Your SIM card could risk your bitcoin.

[Silverstonez]

while I was looking through some posts online I came across a post that says that “Your SIM card can become a bitcoin security risk (even if your wallet is safe)”. So out of curiosity I decided to do more research on it to learn more about it. It’s funny how we focus only on protecting our seed phrase, and not on how phone numbers can become the weakest link for scammers.

Many of us knows that, in this our country Nigeria sim swap fraud has been around for years, and the funny part is most of us think it only affects bank accounts mind you it can also affect those holding bitcoin in Nigeria.

However, it affects more of those people who store or keep their bitcoin investment in a centralized exchange. How does it happen? A a fraudster finds a way to transfer your own phone number to another SIM card and then request for a password reset from your exchange or email account while they receive OTPs from their end.

If your exchange account depends on SMS verification, that can become a serious problem.  So, in order to reduce the risk of losing your bitcoin through this scam method, use an authenticator app instead of SMS, and secure your email account with strong 2FA because many accounts can be recovered using email address.

Warning, be careful who you tell you are holding bitcoin, because sometimes the biggest security risk is not your wallet it’s people knowing you have something worth stealing.

[gracreavix]

Honestly, I never really reasoned it to this extent at all. My mind never went here. I know of sim swap but never did I think it can be used to access your Bitcoin indirectly. Yeah authentication app is good but your are forgetting email address too. That's why I use different mail for different purposes but people are careless to use one mail for everything. That poses a greater risk than you can imagine.

[9ja Amaka]

The essence of two-factor authentication is to avoid scams of this nature. Any Bitcoin user who isn't using 2FA, in Nigeria or elsewhere, lacks wisdom. Using 2FA is common sense. We are not supposed to be told to bind phone numbers, email, and Google Authenticator before any transaction can be done on an exchange account.

In summary, before a scammer attempts to log in to an exchange, the owner is supposed to be notified through email. Most times facial verification is also required when trying to access an account from a different location and device.

[Silverstonez]

In summary, before a scammer attempts to log in to an exchange, the owner is supposed to be notified through email. Most times facial verification is also required when trying to access an account from a different location and device.

If a scammer successfully swaps your phone number to another SIM card there is no way you will receive a notification from your exchange via your phone number if they attempt to access your account.  So, the essence of swapping your phone number to another SIM card is to block your phone from receiving a message when your account is being accessed by another device that has never been used by you to login into your account.

[casey15]

What I find alarming now is the fact that network providers literally sell one phone number to two different people..I know of two people who uses their number for WhatsApp only because the network provider has sold it to someone else so when you try to call them someone else picks..you can only reach them through WhatsApp. Now imagine someone like that has an exchange with an 2FA attached and it requires OTP from an SMS code . Otilor. Eve if the other person doesn't know about the account, once the OTP lands, it will show which company is sending it and the person may try to log in and collect the coins there .. even as we are trying to be careful the network providers are not helping matters

[Hypnotizer]

If a scammer successfully swaps your phone number to another SIM card there is no way you will receive a notification from your exchange via your phone number if they attempt to access your account.  So, the essence of swapping your phone number to another SIM card is to block your phone from receiving a message when your account is being accessed by another device that has never been used by you to login into your account.

Well.. that’s another risk for people who register their centralized exchanges or Wallets with their phone number,  it’s much better to register these stuffs with your email and use 2FA.

Btw this mainly affects people storing their coins with Centralized entities, your Self Custody wallet can never be at risk because of your SIM whatsoever. So if you decided you want to keep your bitcoins on these platform, then you need to take securing the account seriously and block every known possible risk that might lead to your account being compromised.

[SuperBitMan]

You are absolutely right on this, however when your SIM card is stolen or when your phone is stolen the next thing to do is to make sure you don’t allow those that stole your phone to have access to your exchange and even your bank account, all you need to do is to login your bank account or crypto exchange where you have some bitcoin with another phone or system and then disable or replace the stolen phone’s 2FA method or you secure your email account too by changing the password and revoke suspicious sessions, because your email can be used to reset your exchange account just like you have explained.

However the best option is to contact your mobile network provider and block the SIM with this they can’t have any access to your SIM card anymore.

[Nathrixxx]

Many of us knows that, in this our country Nigeria sim swap fraud has been around for years, and the funny part is most of us think it only affects bank accounts mind you it can also affect those holding bitcoin in Nigeria.

Another additional challenges for those that are used to have their financial assets on a centralized platform, which could be a serious problem for them and stand a chance of losing their bitcoin on centralized exchange when their simcard got compromised, anyone can use the user phone number to generate a password reset and the name I want to verify this on the phone number or email as the case may be when the scammer specifically choose to use a verification medium through his phone number.

[Salahmu]

Sharing every information concerning security is very important to always keep people learning about what is happening but however is not easy as you think it might be because a lot of Centralized exchange doesn't support phone number or even use to send any verification from there during log in or withdraw so actually even if somebody has your number they will never be able to have  control over it because email is mostly were verification are sent to and besides how would the person even know the name the owner use on their exchange account through the phone number. Actually there could be other way this will be harmful but through this means.

[Shadiq]

Any means of communication is risky for holding Bitcoin. Especially accounts that are somehow linked to your SIM card. I often receive messages or calls from scammers. Receiving those calls means they are able to send malware to my device. It is not safe to keep Bitcoin on a device that is capable of wireless communication for a long time. This is the only source for hackers or scammers to attack.

If you store Bitcoin on a device that is not connected to the internet and has no means of communication, then an open source wallet is also safe. No matter what kind of measures you take in the case of centralized exchanges, there will be a possibility of losing it. Try to keep the SIM card number used in the exchange and bank account as secret as possible.

[osasshem]

I saw this coming, but never knew how it would be possibly done. I thought the use of NIN for SIM card registration made it linked to that NIN, therefore making the swap without the presence of the actual owner is impossible. I said this because I once had some issues with the SIM card I was using, then the use of NIN has not yet been involved in registration. So, when I went for the to be retrieved, I was told it's not my face that's showing on their system, that made me believe it is not possible to change someone's SIM to another person's.

How I thought the use of SIM card can lead to hacking a crypto related account is using it to filter every crypto registered platform with that same line and find some matching repeated patterns and so on. If the possibility of swapping is that simple, making 2FA, and securely protecting your email account for high security level.

I wonder how long we can keep up with our security in this industry as years goes bye.

[Umulala-alala]

You are absolutely right on this, however when your SIM card is stolen or when your phone is stolen the next thing to do is to make sure you don’t allow those that stole your phone to have access to your exchange and even your bank account, all you need to do is to login your bank account or crypto exchange where you have some bitcoin with another phone or system and then disable or replace the stolen phone’s 2FA method or you secure your email account too by changing the password and revoke suspicious sessions, because your email can be used to reset your exchange account just like you have explained.

However the best option is to contact your mobile network provider and block the SIM with this they can’t have any access to your SIM card anymore.

If your gadget get stolen and you know how important your sim card i think the first thing to do is to contact the network careline customers to immediately block your sim card so that what ever they try using your sim card won't be possible for them, the easiest means they can get you scam is when your phone and sim card is with them, holding these two things give them easy access to your private information and codes even if you get your exchange secure with the 2FA without blocking your sim card they will definitely temper with your asset.

[Gost ms]

This is a mistake that most people make and for which they attract scammers. If I don't tell anyone that I have Bitcoin, then no one will ever know that I own Bitcoin and no such attack will ever happen to me. There are many who tell everyone that they own Bitcoin, then many people become greedy for their Bitcoin and as a result, there are many risks for them and their holdings. If we don't make these small mistakes, then we can protect ourselves from such problems.

However, it is very easy to protect ourselves from this type of scam. If a person keeps all their security measures turned on, then surely that person will be able to protect himself from such scammers. Collecting Bitcoin in the middle of an exchange is also a big folly.

[Ambatman]

This problem has nothing to do with non custodial wallets
Since they have nothing to do with your Sims or personal information.
You can only face this risk when you leave your coins on exchanges
And to be sincere
It makes that statement "nor b d fone pain me na the sim pain me" sound more true.
Your mail is also at risk
Almost everything currently in Nigeria involves sim.

[Asiska02]

2FA is always the best when using centralized exchanges to backup your funds there. SMS alert sent through OTP has long being compromised and has not been an effective means of securing your data or information from fraudster who may have getting hold of your phone number or any other important details like your email address too.

The number of security I use to back up my exchange account is on a top notch while still paying attention to data comprised such as password leakage. Passkeys since introduced into exchanges has added another layer of security to one’s account, with this even with a password reset, it’ll not be possible to have access into your account. If you don’t save money in exchanges but a personal wallet, you’re at a minimal risk of losing money even if your account gets compromised. The phrase still comes again ‘not your keys, not your coins’.

[Proty]

With SIM card alone, it won't be possible for someone to gain unauthorised access to a bitcoin wallet. However, it is only when such a sim card is linked to an email or an exchange that's when it's a problem. If this SIM card is successfully swapped, it becomes easy for attackers to receive OTP that will enable them to access the account.
For this reason, apart from securing the seed phrase, it will be a good idea to add different layers of security such as an authenticator app instead of relying only on sms.
It is also good not to disclose the amount of bitcoin we have in our holding as this is also another form of security.

[Cryptomultiplier]

We should besides using 2FA, also learn to use hardware security keys like Yubikeys which requires physical touch from the owner.
 
Another one that has been so mentioned here is using cold storage instead of relying on CEX for saving our funds, because cold storage is offline and sim swaps or email compromise can't affect it.

Lastly, it's always good to be attentive mostly when you notice you have a signal loss in your sim cards and this is when it's nice to ask around, use a WiFi to freeze your CEX and email accounts before alerting your mobile carrier service.

To be forewarned is to be forearmed.

[Cookdata]

If your exchange account depends on SMS verification, that can become a serious problem.  So, in order to reduce the risk of losing your bitcoin through this scam method, use an authenticator app instead of SMS, and secure your email account with strong 2FA because many accounts can be recovered using email address.

Warning, be careful who you tell you are holding bitcoin, because sometimes the biggest security risk is not your wallet it’s people knowing you have something worth stealing.

You got a very good reasons for this thread. I could remember 4 years ago during President Buhari regime. A guy using the then the first lady details number to scam people, reason was that there was a sim first lady was using one time, she abandoned it for a year and since the minimum time needed for sim to be active was 6 months, so the sim was swapped for another person.

On inserting the sim, he was receiving calls from people, he was even collecting money from people and promising that he was going to give them contract until one day the first lady was brief about his scam and was later arrested.

We have bad data records in Nigeria, if you have any platform you are using sim to receive sensitive information, change it to 2FA. They are better than using mobile numbers and not just the exchanges, anything that is sensitive.

[Zorellian]

Honestly, I never really reasoned it to this extent at all. My mind never went here. I know of sim swap but never did I think it can be used to access your Bitcoin indirectly. Yeah authentication app is good but your are forgetting email address too. That's why I use different mail for different purposes but people are careless to use one mail for everything. That poses a greater risk than you can imagine.

Same here, I never have idea of someone just get access to your SIM card alone will cause a lot of problems like this, I keep wondering how can someone just have your SIM card and have access to your bitcoin in any exchange that is in. I still think of it like is impossible to me that a fraud will just have access to your sim and everything will be done, but come think of it, nothing is impossible in this world has and frauds have graduated from where we think they are now so I can’t go by this mate thread.

[Somto9Light]

The problem with a lot of us in Nigeria is that we are so weak in security both in our investment and in our environment. We are not security conscious at all, if not when you lose your phone what you should do is retrieve the number immediately because if a scammer get hold of your sim card they can possibly seek a password reset on the centralized platforms that they can use a password reset to log in. Once your sim is compromised, a lot of things are likely to be exposed including your email address because they can also ask for a password reset too. Other users have already suggested using 2FA to strengthen the security of accessing your sensitive apps and sites of your crypto holdings or banking apps.