drifts is your record of it. The tell is hesitation: you think you know it, you are not certain, and you would rather not spend one of your attempts finding out.
That hesitation is worth taking seriously, because attempts are usually limited and the lockout tends to arrive at the exact moment you are trying to move money. Check the record while nothing is pending. If your written copy and your memory disagree, trust neither and reset it from inside a working session.
The moment it is actually needed
You will not miss this item while browsing. It surfaces when a balance is ready and a payment is due, which is the least convenient moment for a search through drawers. That is why it belongs on the list of things you hold beforehand rather than the list of things you sort out later.
The rest of that moment is covered in the paying stage, and the record of what you were trying to do when it stopped is the order record. Both assume you already know your own second secret.
Questions that come up
What if a market does not offer a spend PIN?
Then the account has one secret doing both jobs, and you should know that rather than assume otherwise. The practical response is to compensate elsewhere: keep less sitting in the balance, move funds out promptly after a payment clears, and treat the passphrase as the single thing standing between an intruder and your money. Some markets call the feature something else, so check the security settings before concluding it is absent.
Can the PIN and the passphrase share a password manager?
They can, and doing so gives up most of what the separation was for, because one unlocked manager then produces both. If convenience wins, at least put the PIN in a separate entry under a name that does not connect it to the account, and keep the paper copies of the two in different places. Splitting the physical copies preserves some of the benefit even when the digital copies sit together.