Moon.com Security: 2FA, Passkeys and Account Recovery
Short answer
Yes: Moon supports 2FA through an authenticator app, and passkey login requires 2FA first.
Yes, Moon.com supports two-factor authentication through an authenticator app, according to Moon's help center. The largest gap concerns custody: Moon's terms state that Moon.com is not a licensed custodian and that its fund-separation measures cannot guarantee full recovery after a breach or insolvency. Anyone under the minimum legal age, or located in a country that Moon's terms list as prohibited, must not use the service.
Moon.com is a leveraged betting site where users wager on whether a market price goes up or down, with Moon as the counterparty to every bet, run by Moon International Limited.
Key facts
| Item | What Moon's documents say | Source |
|---|---|---|
| Operator | Moon International Limited | Moon terms |
| License | Valid on Anjouan register | Anjouan licence register |
| Counterparty | Moon, as the House | Moon terms |
| Withdrawals | 2FA step applies once set up | Moon help: two factor authentication |
| Restricted countries | Listed in Moon's terms | Moon terms §3.2 |
| 2FA method | Authenticator app | Moon help: security features on |
| Passkeys | Supported | Moon help: security features on |
| 2FA recovery | Email from linked address | Moon help: lost two factor |
| Custody | Not a licensed custodian | Moon terms |
Code ACES: rakeback for affiliate sign-ups.
Moon's help center says accounts opened through an affiliate normally get rakeback switched on: 3.5% of the fees you pay comes back.
Does Moon.com have 2FA?
Yes, Moon.com offers two-factor authentication. Two-factor authentication, or 2FA, adds a second check to the login on top of the password. Moon's help center describes it as an added security layer that helps stop unwanted or illegal entry into a Moon.com account. The feature sits under its own heading in Moon's security features article.
Moon's help center explains the idea with a comparison. A normal account login needs only a username and a password. With 2FA turned on, the login gains one more step: a randomized code from a mobile device that you own and have linked to the account. Someone who learns your password still needs that code to complete that step. Moon presents the feature as protection beyond the plain password login.
Moon's 2FA runs through an authenticator app. An authenticator app is a phone program that produces short-lived login codes for the accounts you link to it. Moon's security features article names this app-based method as the way it supports 2FA. The same article says that, once 2FA is on, you must enter a time-sensitive code from the app when you perform certain actions. A time-sensitive code is valid only for a short window.
Moon's help center strongly recommends that every account turns on 2FA. The advice sits in the general security features article, which also covers passkeys and automatic logout after a password reset. The same article opens a list of the things that 2FA helps to protect once a user enables it. Moon frames 2FA as a recommendation in that article. Each account holder switches it on from the Security page of the account settings.
Sources: Moon help: two factor authentication, Moon help: security features on (retrieved October 18, 2026)
How do you set up 2FA on Moon.com?
You set up 2FA on Moon.com by installing an authenticator app and linking it on the account's Security page. Moon's help center names Authy as its recommended app and Google Authenticator as the alternative. You link the app either by scanning a QR code or by copying a setup string into it.
The first step happens on your phone or another device you choose. Moon's 2FA article says you must install either Authy or Google Authenticator before the setup can begin. Authy carries the label 'recommended' in that article. Google Authenticator is the only other app the article names. Once linked, the chosen app produces the time-sensitive codes that Moon asks for when you perform certain actions on the account.
The second step happens inside your Moon.com account. Moon's help center directs you to the Account section and then to the Security page. That page shows a QR code and a text string for the link. A QR code is a square barcode that a phone camera can read. You can scan the code with the authenticator app, or you can copy the string into the app by hand. Either route links the device to the Moon.com account.
After setup, the linked app joins certain account actions. Moon's security features article says that, with 2FA on, you must type a time-sensitive code from the authenticator app when you carry out those actions. The 2FA article describes the code as randomized and as coming from a linked mobile device that you own. The security features article lists 2FA under its own heading, beside passkeys and the password reset rule.
Sources: Moon help: two factor authentication, Moon help: security features on (retrieved October 18, 2026)
Code ACES: rakeback for affiliate sign-ups.
Does Moon.com 2FA protect withdrawals?
Yes, Moon.com extends 2FA to withdrawals once you set it up. Moon's 2FA article says the extra security step also covers withdrawals and any other method you can use to send funds out. The article says the main purpose of that step is your own protection.
Withdrawals matter for account security because they move money out of the account. Moon's 2FA article treats them as a protected action alongside login. With 2FA active, a withdrawal request calls for the app code as an added step. The article words the scope broadly: any protocol you can use to send funds falls under the extra step. Withdrawals are the example it names first.
Moon's security features article makes a similar point in its own words. It says that, once a user enables 2FA, the feature helps protect a set of account functions, and the article then lists them. It also says the user must enter a time-sensitive code from the authenticator app when performing certain actions. The separate 2FA article names withdrawals directly as one of the protected actions.
Moon's terms also set out who carries the risk for account activity. The terms make you solely responsible for all activity under your account, whether or not you authorized it. The same clause covers the confidentiality of your login credentials, passwords and two-factor devices. A withdrawal requested from your account falls under that wording, since it is account activity. A separate Moon Legit page covers how Moon.com withdrawals work in detail.
Sources: Moon help: two factor authentication, Moon help: security features on, Moon terms (retrieved October 18, 2026)
Does Moon.com support passkeys?
Yes, Moon.com supports passkey login. A passkey is a login method that uses a unique code generated for you and held on your device, in place of a typed password. Moon's help center says it offers passkey sign-in because it puts user safety and security first. The security features article describes passkeys as faster and more secure for login.
Moon's passkey article lists several claimed benefits. According to the article, a passkey randomly generates a unique code instead of relying on a password built from letters, numbers and symbols. The article also states that a passkey cannot be guessed or cracked. Another listed benefit is that you no longer need to remember a separate password for each site. Moon's security features article adds that passkeys improve both convenience and account security. All of these points are Moon's own descriptions of the method.
Moon's passkey article also addresses fake websites. It says passkeys are designed for use on specific websites, so a passkey will not log you in to a fake or malicious site. Phishing is the trick of luring a user to a copy of a real login page to steal credentials. Moon's article presents the site-bound design as a defense against that kind of fake site. Nobody at Moon Legit has checked this behavior on a live Moon account.
Moon's passkey article says major tech companies developed passkeys, naming Apple, Google and Microsoft along with the Fast Identity Online (FIDO) Alliance. The article calls the passkey an alternative to traditional passwords, email addresses and 2FA login options. Moon's security features article says a passkey lets you skip typing your email and password at sign-in. Your device's built-in security features take the place of those typed details.
Sources: Moon help: security features on, Moon help: passkey info (retrieved October 18, 2026)
How do you set up a passkey on Moon.com?
You set up a Moon.com passkey only after 2FA is active on the account. Moon's passkey article says you must enable two-factor authentication first, and then you can create a passkey. The setup runs through a Manage Passkeys option in the account, according to the same article's step-by-step guide.
The order of steps matters on Moon.com. Moon's passkey article places the 2FA requirement at the start of its setup guide, under a heading on how to set up a passkey at Moon.com. A user who has not turned on 2FA cannot create a passkey under that rule. The guide then tells you to choose the Manage Passkeys option to add one.
Moon's passkey article sets one physical condition for sign-in. The device you use to sign in must be close to the device that holds your passkey. For example, a laptop login needs the phone that holds the passkey nearby, if the passkey lives on that phone. Moon's security features article says passkey sign-in relies on your device's built-in security features instead of a typed email and password.
Moon's help center spreads passkey guidance across separate articles. The security features article gives a short overview and says Moon offers passkeys to make login quicker and safer. The dedicated passkey article holds the setup guide, including the 2FA requirement and the Manage Passkeys step. You can open that dedicated article to follow the exact steps, since it carries the heading on how to set up a passkey at Moon.com.
Sources: Moon help: passkey info, Moon help: security features on (retrieved October 18, 2026)
What happens if you lose your Moon.com 2FA?
If you lose access to your Moon.com 2FA codes, you email Moon's account recovery address from the email linked to your account. Moon's help center gives that address as accountrecovery@moon.com. Moon then starts a 2FA recovery procedure, according to the help center article on lost two-factor authentication.
The sending address is the key condition in Moon's recovery instructions. The help center asks you to write from the email that is linked to your Moon account. Moon names a message from that linked address, sent to the recovery address, as the step that leads it to start the 2FA recovery procedure. The article frames the recovery as a procedure that Moon runs after it receives your message.
Moon's 2FA article says the codes come from a linked mobile device that you own. A user who loses that device, or the authenticator app on it, loses the source of the codes. Moon's help center describes this case as losing access to your 2FA code, and its recovery article deals with it. The authenticator link itself is created on the Security page of the Moon.com account.
Moon's terms put the duty to protect 2FA devices on the account holder. The relevant clause names login credentials, passwords and two-factor authentication devices as items you must keep confidential. The clause also makes you solely responsible for all activity under your account, including activity you did not authorize. Moon's help center, for its part, strongly recommends turning on 2FA for every account.
Sources: Moon help: lost two factor, Moon help: two factor authentication, Moon terms, Moon help: security features on (retrieved October 18, 2026)
How do you reset a Moon.com password?
You reset a Moon.com password through the Forgot Password form, as long as an email is linked to the account. Moon's help center says the form sends a reset email to that linked address. You click the link in the email and set a new password. Accounts opened through Facebook or Google follow a different rule.
Moon's forgotten-password article applies to accounts opened with a username and password. The article walks through the steps for a user who still has access to the linked email. You go to the Moon.com site and click the Log In option. You then choose the Forgot password option. Moon then sends an email to the linked address so that you can change the password.
A social login is a sign-in that reuses an existing Facebook or Google account. Accounts created that way have no Moon.com password to change. Moon's help center says such accounts are not accessed with a password, so the password change option does not apply to them. Users of those accounts need to change the password of the Facebook or Google account itself.
Moon logs out every active session when a password is reset. Moon's security features article lists automatic logout after a password reset as a security measure. All sessions connected to the account end with the reset. You then need to sign in again on every device, including phones and computers. Any unknown device that held an open session loses that session as well.
Sources: Moon help: forgotten password, Moon help: security features on (retrieved October 18, 2026)
Is your money safe with Moon.com?
Moon.com does not promise that customer funds are fully safe in every case. Moon's terms state that Moon.com is not a trust company and not a licensed custodian, meaning a firm licensed to hold assets for others. The same sentence says its fund-separation measures do not guarantee full recovery after insolvency, a security breach or another loss event.
Moon's terms gather money matters under a heading on deposits, withdrawals and custody of funds. The custody sentence names a security breach as one of the loss events that may prevent full recovery. Insolvency, meaning a company can no longer pay its debts, is another named event. The terms describe the fund-separation steps as measures, and they state that these measures carry no guarantee of full recovery.
Moon.com does not hold the assets that users bet on. Moon's terms say the platform offers bets on the price movements of markets only. The platform does not handle the purchase, sale, custody or transfer of any underlying asset. Moon's terms also say the service is not an investment, trading or brokerage service. The same clause says users cannot buy, sell or hold a digital asset on the platform.
Moon International Limited runs Moon.com, according to Moon's terms, and the company is incorporated in the Union of the Comoros. The terms make Moon.com the House, the principal counterparty, or the party on the other side, of every bet. As of October 2026, the Anjouan gaming regulator's public license register lists Moon International Ltd with a valid business-to-consumer license for moon.com. The question of whether Moon.com is legit overall has its own Moon Legit page.
Sources: Moon terms, Anjouan licence register (retrieved October 18, 2026)
What we could not verify about Moon.com
Moon Legit could not verify how Moon.com security works on a live account. Nobody on the site has used a Moon account for this article. Every statement here comes from Moon's documents and a public register: 26 Moon pages retrieved on 2026-10-18, made up of 23 English help-center articles and 3 other moon.com pages.
Several practical points remain untested. Moon Legit did not check how quickly Moon handles a 2FA recovery request sent to the account recovery address. The help center article on lost 2FA access says Moon will start a recovery procedure after your email arrives. Nobody on the site checked how long that procedure takes, what proof it asks for, or how often it succeeds.
The passkey claims are also unverified. Moon's passkey article says a passkey cannot be guessed or cracked. The same article says a passkey will not log you in to a fake or malicious site. Moon Legit has not checked those claims against a live login. Nobody on the site has tried passkey sign-in on any phone, computer or browser, or measured how close the devices must be for the sign-in to work.
Other points also sit outside what Moon Legit could confirm. Nobody checked how the 2FA step behaves during a real withdrawal, how fast support answers, or how Moon handles a hacked account. Moon's documents do not mention a gaming license number. The Anjouan register row is the only license record cited here. Moon Legit has not checked what that license covers.
Sources: Moon help center, Moon help: lost two factor, Moon help: passkey info, Moon help: two factor authentication, Anjouan licence register (retrieved October 18, 2026)
Check it yourself
- Open the security features article in Moon's help center and check that you still see 2FA through an authenticator app listed. Moon help: security features on
- Read Moon's passkey help article and confirm for yourself that you must turn on 2FA before you can create a passkey. Moon help: passkey info
- Open Moon's help article on lost 2FA access and note the recovery address and the rule about writing from your linked email. Moon help: lost two factor
- Search Moon's terms of service for the word custodian and read the full sentence about recovery after a security breach. Moon terms
- Look up Moon International Ltd in the Anjouan gaming regulator's public license register and compare the listed status and expiry date with today's date. Anjouan licence register
Questions
Which authenticator apps work with Moon.com 2FA?
Authy or Google Authenticator. Moon's 2FA setup guide tells you to install one of them, and it marks Authy as the recommended choice.
Sources: Moon help: two factor authentication (retrieved October 18, 2026)
Does Moon.com ask for 2FA on withdrawals?
Yes. Once 2FA is active, Moon's help center says the added check also applies to withdrawals and to any other way of sending funds out.
Sources: Moon help: two factor authentication (retrieved October 18, 2026)
Do I need 2FA before I create a Moon.com passkey?
Yes. Moon's passkey guide makes an enabled 2FA setup the first condition for creating a passkey.
Sources: Moon help: passkey info (retrieved October 18, 2026)
How do I recover lost Moon.com 2FA access?
Email Moon's account recovery team. Write to accountrecovery@moon.com from the address linked to your account, and Moon says it will begin a 2FA recovery procedure.
Sources: Moon help: lost two factor (retrieved October 18, 2026)
Can I reset my Moon.com password if I signed up with Google?
No. Moon's help center says accounts opened with Facebook or Google have no Moon password, and those users change the password of the Google or Facebook account instead.
Sources: Moon help: forgotten password (retrieved October 18, 2026)
Does a Moon.com password reset sign out other devices?
Yes. Moon's security features article says a reset ends every active session tied to the account.
Sources: Moon help: security features on (retrieved October 18, 2026)
Does Moon.com hold the crypto or assets I bet on?
No. Moon's terms say the platform offers bets on market price movements and does not buy, sell, hold or transfer the underlying assets.
Sources: Moon terms (retrieved October 18, 2026)
Can a Moon.com passkey log in to a fake site?
No, per Moon's help center. Moon's passkey article says each passkey is tied to specific websites, so it will not sign you in to a fake or malicious copy.
Sources: Moon help: passkey info (retrieved October 18, 2026)
Code ACES: rakeback for affiliate sign-ups.
Sources
Every number in this article comes from one of these records. Each record quotes the document it came from and the date we retrieved it.
Moon help: two factor authentication
Two-Factor Authentication is an extra layer of security used to help prevent unwanted or illegal access to your Moon.com account.
Where traditionally you can login to an account with simply a username and a password, this extra level of protection lets you add an additional security step to your login process by requesting a randomized code from a linked mobile device you own.
You can then head over to your Account > Security page to link your device with your Moon.com account by either copying the string provided into the 2FA app or simply using the QR Code shown.
To start this process, you’ll need to install either Authy (recommended) or Google Authenticator on your chosen device.
With 2FA set up, the extra security step also applies to withdrawals and other ways of sending funds.
When you have setup 2FA on your account, this also extends the additional security step to withdrawals, and any other protocol which you can use to send funds, primarily for your own protection.
Moon help: security features on
Two-Factor Authentication (2FA)
Moon supports two-factor authentication with an authenticator app.
Moon supports Two-Factor Authentication (2FA) using an authenticator app for an added layer of account security.
With 2FA enabled, you’ll be required to enter a time-sensitive verification code generated by your authenticator app when performing certain actions.
We strongly recommend enabling 2FA on all accounts.
Once enabled, 2FA helps protect:
Automatic Logout After Password Reset
Moon supports passkey login.
Moon supports passkeys for faster and more secure login.
Passkeys help improve both convenience and account security.
Signing in with a passkey allows you to bypass entering your email and password by using your device’s built-in security features, such as:
For additional security, resetting your password will automatically log out all active sessions connected to your account.
After resetting your password, you’ll need to sign in again on all devices.
Moon terms
You are solely responsible for maintaining the confidentiality of your login credentials, passwords, and two-factor authentication devices, and for all activity that occurs under your Account, whether or not authorized by you.
Moon's terms say Moon.com is not a trust company or licensed custodian, and that its fund-separation measures do not guarantee full recovery after insolvency or a security breach.
Moon.com is not a trust company or licensed custodian, and these measures do not guarantee full recovery of funds in the event of insolvency, security breach, or other loss event.
Deposits, Withdrawals and Custody of Funds
The Platform offers Bets on the price movements of Markets only and does not facilitate the purchase, sale, custody, or transfer of any underlying asset.
Moon's terms say the service is not an investment, trading, brokerage or financial advisory service and offers no spot trading.
They are not, and must not be treated as, an investment, trading, brokerage, or financial advisory service, and the Platform does not offer spot trading or any means of buying, selling, or holding a digital asset.
Moon.com is operated by Moon International Limited, incorporated in the Union of the Comoros with registration number 16151 and a registered office in Hamchako, Mutsamudu, Anjouan.
1.1 These Terms of Service ("Terms") constitute a legally binding agreement between you ("User," "Player," "you," or "your") and Moon International Limited, a company incorporated under the laws of the Union of the Comoros with registration number 16151, having its registered office at Hamchako, Mutsamudu, Autonomous Island of Anjouan Union of Comoros (together with its affiliates, "Moon," "Moon.com," the "House," the "Company," "we," "us," or "our").
Moon.com is the principal counterparty (the House) to every bet: it pays winning payouts and keeps losing wagers.
Moon.com acts as the House: the principal counterparty to every Bet placed on the Platform.
Section 3.2 of Moon's terms lists prohibited jurisdictions, and also excludes any sanctioned country and any country that requires a local gambling or financial-services licence that Moon does not hold.
3.2 Prohibited Jurisdictions The Services are not directed at, offered to, or intended for use by any person who is a citizen or resident of, incorporated in, or physically located or established in, Afghanistan, Argentina, Austria, Australia, Belgium, Brazil, Cayman Islands, Colombia, Croatia, Cuba, Curaçao, Czech Republic, Cyprus, Democratic Republic of the Congo, Denmark, France, Germany, Greece, Iran, Iraq, Israel, Italy, Liberia, Libya, Lithuania, Malta, Mexico, Netherlands, North Korea, Ontario, Peru, Poland, Portugal, Serbia, Slovakia, South Africa, South Sudan, Spain, Sudan, Syria, Sweden, United Kingdom, United States, Zimbabwe or any other country or territory that (i) is the target of comprehensive, country-wide sanctions administered by a Sanctions Authority, or (ii) requires a local gambling, gaming, wagering, or financial-services licence or authorisation for the provision of Bets of the kind offered on the Platform, which we do not hold (each, a "Prohibited Jurisdiction"). You must not access or use the Services from a Prohibited Jurisdiction.
Moon help: passkey info
We prioritize the safety and security of all our users at Moon.com which is why we now allow you to sign in using a passkey.
A passkey is a type of login method that enhances online account security while also being easier for you to access.
Rather than using a password with letters, numbers, and symbols, passkeys randomly generate a unique code.
Your passkey can’t be guessed or cracked.
You don’t have to remember unique passwords for each site you use.
Passkeys are designed to be used on specific websites, meaning you won’t be able to log in to a fake or malicious site.
Passkeys are developed by major tech companies such as Apple, Google, and Microsoft, as well as the Fast Identity Online (FIDO) Alliance.
This secure and convenient option offers an alternative to the traditional passwords, email addresses, and 2FA login options.
How to set up a passkey at Moon.com
To create a passkey, you must first enable Two-Factor Authentication (2FA) on your account.
Choose the Manage Passkeys option.
The device you use to sign in must be close to the device that holds your passkey.
Moon help: lost two factor
Users who lose 2FA access contact a dedicated account-recovery address from the email linked to the account.
If you lost access to your 2FA code, please contact us from the email linked to your account to accountrecovery@moon.com , and we will initiate a 2FA recovery procedure.
Moon help: forgotten password
In case your account was opened using a username and password:
If you have simply forgotten your password, but have linked an email to your account, you can easily reset your password through the Forgot Password form.
You will just need to click on the link and set a new password.
Here's another way how to change the password if you have access to the email linked to your Moon account: First, go to the site and click on the Log In option:
Afterward, click on the option Forgot password :
Once you do so, you should receive an email to change your password to the email linked to your account on Moon.
Accounts made using a Facebook/Google account do not have the option to have the password changed as they are not accessed using one.
For such users, changing their Facebook/Google account password is needed.
Anjouan licence register
The public licence register of the Anjouan gaming regulator (anjouangaming.com) lists Moon International Ltd with licence number ALSI-202601063-FI2, status valid, type b2c, issued 2026-01-31, expiry 2027-01-30, for the domain moon.com.
anjouangaming.com licence register: company "Moon International Ltd", licence number ALSI-202601063-FI2, status "valid", type "b2c", issued 2026-01-31, expiry 2027-01-30, domains "moon.com".
Moon help center
None of the 26 Moon pages retrieved on 2026-10-18 (23 English help-centre articles and 3 other moon.com pages) mention a gaming licence number.