Your SIM card could risk your bitcoin.

[Son Of Blockchain (SOB)]

 When i saw the thread i was very curious to how someone wallet can be at risk with sim card until i read through to see that it concerns exchanges. Are people supposed to be storing their Bitcoin in exchanges in the first place, sim or not that the first red plag to Bitcoin walleylt security and should be avoided at all cost.
 People that choose to store their money with Bitcoin should be self custodians of their money and not involving it with a third party so storing it in exchanges is almost equivalent to saving with bank.

[Marykeller]

In summary, before a scammer attempts to log in to an exchange, the owner is supposed to be notified through email. Most times facial verification is also required when trying to access an account from a different location and device.

If a scammer successfully swaps your phone number to another SIM card there is no way you will receive a notification from your exchange via your phone number if they attempt to access your account.  So, the essence of swapping your phone number to another SIM card is to block your phone from receiving a message when your account is being accessed by another device that has never been used by you to login into your account.

This can only happen if scammers have access to your email account. If nothing of the sort, consider the approach of scammers to login to their exchange account unfruitful. 

To the best I can tell, you can't log in to someone else's Exchange account without verifying email and SIM verification. You have to receive messages from both sides to activate the account.

You see, the SIM swap has no advantage if the email is not provided. Not only that, what about the exchange not disclose because we have many exchanges, not few, someone can open an account with.

[Dareo]

I think this is why the Not Yours Not Your Coin theory was created. Despite the many security measures in centralized exchanges, there is still a possibility of funds being stolen. A fraudster can apply to a third party if he wants. But when you use a self custody wallet, the fraudster cannot apply to any centralized platform that this wallet is mine, until he gets those seed phrases.
And in the case of centralized wallets, I want to say that how many people use their phone number as a security key? I know most people use their email address as their security system. Besides, we have two factor authentication.

[coinlary]

We have bad data records in Nigeria, if you have any platform you are using sim to receive sensitive information, change it to 2FA. They are better than using mobile numbers and not just the exchanges, anything that is sensitive.

I heard they are also selling one active phone number to multiple people now, no duration is being honored, and that's  how bad both the providers and the data records are in Nigeria.

By the way, phone number verification is also part of 2FA options, there're others  too like, passkey, email, authenticator and so on. What you meant is limiting  what the  phone number can do if the  service has a way to do such or choose Authenticator or-and the likes over phonenumber.

[PVequalNRT]

I think this is why the Not Yours Not Your Coin theory was created. Despite the many security measures in centralized exchanges, there is still a possibility of funds being stolen. A fraudster can apply to a third party if he wants. But when you use a self custody wallet, the fraudster cannot apply to any centralized platform that this wallet is mine, until he gets those seed phrases.
And in the case of centralized wallets, I want to say that how many people use their phone number as a security key? I know most people use their email address as their security system. Besides, we have two factor authentication.

Many Nigerians use exchanges to store their crypto than they do with custodial wallet, it makes sense to thatnhe bringing it to our attention how people can lose their money by depending on sim card. The Nigerian telecommunications companies don't roll out new numbers again, it's the old numbers they are recycling everyday for people to use without caring much about the consequences.

[Joy- maker]

When i saw the thread i was very curious to how someone wallet can be at risk with sim card until i read through to see that it concerns exchanges. Are people supposed to be storing their Bitcoin in exchanges in the first place, sim or not that the first red plag to Bitcoin walleylt security and should be avoided at all cost.
 People that choose to store their money with Bitcoin should be self custodians of their money and not involving it with a third party so storing it in exchanges is almost equivalent to saving with bank.

The thread is very educational, I never knew scammers could steal your Bitcoin just by simply swapping your phone number to another SIM card. As for centralized exchanges, a large population of people who are involved in Bitcoin keep their coins on centralized exchange. Even on this forum, there are users who keep their long term Bitcoin investment on centralized exchanges despite repeatedly seeing the phrase "Not your key, not your coins."  One thing you should know is that, some people won't learn from others mistakes until they become victim themselves.

[Homemade-IQ]

Warning, be careful who you tell you are holding bitcoin, because sometimes the biggest security risk is not your wallet it’s people knowing you have something worth stealing.

The problem of every Bitcoin investors start when he decides to hold his Bitcoin in an exchange instead of a self custodian wallet, because once you start keeping your asset in an exchange, you are exposing your crypto asset to every level of fraud, which might cost you your crypto asset, so it's very important that we prevent disaster from happening by keeping our crypto asset in a self custodian wallet than in an exchange where it's vulnerable.

[Miles2006]

The surprising part here is having access to retrieve the email address first, email address is linked to exchange account viewing email address is a criterion to own an exchange account. SIM card is a key factor in terms of scam operation though I don’t get it with the transfer of numbers and the rest but, if anyone should get full access to our email then it’s an easy access to hack an exchange account using the change of password pattern.
I doubt if decentralized wallet will face same challenge, decentralized operate differently definitely the centralized exchange is own by a third party so anything can happen when linked with an open space, also SIM card can be locked although I’m not sure if this is a preventive means.

[Agbamoni]

Sharing every information concerning security is very important to always keep people learning about what is happening but however is not easy as you think it might be because a lot of Centralized exchange doesn't support phone number or even use to send any verification from there during log in or withdraw so actually even if somebody has your number they will never be able to have  control over it because email is mostly were verification are sent to and besides how would the person even know the name the owner use on their exchange account through the phone number. Actually there could be other way this will be harmful but through this means.

I can't think of any exchange that does not require a phone number for sign-up and for sending notifications. The exchanges I know have options for phone number sign-up. In addition, during withdrawals, some exchanges send a code to both phone number and email. For better security I usggest using both not one to improve security. However, some users make use of passkeys, which I think is too risky

[Karl_3000]

I can't think of any exchange that does not require a phone number for sign-up and for sending notifications. The exchanges I know have options for phone number sign-up. In addition, during withdrawals, some exchanges send a code to both phone number and email. For better security I usggest using both not one to improve security. However, some users make use of passkeys, which I think is too risky

On most exchanges that I am using, my phone number is not linked to it. Example is Bybit, Gate and MEXC that I only use email, 2FA and passkey. But my phone number is linked to two exchanges. I do not like to link my phone with exchanges so I prefer to avoid it if possible. 2FA, email and passkey authentication are enough.

[Barikui1]

On most exchanges that I am using, my phone number is not linked to it. Example is Bybit, Gate and MEXC that I only use email, 2FA and passkey. But my phone number is linked to two exchanges. I do not like to link my phone with exchanges so I prefer to avoid it if possible. 2FA, email and passkey authentication are enough.

Linking my sim card to my exchange account is a practice I don't find healthy, not that I expect disaster to happen, but I don't think it is safe enough like my email.

I secure my main sim card with my puk code, so if my phone is shut down or for any reason my sim card is removed from my device, puk code will be asked before network will get back to that sim, so if you cannot figure that out, you cannot make use of it for any reason, but it's actually not a healthy practice to be leaving our crypto asset in an exchange because they becomes a target for scammers when they are there.

[Money bag]

This is why it's too much risk to keep your bitcoin investment a centralized exchange, because once someone gets access to your SIM or your email they can basically ask for a password reset, if you are risking it and keeping your bitcoin investment a centralized exchange then you should at least make sure it's secured with 2 factor authentication so that access from a third party will at least be a little difficult to pull off.
We need to stop thinking that our assets are saved behind these little defenses, the world has grown past that point, someone can just duplicate your phone and gain access t whatever is inside.

[NewRevelation]

In summary, before a scammer attempts to log in to an exchange, the owner is supposed to be notified through email. Most times facial verification is also required when trying to access an account from a different location and device.

If a scammer successfully swaps your phone number to another SIM card there is no way you will receive a notification from your exchange via your phone number if they attempt to access your account.  So, the essence of swapping your phone number to another SIM card is to block your phone from receiving a message when your account is being accessed by another device that has never been used by you to login into your account.

I don't it's even too good to use an sms notification at all. An authenticator app is a better way to ward off such scam method because if it's not you, and the authenticator numbers pasted, then it's not going through or the funds can't me moved. Some people might just feel to azy to link and update all those apps and the 2FA, but it's very necessary we do that. Using sms alert alone isn't enough protection. Since we know of so many scammers looking for ways to defraud people, then we must take extra measures to ensure we are safe and not lose our assets to criminals.
 

[EarnOnVictor]

I fear that thing called SIM and OTP via SMS, as they have always been blindspots. You could lose your locked phone and before you know it, debit alerts here and there; so porous.

As for Bitcoin, though this is highly unlikely in Nigeria, it's possible. Our passwords and seedphrases are never enough if other layers of protections are not enforced. This is why Google authentication or any others that are independent of the SIM card are important. But I fear recovery of the account if the authenticator couldn't be reached for any reason. The SMS's OTP has always been the best alternative if not for the loophole.

[Ashawowo(OS)]

However, it affects more of those people who store or keep their bitcoin investment in a centralized exchange. How does it happen? A a fraudster finds a way to transfer your own phone number to another SIM card and then request for a password reset from your exchange or email account while they receive OTPs from their end.

If your exchange account depends on SMS verification, that can become a serious problem.  So, in order to reduce the risk of losing your bitcoin through this scam method, use an authenticator app instead of SMS, and secure your email account with strong 2FA because many accounts can be recovered using email address.

I use Binance, there is not such options to authenticate a user by phone number anymore, it is usually pass keys, face verification, email and authenticator app that are combined in 2 to 3 requirements format to authenticate a user. SMS loophole has been addressed from a long time ago and most OTPs go directly to your email. I don't think any reasonable exchange would include phone number as a valid backup option or even use only it, it is too risky to have that option.

Even if you gain access in Binance, you cannot withdraw funds with a new device without a rigorous verification process of which phone number cannot suffice.

[Nathrixxx]

We begin to create vulnerability for ourselves the moment we see everything as being an ordinary experience when we should take caution of them, don't lose your SIM card for anything, I have seen some people that lost their money from their bank account because of this similar scenario happening to them, anyone can get access to your number and also contact some of your friends and family on your behalf, they can as well use it to scam you by resetting some of your credentials online using your same SIM card you lost, this is where after any loss you should quickly report to the necessary authority for a welcome back.

[ColdLava40]

Warning, be careful who you tell you are holding bitcoin, because sometimes the biggest security risk is not your wallet it’s people knowing you have something worth stealing.

Having 2FA on your exchange account solves most of the problems.

Not everyone understands how to protect their accounts from security risk, so I'll applaud you for this. I've heard about the sim swap but never really experienced it before or knew how it works.

Scammers can do anything to get to you. We just need to be careful with how much information about our self we put out to the public. Since there's no way to confirm if our sims had already been swap, this would really be a strong security risk for those who uses sms messages for verifications on exchanges.

[Franklyn-wood]

The problem with a lot of us in Nigeria is that we are so weak in security both in our investment and in our environment. We are not security conscious at all, if not when you lose your phone what you should do is retrieve the number immediately because if a scammer get hold of your sim card they can possibly seek a password reset on the centralized platforms that they can use a password reset to log in. Once your sim is compromised, a lot of things are likely to be exposed including your email address because they can also ask for a password reset too. Other users have already suggested using 2FA to strengthen the security of accessing your sensitive apps and sites of your crypto holdings or banking apps.

That's truth Nigerians don't really bother much about improving the security aspect of the information, rather we believe what will happen will happen, so taking to heart or worry about what will happen to the information we need to protect doesn't matter.
The level of exposure matters more to how much importance we attach to be able to secure our informations, I think due to the introduction of NIN thos makes people more deciplined because there is limit to the number of sims they can use, so this gives everyone the consciousness of how and what we do with the number to remain securedly safed from treats.

[Agbamoni]

I can't think of any exchange that does not require a phone number for sign-up and for sending notifications. The exchanges I know have options for phone number sign-up. In addition, during withdrawals, some exchanges send a code to both phone number and email. For better security I usggest using both not one to improve security. However, some users make use of passkeys, which I think is too risky

On most exchanges that I am using, my phone number is not linked to it. Example is Bybit, Gate and MEXC that I only use email, 2FA and passkey. But my phone number is linked to two exchanges. I do not like to link my phone with exchanges so I prefer to avoid it if possible. 2FA, email and passkey authentication are enough.

Check the security settings for the exchanges your phone numbers aren't linked to in your account. There is an option to bind a phone number if you want. Exchanges do suggest security options. I suggest the choice should be yours, not whatever they offer you. I personally prefer to bind a phone number, email, and 2FA. This is the best combo to use for security in an exchange, IMO.