Scammers will ask you to turn these off
These controls exist to slow down a withdrawal that is not really yours. If another person has asked you to switch them off, to avoid setting them up, or to raise your own limit so a payment will go through, that is a scam. You may also have been told to tell us it was your own decision, which is the clearest sign of all.
You will not be in trouble for telling us, and nobody here will judge you for asking. Please contact our support team before you change anything.
More on how these scams work: Bitcoin scam awareness.
Bitaroo lets you place two restrictions on your own account, so that even someone who has your password and your device cannot move funds freely. Both are optional, both are off until you set them up, and both are found under Account > Security > Restrict withdrawals on the website, or Settings > Security > Restrict Withdrawals in Bitaroo Express.
The two controls are:
- Approved IP addresses. Withdrawals are only allowed from internet connections you have approved.
- 24 hour withdrawal limits. A cap on how much can be withdrawn from your account in any rolling 24 hours, set separately for bitcoin and for Australian dollars.
You can use either one on its own. Setting a limit does not require you to approve an IP address first, and the reverse is also true.
The 48 hour rule, and why it exists
This is the part worth understanding before you set anything up.
Making your account more restrictive takes effect straight away. Making it less restrictive waits 48 hours.
| What you change | When it applies |
|---|---|
| Adding your first IP address | Straight away |
| Adding any IP address after that | In 48 hours |
| Removing one of several addresses | Straight away |
| Removing every approved address | Blocks all withdrawals for 48 hours |
| Lowering a limit, or setting a first one | Straight away |
| Raising a limit, or removing one | In 48 hours |
The reason is simple. Somebody who has taken over your account can reach these settings too. The protection is not that they cannot change them. It is that a change which would help them does not take effect for two days, while a change that locks the account down works immediately. So an attacker cannot open the door, and you can shut it right now.
The same logic explains the row that surprises people most: removing your last approved address blocks withdrawals for 48 hours. Without that, deleting the whole list would be a one click way to switch the protection off.
You are told every time
Every change to these settings sends you an email. That is deliberate, and it is the part that makes the 48 hour window useful: if a change was not made by you, the email is your warning, and two days is enough time to act on it.
If you receive one of these emails and it was not you, change your password immediately and contact our support team.
Before you start
- Two factor authentication is required. Every change here is confirmed with a 2FA code, so 2FA must be switched on before you can set up either control.
- These are your restrictions, not a replacement for ours. Bitaroo's own withdrawal limits and security checks still apply. Where both apply, the lower of the two is used.