Accounts & Security

This page defines how WorldX protects users against account takeover and operational abuse.

Purpose

Account compromise is one of the most common causes of loss. The account system must:

• Reduce takeover probability

• Reduce takeover impact

• Provide clear recovery and dispute pathways without enabling social engineering

Key Definitions

• Session: An authenticated device/browser instance.

• Security event: A sensitive change (password reset, MFA reset, new device, API key creation).

• Cooldown: A time-based restriction after security events.

• High-risk action: Withdrawal, API trading enablement, sensitive profile changes.

Account States

WorldX uses explicit user states because feature access depends on risk and compliance constraints:

• Unverified: Limited access

• Verified (Tiered): Broader access (tier rules defined by compliance posture)

• Restricted / Under Review: Limited actions due to risk signals or compliance requirements

• Suspended: Actions blocked pending resolution

WorldX publishes what each state allows and the escalation path.

Authentication Baseline

WorldX requires:

• Strong password handling

• MFA support (TOTP recommended)

• Session management (view + revoke sessions)

• Alerts for anomalous logins (policy-defined triggers)

High-Risk Action Protection

WorldX protects withdrawals and sensitive actions through layers:

• MFA enforcement

• Cooldown after security changes

• Optional withdrawal allowlists (recommended for serious users)

• Anomaly detection (new device + withdrawal, unusual patterns)

• Manual review triggers for high-risk events

Threshold details remain private, but the enforcement categories are public.

Account Recovery

Recovery is treated as high risk. WorldX recovery must:

• Require strong identity verification (tier-dependent)

• Log recovery events as security events

• Enforce cooldowns after recovery before withdrawals

• Provide transparent case tracking for users

What Users Will Always See

Users can always view:

• Active sessions

• Recent security events

• Withdrawal history and status

• Whether the account is restricted and why (reason codes when allowed)