What happens when your identity is stolen -- real story || Avoid CEXs!

[GazetaBitcoin]

What you will read below is the real story of a Romanian citizen which happens to live a nightmare everyday, after his identity was stolen. It didn't happen after using a centralized exchange, yet he lives the same thing as one which had his identity stolen by hackers from a centralized exchange or from any other source. This article is a cautionary tale. All those using centralized exchanges must be aware that at any time the exchange can be hacked and risk not just their funds but also face the risk that hackers steal also their personal information and use it against them. Or, even worst, hackers sell their personal information on dark web where criminals buy it with 1-5$ and they can always make a visit to those people...


A recent article from Romanian newspaper Adevărul tells the story of C.T. (36 years old), living in Germany for the last 8 years.

While his main job is to be a driver in Mannheim, C.T. also acted as a vlogger and it seems that thieves of personal information became interested about his name.

The nightmare started in 2018 when he was driving home (towards his home from Romania) and he was arrested in Hungary after he stopped for a Police casual check, being informed that he was part of a network of thieves which were stealing cars. Apparently, his name appeared in Police database with a theft of a 22.000 EUR car. Obviously, the man protested and tried to explain he is innocent. He was told to contact the Tribunal of a city where he was never before.

Months later, while being in Germany, Romanian Police contacted him for informing him that his personal information was stolen. They said they knew the guy but they needed C.T. to come to them for some declarations. The man went to Romanian Police and, excepting the paperwork, they also got his fingerprints, took photos of him, measured him and had him go through a lie-detector test.

Since then, somehow, his problem became worst. Each time he was driving to Romania he was stopped at Customs Office. Each time he felt humiliated as they were looking at him like at a criminal. Each time he had to repeat the entire story, because he appeared as international fugitive.

After a while Austrian Police informed him that the thief which stole his personal information was finally caught and convicted.

Yet in February this year he had another incident with German Police. One day, at 6am, when he was at work, a neighbor told him that Police is at his door, looking to arrest him, because he stole a 38.000 EUR boat. C.T. believed that his personal information was now used by another thief. This new criminal investigation was conducted by Augsburg Police. He went there and he observed they had a dossier with all his data, but with a photo of someone else. They asked him where he was during a certain day of 2022 and he proved them with his phone, with his Google account, by accessing his location history.

Lawyers suggested him to change his name, yet the man does not want to make this move. At the end of article he describes how afraid he is of finding out that a bank loan was made on his name or of getting arrested wherever he goes.


All of the above is an impressive story. It does not really matter how those thieves managed to obtain this individual's personal information. What matters is that such theft can always occur if you are using centralized exchanges. Hackers may steal your data. Even the exchanges may sell your data, as it was the case of Coinbase. So we're not talking about a shady exchange from a third world country, but about one of biggest exchanges worldwide. Yet this exchange was caught selling customers' data.

So are you still willing to use CEXs?

Topic is self-moderated for avoiding spam.


Translations (in chronological order):

• Română: Ce se întâmplă când îți este furată identitatea – caz real || Evitați CEX-urile!, translation by GazetaBitcoin
• German: Was passiert wenn die Identität gestohlen wird, wahre Geschichte | Vermeide CEX!, translation by AHOYBRAUSE
• Filipino: Ano ang mangyayari kapag ang iyong pagkakakilanlan ay ninakaw -- totoong kwento, translation by jeraldskie11
• Russian: Чтo бyдeт,кoгдa вaшa "личнocть yкpaдeнa"?, translation by FP91G
• Pidgin: Real Stori--Watin you go see wen person theft ur identity ||Comot hand from CEXs oh, translation by MeCsc
• Polish: Co stanie się, gdy Twoja tożsamość zostanie skradziona - historia prawdziwa ..., translation by cygan
• Bengali: কি ঘটে যখন আপনার ব্যক্তিগত পরিচয় চুরি হয়?, translation by DYING_S0UL
• French: Que se passe-t-il lorsque votre identité est volée ? || Évitez les CEX, translation by iwantmyhomepaidwithbtc2
• Urdu: جب آپ کی شناخت چوری ہو جاتی ہے تو کیا ہوتا ہے۔, translation by ThemePen
• Indonesian: Apa yang terjadi jika identitasmu dicuri -- kisah nyata || Hindari CEX!, translation by Pandorak

[1714692118]

1714692118

[1714692118]

1714692118

[1714692118]

1714692118

[1714692118]

1714692118

[1714692118]

1714692118

[1714692118]

1714692118

[un_rank]

Data is invaluable and is our digital representation, which can be used with malicious intent as well.

People fail to see the danger of exposing their data, maybe cause they do not see themselves as celebrities and are not public figures, so their identity is mostly unremarkable. But this does not matter to hackers at all and anyone can be a victim.

To put it into perspective, when asked to prove our identity on an exchange we present certain documents, those documents if in the hands of the wrong person can be used to represent us as well and we would panic if an important physical ID is lost and hurry to get it repaced, neither would we leave it in possession of anyone, but can freely give out the digital version.

- Jay -

[Dr.Bitcoin_Strange]

Generally, there are other possible means by which an individual's personal information can be stolen. There are some phishing sites that most individuals log on to that get their personal data compromised, and some uncommon mistakes could also lead to identity compromise. Similarly to the story of this Romanian, a guy in my country got caught on CCTV while he stole a paper from the trash can in the bank. The paper he stole contained the bank verification numbers of that bank's customers. I can't remember the whole story, but this guy was arrested by the police, and he confessed that he usually goes to different banks and tries to steal people's BVN, then sells it to a guy who has a site that enables them to get every piece of information about the person who has the bank verification number, and they use the information to carry out fraudulent activities.

[Dunamisx]

Using the centralized exchanges is as worse as placing your entire life private information on the internet for anyone to use against you, if dome people might have known the repercussions or risk associated in using them some would have avoided them long ago, aside the fact that centralized exchange are not secured enough because they can share ones private data provided through KYC to a third party, they can be hacked, they can also serve various vulnerabilities which includes the promotion of shitcoins on their exchange and they convinced people to invest more on alts they promoted.

[serjent05]

As much as possible I wanted to avoid using CEX but the problem lies on where I can exchange my cryptocurrency since not many of them are listed on DEX'es and/or don't have liquidity but only on centralized exchanges.  Aside from that database leak is not only on CEX but also on the poor security of the government websites like the one in my country where the official site of the list of voters where breached

I bet the person's identity information stated by @OP was leaked by other sites and not by centralized exchanges.  Though I agree that some exchanges such as Coinbase which is rumored to be selling data to a third-party company.  This article[1] stated that Coinbase is selling geo-location information to ICE.


[1] https://www.coindesk.com/business/2022/06/29/coinbase-is-reportedly-selling-geo-location-data-to-ice/

[Pokapoka124]

It annoys me when gambling sites and online casinos request mandatory kyc from users. As bitcoiners we can easily point centralized exchanges as the problem but also note in the story our character used his google tracker as alibi. It shows how centralized the world today really is. You do not own your data in today’s world, it’s always in the control of a third party whom you have shared that data with. The banks, big tech and government agencies own your data and can do with it as they please. I hope people can learn from this sorry and be more concerned about data ownership and data protection.

[dzungmobile]

From Facebook to Google gates and this story as well as other stories, KYC is extremely dangerous - and useless

[1miau]

Wooowww, really sounds scary as shit.  

Is it known where his data and which data was stolen?

I can believe once such data is gathered in DarkNet spaces and combined from other hacks / leaks, it might get pretty dangerous for people which data got leaked. KYC on centralized exchanges is very risky and we should avoid it.
But not limited to KYC, look at how many people were affected from Ledger's hack and received scary letters in their (physical) mailbox at home. And Ledger downplayed these hacks...

So we're not talking about a shady exchange from a third world country, but about one of biggest exchanges worldwide.

Most often, it's about to save costs. Shady, insecure and often fraudulent verification processes are offered. Computer science experts have warned about it multiple times but nobody listens...
In Germany, many banks are even deliberately ignoring BaFin (German SEC) standards and are getting away with it...

And, as you've said, some centralized exchanged are deliberately selling data to make more profits. Such exchanges engaging in such criminal busines, endangering customers, should face massive legal consequences.

A recent article from Romanian newspaper Adevărul tells the story of C.T. (36 years old), living in Germany for the last 8 years.

While his main job is to be a driver in Mannheim, C.T. also acted as a vlogger and it seems that thieves of personal information became interested about his name.

Anyways, Mannheim has a veery nice park. 

From Facebook to Google gates and this story as well as other stories, KYC is extremely dangerous - and useless

+1

[Iranus]

As much as possible I wanted to avoid using CEX but the problem lies on where I can exchange my cryptocurrency since not many of them are listed on DEX'es and/or don't have liquidity but only on centralized exchanges.  Aside from that database leak is not only on CEX but also on the poor security of the government websites like the one in my country where the official site of the list of voters where breached

I bet the person's identity information stated by @OP was leaked by other sites and not by centralized exchanges.  Though I agree that some exchanges such as Coinbase which is rumored to be selling data to a third-party company.  This article[1] stated that Coinbase is selling geo-location information to ICE.


[1] https://www.coindesk.com/business/2022/06/29/coinbase-is-reportedly-selling-geo-location-data-to-ice/

I limit using CEX to insure my assets. I would like to ask everyone here who doesn't have a bank account, who doesn't have a citizen ID?...and many services in daily life we have to use citizen ID. If we all did it, it means our identity was exposed or sold before we used the centralized exchange. Don't blame CEX when our identity is sold, but many other cases. Apart from bitcoin, everything in this world is centralized, and we are using them every day, from our place of residence, school, and work... they all hold our identity. Our identities have long since ceased to be private.

[LDL]

The biggest crypto heist in the bitcoin history...

1. Mt.Gox
2. Linode
3. BitFloor
4. Bitfinex
5. Bitgrail
6. Coincheck
7. Kucoin
8. PancakeBunny
9. Poly Network
10. Cream Finance
11. BadgerDAO
12. Bitmart
13. Wormhole
14. Ronin Network
15. Beanstalk
16. Harmony Bridge
17. FTX

All these exchanges have been hacked at various times and have robbed people of billions of dollars. Not only billions of dollars have been stolen but also the information of various customers has been stolen. To all of you, always be careful when using centralized or decentralized exchanges. Your personal information can be stolen at any time.

Full details here: https://cointelegraph.com/explained/the-biggest-crypto-heists-of-all-time

[GazetaBitcoin]

As much as possible I wanted to avoid using CEX but the problem lies on where I can exchange my cryptocurrency since not many of them are listed on DEX'es and/or don't have liquidity but only on centralized exchanges.

Indeed, not all decentralized exchanges have liquidity. However, you can always search on CoinATMRadar for a cash-in / cash-out crypto ATM in your area. These ATMs are (supposed to be) anonymous, although their fees are not small... As an alternative, you can also try peer-to-peer transfers.

I bet the person's identity information stated by @OP was leaked by other sites and not by centralized exchanges.

Indeed, the subject of OP did not have any connection with crypto. However, as I wrote also inside OP, this is not the point. The main subject is to understand what you may live once your identity is stolen. Then I explained that such thing may happen if you use centralized exchanges.

Wooowww, really sounds scary as shit.  

Indeed...

Is it known where his data and which data was stolen?

No, this information was not published...

I can believe once such data is gathered in DarkNet spaces and combined from other hacks / leaks, it might get pretty dangerous for people which data got leaked. KYC on centralized exchanges is very risky and we should avoid it.
But not limited to KYC, look at how many people were affected from Ledger's hack and received scary letters in their (physical) mailbox at home. And Ledger downplayed these hacks...

Indeed, my dear 1miau. This is why we have to do everything we can to ensure that our personal information remains personal.

In Germany, many banks are even deliberately ignoring BaFin (German SEC) standards and are getting away with it...

Really? I would not expect something like that from a country like Germany... Wow!

Anyways, Mannheim has a veery nice park.  

Hehe, good to know!

[bittraffic]

The lawyer's suggestion to change his name is the worse idea. Because that would add up again to another suspicion from the police as to why he changed his name.  I think he just has to bring papers every time proving he was cleared of the car and boat theft.

Yep, this could happen to any of us who have submitted all the documents to ICO projects or CEX. Very alarming that if it happens to you in one country, it could also happen to any country you will visit.

[dkbit98]

So are you still willing to use CEXs?

Not really, but I can understand why many people are still using centralized exchanges a lot, maybe when they are exchanging larger amount of money and they want to buy/sell lot of Bitcoins.
I am all for P2P trading and decentralized exchanges like Bisq, but let's be realistic and say that we can't expect everyone to use DEX especially if they are companies or financial institutions.
Identity and documents can be stolen anytime if they are sent for any verification, so I would suggest regular people to stay away from CEX like Coinbase, Binance., etc, or at least be aware of the risks and use them sparingly.

[franky1]

here is the thing
(i am not promoting CEX or denying utility of de-fi. i am being frank and rational about identity theft using observations)

the OP's story is not about identity theft related to a CEX..
the OP admits to this in his first sentance..


here is one thing i have seen happen in the past related to de-fi/localbitcoins(services like craigs list of buyers/sellers with a escrow service included)

when doing private bitcoin-fiat swaps with random strangers.  independently of a central market orderbook

some strangers steal from each other by doing chargeback scams

chargeback scams are where you would buy btc with fiat and then call your bank and claim someone falsely used your account to pay some scammer.. .. thus get a refund on your bank transfer and give the btc seller a red flag. resulting in them having their account closed
(many people had their accounts closed and it gave a bad impression with banks about bitcoin traders)

this then caused many bitcoin sellers to start requesting KYC on these de-fi methods of trading to prove the transactor is the bank account holder to use as evidence that there was no false transfer. thus avoid this drama of accusation

then malicious people using the kyc request ' new norm' experience people had to go through.. started requesting KYC and then selling the data to others on the darknet

and then those identities were used for nefarious purposes

yep
this is why many banks disliked bitcoin traders in the years 2013-16 of localbitcoins
this is why when the kyc stuff started up in 2016+
this is why many users stopped using local bitcoins more recently
this is why localbitcoins closed down even more recently

you will find the 2020 new "de-fi" crap will cycle through the same experience as localbitcoins
scamming for value. KYC to protect traders.. then scamming for identity. then people disliking and losing faith in the latest versions of de-fi

[Sarah Azhari]

Hackers may steal your data. Even the exchanges may sell your data, as it was the case of Coinbase. So we're not talking about a shady exchange from a third world country, but about one of biggest exchanges worldwide. Yet this exchange was caught selling customers' data.

your story worries me, if I already have KYC, what can I do now?, do they really clean up my database KYC if I did cancel my membership or delete my account?. I also do not know how to sue them, because like my experience in past, where the Facebook case "Cambridge Analytic", give my KYC on a third party to a consultant company. Until now I don't know how to sue (1 BTC) Mark Zuckerberg because I've already KYC (taken a picture and sent my ID Card) before.

[franky1]

Hackers may steal your data. Even the exchanges may sell your data, as it was the case of Coinbase. So we're not talking about a shady exchange from a third world country, but about one of biggest exchanges worldwide. Yet this exchange was caught selling customers' data.

your story worries me, if I already have KYC, what can I do now?, do they really clean up my database KYC if I did cancel my membership or delete my account?.

financial data usually needs to be kept on file for upto 6 years(countries vary) due to tax related stuff and other AML / bank secrecy act policies
UK - https://www.gov.uk/guidance/money-laundering-regulations-your-responsibilities#record-keeping-requirements

You must keep your records for five years beginning from:
    the date a business relationship ends
    the date a transaction is completed

US - https://www.fincen.gov/sites/default/files/shared/bsa_quickrefguide.pdf

Keep the record for 5 years from the date of
transaction.

and yes expect exchanges to sell your data. much like expect your bank to sell your data
(banks DEFINITELY sell your data to other commercial businesses if you sign up to accounts that give "cash back offers on purchases" (because thats how they get the cash to give back))

however. be more aware if strangers on de-fi ask for KYC as they are more likely to use your information on dark markets

selling data to other legitimate businesses is less risk then handing id to stranger who can use it on dark markets

[GazetaBitcoin]

Identity and documents can be stolen anytime if they are sent for any verification, so I would suggest regular people to stay away from CEX like Coinbase, Binance., etc, or at least be aware of the risks and use them sparingly.

This is very well said, dkbit98! And I hope that my story will help many users to understand how it really feels to live such drama. I also suggest reading a topic written by 1miau, which is complementary to mine: Why KYC is extremely dangerous – and useless (I believe that Sarah Azhari, quoted below, will be very interested in reading 1miau's topic.)

your story worries me, if I already have KYC, what can I do now?

Well, first of all you should inform the ones having your personal information that they do not have your consent anymore for processing your personal information. And according to GDPR, they should agree to delete the information they have about you. However, GDPR is recognized only in Europe, therefore if you will address to a company from the rest of the world, GDPR will be useless. If they won't agree, you will have to sue them.

do they really clean up my database KYC if I did cancel my membership or delete my account?

It mostly depends on who is "they". If "they" are a honest business, they should delete your personal information upon your request. The problem is that you may never know for sure if they did it... Furthermore, in case you gave your personal information for something which has a financial connection, then your data will be deleted in 3-5 years (if they will ever delete it)...

I also do not know how to sue them, because like my experience in past, where the Facebook case "Cambridge Analytic", give my KYC on a third party to a consultant company. Until now I don't know how to sue (1 BTC) Mark Zuckerberg because I've already KYC (taken a picture and sent my ID Card) before.

You have to contact a lawyer from your country. I don't know your country laws, nor who you want to sue... But best advice is this: (1) contact the ones having your personal information and let them know that you don't consent to have your data anymore; (2) wait for their answer; (3) if the answer is positive, you can only hope they will actually delete your data; (4) if their answer is negative or if they don't answer at all, then contact a lawyer. You may never know what may happen with your data. And, as you saw in the story from OP, an identity theft is a living hell...

If you wish, you can keep us posted with what progress you made.

[mendace]

I think it's not so much how willing you are to use a cex but rather how strong your password is whenever you sign up for services that use KYC, and obviously how serious the service you're using is.
Breaking a password is not very difficult, simply giving an example a social network like Facebook will ask for a password with certain requirements (min. 8 characters, must contain a capital letter, at least one number and a special character) now think how much it has narrowed the field of research. A hacker can do a brute force attack and a dictionary already with that information and trust me it often takes 1 week to hack.  So the first source of security is yourself.

[D ltr]

from this case it is really very dangerous to do KYC on an exchange, anything can happen beyond our control, very terrible,
but how can we trade if we don't do kyc on the exchange, even though that's the main part of being able to trade and withdraw funds.
hope that in the future all exchanges can be responsible for existing data

[Woodie]

This is one hell of a nightmare, wouldn't be surprised if he quit his driving job  with all the humiliation he keeps getting But why didn't he use his lawyers to sue these convicts for identity theft and all trumour suffered because of  their actions..?

Btw if I were him,would have gone with changing identity, the damage is to much

All those using centralized exchanges must be aware that at any time the exchange can be hacked and risk not just their funds but also face the risk that hackers steal also their personal information and use it against them.

The digital world is a whole different place which needs everyone of us taking extra precautions to protect our data, btw in such scenarios, does the exchange protect itself from being sued for misuse of data or failure to secure this data using its terms and conditions ?? ***Kind of reminds me of Facebook***