What to do right after your first purchase

Most of this is the security setup that ideally happened before the money went in. If you did it then, this page takes you four minutes instead of fifteen. If you did not, now is the second-best time, and nothing here is difficult.

1. Two-factor authentication, using an app

If your account is still protected by SMS codes, change that now. Text-message codes can be intercepted by someone who persuades your mobile operator to move your number to a new SIM — a documented, ordinary attack rather than a theoretical one, and one that targets people known to hold crypto.

Any authenticator app works. During setup you are shown a backup key: write it on paper. Do not screenshot it, because that puts your recovery key into your photo library and from there into whatever cloud your photos sync to. A note in a drawer is genuinely better security than a file on the device you are protecting.

2. Anti-phishing code and withdrawal whitelisting

Two settings that almost nobody turns on and that between them defeat most of what actually goes wrong.

The anti-phishing code is a short phrase you choose, which the exchange then includes in every genuine email it sends you. From that moment, any email claiming to be from them without your phrase is fake, and you no longer have to judge these on the quality of the logo. It takes about a minute to set.

Withdrawal address whitelisting restricts withdrawals to addresses you approved in advance, usually with a delay before a newly added address becomes usable. That delay is the entire point: it is time for a notification to reach you and for you to react.

You now own something that people actively try to steal. These two settings are the cheapest defences available.

3. Write down what you just did

Thirty seconds, and it is the item on this page most likely to matter.

In many countries a crypto purchase is already a taxable event with a record-keeping obligation attached, and the obligation begins at purchase rather than at sale. What you need later is the cost basis: what you paid, in your own currency, at the moment you bought. Without it, working out what you owe when you eventually sell is guesswork, and the guess tends not to be in your favour.

Five fields:

• Date and time
• Amount paid, in your own currency
• Quantity received
• Fee paid
• Platform

A spreadsheet is fine. A note on your phone is fine. What is not fine is assuming the exchange will still have it: platforms change providers, close accounts, restructure their export formats, and occasionally leave markets entirely, and none of that is your problem until it is.

Where to keep the record so it survives

Two failure modes are worth designing around, because both are common.

The record lives only on the platform. Exchange trade histories are exportable and they are also the first thing you lose access to if an account is closed, a platform exits your market, or a login goes wrong at the worst moment. Keep your own copy somewhere the exchange does not control.

The record lives only on one device. A note on a phone that is never backed up is a record with a single point of failure. Anywhere that syncs — a spreadsheet in whatever cloud storage you already use, an email to yourself — is fine, because none of this is secret information. It is a list of purchases, not a password.

One more habit worth starting immediately: add a row every time, not in batches. People who intend to reconstruct six months of activity from statements at tax time discover that fees, conversion rates, and timestamps are the parts that are hardest to recover and the parts that matter most.

4. Find where the coins actually are

Open the balance page and look at it. Most platforms split holdings across several areas — a spot balance, a funding balance, sometimes an earn or savings section — and a purchase lands in one of them. Knowing which one before you are anxious is worth more than working it out during.

While you are there, absorb the thing that surprises people most: that number is a record in the exchange's database saying they owe you that quantity. It is a claim against a company rather than an asset in your own hands. For a small first purchase that is a normal arrangement and most people leave it exactly there — the distinction and what it costs you is worth ten minutes now rather than during an incident.

5. Alerts on, price notifications off

Turn on login notifications and withdrawal notifications. An unexpected one of either is the earliest warning you will get, and reacting within minutes rather than days is what decides how that ends.

Turn off price alerts unless you have a specific decision waiting on a specific number. A notification telling you an asset moved is not information; it is a prompt to open the app, which is what it was built to be. The first week is when that habit forms.

6. Close the app

Seriously. The purchase is complete and there is nothing further to do.

What happens next is that the price moves, probably within hours, and you feel something about it that is out of proportion to the amount. That reaction is the actual output of this exercise: it tells you what size position you can hold without it occupying your attention. Someone who checks eleven times before lunch has learned something genuinely useful about themselves, at a small cost, which is a good trade.

Three things not to do this week

Do not add money because the price went up. This feels like new information arriving and confirmation you were right. It is the same asset at a higher price, and the urge arrives precisely when the decision is least considered. It is the mechanism that turns a small experiment into a large regret, and it is the single most expensive item on that list.

Do not accept help from anyone who approaches you. New holders attract messages: friendly strangers, people offering to trade on your behalf, someone from “support” who noticed a problem with your account. All of it is a scam without exception. Real support never contacts you first, never asks for your password or 2FA code, and never asks you to move funds to a “safe” address.

Do not immediately buy four more things. Five assets is five sets of fees, five records to keep, and five sets of research you have not done, in exchange for exactly the same educational value as one. The list being long is a product decision by the exchange, not a statement about how many are worth owning.

If you want a next step

There is no obligation to have one. But the two that repay the effort are understanding what the purchase actually cost you — the number is usually larger than the fee line suggested — and, if the amount grows into something you would mind losing, learning self-custody calmly rather than urgently.

And if the honest conclusion after a week is “I did not enjoy any part of this”, that is a complete result. You paid a few dollars in fees to learn something about yourself that plenty of people pay considerably more to find out.