[Reflection] REMEMBER: KYC gets people kidnapped!

[Forsyth Jones]

I'd like to share two reflective articles/posts on the risks and obstacles associated with mandatory KYC.. Here's the text from Unstoppable Wallet on the subject below:

Is there any way to solve the problem of mandatory KYC without exposing users' data to risks?

REMEMBER: KYC gets people kidnapped! 

Not metaphorically. Literally. 

Every crypto kidnapping you've read about - the wrench attacks, the abducted founders' kids, the millionaires tortured in rented villas - started the same way: 

a KYC database leak (or similar)!   

You didn't give that information to criminals. You gave it to a compliant, regulated platform.

KYC has never caught the kidnappers. It recruited their targets.

The most dangerous thing in crypto is a spreadsheet with your name and address on it. 

There is exactly one defense: don't be on the list.

No account. No selfie. No proof of address. 

Crypto should be held in a wallet that doesn't know who you and doesn't ask for your ID to trade assets. 

We built that wallet. No accounts, no email, no tracking, no KYC. 

The empty database is the only one that can't be leaked!

The other article below of rabbit.io cites the costs and obstacles of KYC processes (which reach $200bi per year) and how KYC harms companies and users more than it brings in real benefits. The article highlights that the costs of the entire KYC arrangement are unfairly distributed and that companies pay for a function that is the state's responsibility, while users are forced to go through KYC, risking their personal data IDs for a possible leak or flash kidnapping. Meanwhile, criminals always find ways to bypass the verification by falsifying data or even leaking KYC databases that the state swore would be effective in protecting the parties involved

Mandatory state KYC is an evil to be combated, as it violates all aspects of our privacy, turning any and all users into potential criminals. KYC is a means of proving your innocence, it's a method where the goods one pay for the actions of the fraudsters.

I'm not against private rules established by a company, I'm against the mandatory KYC that the state swears to protect (but doesn't commit to in cases of data leaks or kidnappings resulting from these database leaks).

src: https://rabbit.io/blog/how-kyc-harms-business-and-violates-consumer-rights

[_act_]

What I noticed on this forum is that many people have gone for the KYC way which are the centralized exchanges, but which is very dangerous if the data get leaked to the bad hands. They use it for P2P.

Some people do not know that their decision to buy Ledger Nano directly from the company can lead to bad people knowing that they have bitcoin and they know their homes

Some of the wrench attack is because of KYC, but not all.

KYC is extremely dangerous till today.

[EluguHcman]

Is there any way to solve the problem of mandatory KYC without exposing users' data to risks?

KYC on its own first signifies personal identification and once it is uploaded on any public or third parties server, then the datas privacy should be automatically at risk to be exposed.
Perhaps it should be wondered why a platform would even make the KYC mandatory which means they want to have the access to your datas so that they can easily trap you at any given time with it.

Broadly, whatever systems that enrolls on KYC does not mean privacy for the users else, it serves as your signature in the platform once your KYC is there required.
The organization might not also sell your datas but can be used be hold and used against you at their own interests.

[Odohu]

What I noticed on this forum is that many people have gone for the KYC way which are the centralized exchanges, but which is very dangerous if the data get leaked to the bad hands. They use it for P2P.

Are there really competitive alternatives? The crackdown on privacy infrastructures such as mixers and even privacy coins  renders a lot of people helpless especially people who do not have deep knowledge of how to navigate the process of properly using Bitcoin for everyday needs without KYC. And considering that not everything can be bought with Bitcoin in some countries, one still need to convert to fiat which is where the CEX becomes a necessity as DEX that offers P2P are not popular. 

We will help more people if we give detail process of properly using Bitcoin without performing KYC, this way people will naturally avoid KYC because no one enjoys the tedious KYC processes. 

What I do is hold my coins in my private wallet and only send the part I want to convert to fiat for my regular needs to CEX. Sometimes I use instant swap exchanges to avoid sending directly from my wallet where I have good stash of my coins.

[Alvin_talk]

The government should realise  that the primary purpose for the introduction of KYC has back fired. KYC is a potential death sentence IMO. Hackers succeeds in hacking a company's data base and impersonate data and information with the primary aim of carrying out illicit activities with it. This results to many false positives when investigating such crime; the hacker gets away with the crime while the customer whose information was impersonated now face the penalty, so sad to see many innocent people face this kind of challenges all because the government wishes to monitor all our daily activities and transactions while claiming to combat financial crime. They should also understand that privacy is not all about having something to hide, rather it is mostly about reducing unnecessary risk associated with KYC compliance because the more companies are in possession of your sensitive data, the higher the chances of your identity being hacked and impersonated by hoodlums.

But then again, it is a painful realisation that going against these crazy government policies is really challenging. Though their are ways around it when it comes to Bitcoin but most companies and civil service job do not pay in Bitcoin, they pay with fiat, so how do we go about this?  Really challenging time for privacy lovers I must say.

[Darker45]

Quite frankly, to a certain extent, KYC may be necessary. That's to be fair with the government and law enforcing agencies. But to require every single user to go through KYC is overdoing it. It's simply too much. That's incompetence, laziness. That's already betrayal of the very purpose of the process.

KYC is supposed to be implemented to make people safe and their properties protected, among others. The blanket implementation of KYC, on the contrary, is doing the exact opposite--putting lives and properties in danger.

[m2017]

The other article below of rabbit.io cites the costs and obstacles of KYC processes (which reach $200bi per year)

And they also claim bitcoin "expensive" because of energy consumption. Look at these figures: they could be used for something beneficial to humanity, but instead are used for harm.

and how KYC harms companies and users more than it brings in real benefits.

Companies and users have never been on the list of those who should benefit from KYC.

The article highlights that the costs of the entire KYC arrangement are unfairly distributed and that companies pay for a function that is the state's responsibility, while users are forced to go through KYC, risking their personal data IDs for a possible leak or flash kidnapping.

Here, you can see who the real beneficiary is. Notice how elegantly everything is arranged: some pay for surveillance of others, but the benefits accrue to completely different people.

Meanwhile, criminals always find ways to bypass the verification by falsifying data or even leaking KYC databases that the state swore would be effective in protecting the parties involved

Because the state is incapable of protecting itself from itself. There are many cases in the world (and how many remain hidden?) where government employees have turned out to be criminals.

Mandatory state KYC is an evil to be combated, as it violates all aspects of our privacy, turning any and all users into potential criminals. KYC is a means of proving your innocence, it's a method where the goods one pay for the actions of the fraudsters.

How are you prepared to combat KYCs? For example, in a totalitarian state, where KYCs are directly imposed through legislation.

I'm not against private rules established by a company, I'm against the mandatory KYC that the state swears to protect (but doesn't commit to in cases of data leaks or kidnappings resulting from these database leaks).

Data leaks aren't the government's headache. It will shift this responsibility to companies so that they ensure this and, in the event of a leak, are held accountable. The government's "hands" can't be tainted.

[tbct_mt2]

I'd like to share two reflective articles/posts on the risks and obstacles associated with mandatory KYC.. Here's the text from Unstoppable Wallet on the subject below:

Is there any way to solve the problem of mandatory KYC without exposing users' data to risks?

I honestly have never thought about this even I know risk of AML, KYC as well as data breaches. Reading what you shared, I think it is still a possibility but people if already did KYC, they can not do anything else to get their document files back, erase them entirely on the Internet, and they only can hope that worst things won't come.

At least at the time they realize about such risk, they can change their practice, no longer feel easily to use centralized exchanges, complete KYC there. They must to generally leave a strong private life, it's a prevention against any attacks. If they only say KYC is bad, they avoid KYC while in life they noisily tell everyone that they are Bitcoiners, it's non sense.

2026 Bitcoin privacy guide.
Protect your privacy.
How to protect your bitcoin from $5 wrench attacks.
Bitcoiners guide to organized crime.

[Luzin]

If all KYC requesters (institutions/agencies) are able to keep the documents we provide confidential, this really shouldn't be a problem. The documents would be securely stored with no leaks. Unfortunately, even world-class institutions can't maintain this situation. Even some employees of the requesting institution are irresponsible. They exploit important documents for personal gain. We need to fix the system and the mindset of those providing these obligations. Because I understand that KYC is sometimes urgently needed and can't be replaced, but the security model and some people make us disappointed due to leaks of our private data.

IMO CMIIW

[MusaMohamed]

Data leaks aren't the government's headache. It will shift this responsibility to companies so that they ensure this and, in the event of a leak, are held accountable. The government's "hands" can't be tainted.

Governments gather data from citizens and they can leak, sell those data too but of course in different nations with different democracy levels and power control as well as power of voice from citizens and whether human rights are respected or not, governments will act accordingly. It's only in general they don't mind about citizens, and only have to do that if there is democracy, and separation of powers, government hands will "not be tainted" until the fact is proven.

Centralized exchanges have their tools and definitions to use for marking users' coins as tainted or not. They can hire on chain analysis companies to do that too.
Bitcoin Q&A: Blacklists, Taint, and Wallet Fingerprinting.

[Rustam Meraj]

One side that no one ever considers in KYC discussion is kidnapping angle. While everyone is talking about privacy in idea terms, real people have been hurt as their wealth was shown by exchange databases. That is no longer a guessed threat. ​$200 billion compliance cost figure is nuts, too, companies are essentially paying out for service function that they are asking government to provide, and they get no blame if leaks occur. It is required by state and state does not accept blame for results. ​The “empty database can not be leaked” argument is pretty true I suppose. There is not any data to be used as weapon if the data does not exist. They are no longer just an option, and no KYC self custody wallets are becoming safer choice.

[Hatchy]

The most dangerous thing in crypto is a spreadsheet with your name and address on it.  
[

A good number of investors today don't really care about protecting their kyc data, they do not even know the dangers thats involved with sharing their kyc information to any sites. Just like its said there, a spreadsheet with your name, it might sound funny but that spreadsheet hold more information than you can imagine. You are not only endangering your life, but that of your family members. Last year was the peak of it, where we saw many stories of crypto kidnapping and murder, but how many people actually learns?

What I noticed on this forum is that many people have gone for the KYC way which are the centralized exchanges, but which is very dangerous if the data get leaked to the bad hands. They use it for P2P.

The truth is that P2P is one major driver for kyc. Then we had alot of exchanges that don't require you go through kyc to carryout any transactions and thus had many merchants which would offer your local currency. But not they've all moved to CEX. You can barely find a good DEX that offers alot of local currency for P2P.

[aoluain]

What I noticed on this forum is that many people have gone for the KYC way which are the centralized exchanges, but which is very dangerous if the data get leaked to the bad hands. They use it for P2P.

Some people do not know that their decision to buy Ledger Nano directly from the company can lead to bad people knowing that they have bitcoin and they know their homes

I would like to think that more and more people are becoming aware that centralised platforms
are dangerous for their own security and that they are moving to KYC FREE platforms.

When I bought a Ledger many years ago I didnt realise it was a centralised system and havent
used it shortly after that, same with exchanges that ask for KYC or AML.

Those platforms asking for our personal details is the same reason why we advise not to store
Bitcoin on them. Once you hand over your personal details (and coins) you have no control over
their security practices.

[SeriouslyGiveaway]

A good number of investors today don't really care about protecting their kyc data, they do not even know the dangers thats involved with sharing their kyc information to any sites.

It's more easily for investors to protect their KYC than traders because with investors, they need to do more simpler things: buy and hold. If they choose no KYC exchanges to buy bitcoins, then withdraw it to their non custodial wallets, it's well in privacy for them.

With traders, they have more risk, as they need to store coins on centralized exchanges for active trading, and there is another risk of losing their coins by any accident with CEX.

The truth is that P2P is one major driver for kyc. Then we had alot of exchanges that don't require you go through kyc to carryout any transactions and thus had many merchants which would offer your local currency. But not they've all moved to CEX. You can barely find a good DEX that offers alot of local currency for P2P.

P2P can contain privacy issues if those platforms are not actually decentralized, and if the payment method is bank transfer. At least your trade partner will know information about your bank transfer while you have no way to know who are behind those trade partner accounts. Governments can create accounts, use them as honeypots and get information of citizens who have "illegal" P2P trades if it is not allowed in your nation.

No KYC exchanges
https://kycnot.me/?categories=exchange&max-kyc=0

[Karl_3000]

It's more easily for investors to protect their KYC than traders because with investors, they need to do more simpler things: buy and hold. If they choose no KYC exchanges to buy bitcoins, then withdraw it to their non custodial wallets, it's well in privacy for them.

With traders, they have more risk, as they need to store coins on centralized exchanges for active trading, and there is another risk of losing their coins by any accident with CEX.

This is a very good reason I prefer to just hold. Traders that like their coins should send their coins to a self-custody wallet when they finish trading daily. But some exchanges have protection funds already which can be helpful during hack.

P2P can contain privacy issues if those platforms are not actually decentralized, and if the payment method is bank transfer. At least your trade partner will know information about your bank transfer while you have no way to know who are behind those trade partner accounts. Governments can create accounts, use them as honeypots and get information of citizens who have "illegal" P2P trades if it is not allowed in your nation.

No KYC exchanges
https://kycnot.me/?categories=exchange&max-kyc=0

Decentralized exchanges are the best for privacy but your reason centralized exchanges are risky is not valid at all. On decentralized exchanges, people and government can have ads and be used to also know your bank accounts so far you will give them the account to transfer money there or which is the bank account the government received money from.

[BitBrainers]

I've been involved enough in compliance departments under gold standard regulators to tell you this: you didn't give your data to one company. You gave it to an ecosystem. Any node in that chain is a breach point.

The breach rarely looks like a hacker. It looks like access and motive. Both were always there.

Every brokerage CEO's real nightmare was never the regulator. It was the client database leaving the building on a USB stick. That list is the business. Names, balances, locations. In crypto, that same list becomes a target list for people with very different intentions.

The kidnappings are not surprising. They will get worse. The wealth is more visible, the databases are bigger, and the people with access are the same.

Every fear you had about KYC is real. And worse.

As @unstoppablebyhs put it on X: the empty database is the only one that can't be leaked.

[Zlantann]

I'm not against private rules established by a company, I'm against the mandatory KYC that the state swears to protect (but doesn't commit to in cases of data leaks or kidnappings resulting from these database leaks).

src: https://rabbit.io/blog/how-kyc-harms-business-and-violates-consumer-rights

My bank account got blocked, and I went to the bank to notify them. I was told that I needed to upgrade my data to include my house address. I was troubled because I am in deep shit if they have access to my financial transactions and also know where I live. There have been reports of bankers giving out personal information of customers to criminals like kidnappers.

Using crypto was supposed to protect us from these financial institutions. I will avoid any CEX that asks for a house address.

The truth is, we try to be the good guys by providing KYC, but it is getting us into trouble. Meanwhile, the bad guys devise means to bypass KYC verification. When you try to protect your privacy, the state labels you as a rebel, and sometimes punishment follows. The solution would be an increase in Bitcoin adoption, where P2P transactions are popular.

[CryptoYar]

[...]

[...]

Ledger data breach of 2020 certainly made this clear. Customer names, addresses and phone numbers became known to everyone, just what any hacker would need to know you own Bitcoins and where to find you. Common wrong belief among Bitcoin users is that issues of physical security of hardware wallet purchase are not considered when purchasing a hardware wallet.
The overall identity check thing is correct. When you hand over identification to an exchange, you make record of yourself owning Bitcoin and it is linked with your real name and stored on servers you have no control over. You are trusting their practices for unlimited period of time, no matter what they promise to protect you with.
There are no identity check options for purchasing and storing. If you are looking for financial privacy, the extra work is worth it. Once your identity is linked to your coins that connection does not disappear.

[YellowSwap]

What I noticed on this forum is that many people have gone for the KYC way which are the centralized exchanges, but which is very dangerous if the data get leaked to the bad hands. They use it for P2P.

Some people do not know that their decision to buy Ledger Nano directly from the company can lead to bad people knowing that they have bitcoin and they know their homes

Some of the wrench attack is because of KYC, but not all.

KYC is extremely dangerous till today.

I like how things are happening this way, this is literally the only way to make the world knows that KYC speaks danger, sometimes to prove that something is right the world have to taste a bit of it's bad side first.

I feel safe since I am from Africa and I am passing KYC verification on exchanges that are running in Europe or others, I don't think any criminal will board a plan to come and look for me in a hunting ground like Africa.

They will put themselves in a far greater danger that they know, haha, but anyways I get the message _act, I believe that KYC verification brings more problem than solution, some exchanges worker can even pull this off from the inside.

[rat03gopoh]

The other article below of rabbit.io cites the costs and obstacles of KYC processes (which reach $200bi per year) and how KYC harms companies and users more than it brings in real benefits.

And what do users get for the $200 billion cost per year? Fund recovery is increasingly difficult and often misdirected. It's ironic.
I wouldn't call it an additional layer of compliance, but rather another annoying bureaucratic layer. I wonder if there are any statistics that provide data on crime prevention thanks to KYC.