A stranger has your account ID and sign-up email. What that unlocks, and what it doesn't

Does it prove anything when the person messaging you can recite your user ID and the email you signed up with? It proves those two things reached them, and that is all. Two categories get blurred here: what identifies an account and what opens it. A user ID, an email address and a phone number sit in the first. Your password, your verification codes and the setup key behind your authenticator sit in the second. Everything quoted below comes from the English Binance help center; other exchanges write their own rules and you'd need to read theirs.

An ID you are told to hand over

The help-center page on finding your user ID opens with this: "The Binance ID or UID is a unique identifier assigned to each account. You need to provide your User ID for customer support issues."

So the platform's own process has you giving that number to someone else. It was never built to be a secret.

The same page says where it lives. On the website: "Log in to your account and go to [Profile] - [Dashboard]." In the app: "Tap the [Account Center] icon on the top left corner. You will then see your User ID above your nickname." Menu labels move between versions, so trust what your own screen shows (checked 2026-09).

Receiving money is the other everyday use. The page on sending crypto to another user with Binance Pay describes "sending via QR code or using the recipient's Binance account email, phone number, or Binance ID". If a friend is paying you, one of those three has to leave your hands. That page also says users "who have completed identity verification" are the ones who can send or receive this way.

Who has to pass the check when money moves

Stay on the transfer page. One step reads: "Enter your Pay PIN or complete 2FA to verify the payment." The "your" in that sentence is the sender.

Turn that around. Someone holding your ID can start a payment to you, and they are the one who has to clear the PIN or 2FA step on their own account. In the flow as that page lays it out, an ID or an email address only ever fills the recipient field. Nothing in it starts a payment out of your account. That reading is ours, drawn from the steps; the help center does not state it in those words.

Where a known ID does its damage

Its value to a scammer is in saying it back to you. A stranger who quotes your account number and your sign-up email sounds like someone looking at your record.

Think about where those two details have already been, though. You gave the ID to support. You sent it to whoever paid you last. It may be sitting in a screenshot you posted without blurring. The platform was never the only party that knew.

The help center's page on impersonation scams describes the set-up plainly: "Scammers might impersonate the Binance Customer Service team and contact you outside of our official channels. Please note that Binance Support staff will never ask you to reveal any sensitive information or send money to any address for any reason." It also says what phishing is fishing for: "sensitive information, such as your username, password, 2FA code".

Put those together and the ID is the opening line, not the prize. The ask that follows is for something from the credential rows of the table, or for a transfer.

It's out. What now?

1. Work out which category left your hands. If it was only the ID, the email address or the phone number, there's no password to change over this. If you also typed a password or a code into a page they sent you, that's a different article: the first hour after a phishing page.
2. Treat anyone who arrives already knowing your ID as unverified. Run the contact through the official verification tool before you answer anything.
3. Don't call back. The help center's wording is "Never return any calls from someone claiming to be a Binance employee or Binance Support team". That sentence is about returning calls. The page doesn't describe how official contact is made.
4. When you need support, start the conversation yourself from inside the app or the site, and give the ID there. You reaching them and quoting your ID is routine. Them reaching you and quoting it first is the pattern to distrust.
5. Look after the mailbox. An exposed address is where phishing mail gets sent. Set an anti-phishing code if you haven't, and if that mailbox shares a password with any other site, change it — the reason is in how credential stuffing works.

My own habit: I blur the ID and the email in every screenshot before it goes into a forum post or a group chat. Going by the transfer flow above, the number alone doesn't start a payment. Blurring it just means fewer "support agents" turning up afterwards. If a message does land and you're unsure, the phishing check goes through it point by point.