How to protect your crypto account

Why does it matter so much?

A bank transfer can sometimes be stopped if you act fast. A crypto transaction, on the other hand, can't be reversed once it is on the BlockchainBlockchainA public ledger where transactions are grouped into blocks, each linked to the one before, so past records can't be altered without it showing.. If someone gets into your account and makes a withdrawal, the crypto is gone.

Think of your account as a safe. Thick walls don't help much if the key is left lying around. Myntkaup's security and licence page explains that Myntkaup is liable for losses caused by incidents within its control, such as a cyberattack on its systems. A customer letting an unauthorised person into their account, however, is outside the company's control.

A long, unique password for every account

The Icelandic police advise using a different password for every account. The reason is simple: data leaks from company systems all the time. Scammers buy stolen passwords and try them on other services. If you use the same password everywhere, one leak opens every door.

• Make it long. A few unrelated words in a row are both stronger and easier to remember than a short word with a symbol. Avoid names and dates other people know.
• Use a password manager. A password manager creates and stores a different password for each account. You only need to remember one master password.
• Check whether your email has leaked. The Have I Been Pwned website shows whether your email address has appeared in a data breach. If it has, change the password for that account and for your email.
• Use passkeys where offered. Passkeys often use your fingerprint or face and are safer than passwords, the police say.

Two-factor authentication: an app rather than SMS

With two-factor authentication, a password alone isn't enough to get in. You also need something you have, such as a code from your phone. Turn it on wherever it is offered, especially for your email and for crypto services.

The options are not equally secure:

1. A security key or passkey. A small device, for example on USB, or a passkey on your phone. According to the police, a USB security key is the most secure option.
2. An authenticator app. Apps such as Google Authenticator or Microsoft Authenticator generate a new code every 30 seconds on the phone itself.
3. SMS. Better than nothing, but the code goes to your phone number. If a scammer takes over your number, they get the code.

When you turn on two-factor authentication, you are often given backup codes. Write them down and keep them somewhere safe, not in your email.

Protect your email

Your email is the master key. Most services send password reset links to your email address, so anyone who gets into your email can often get into everything else.

At Myntkaup, every withdrawal is confirmed with your PIN in the app and by email. Your email is therefore part of your account's defences.

The police suggest checking these email settings:

• A strong, unique password and two-factor authentication.
• The recovery email address for a forgotten password. Is it still correct, and still yours?
• Forwarding rules. Scammers sometimes set up automatic forwarding that runs silently in the background.

SIM swaps: when your phone number is stolen

A SIM swapSIM swapWhen a scammer gets your phone number moved to a new SIM card so they receive your SMS codes and can break into your accounts. is when a scammer gets your mobile operator to move your number to a SIM card they control, usually by pretending to be you. They often gather the information they need in advance, for example through PhishingPhishingA scam where criminals pretend to be a trusted company or authority to get you to hand over passwords, card details or your seed phrase., data leaks or social media.

From then on, your calls and texts go to the scammer, including two-factor codes. According to ENISA, the EU's cybersecurity agency, this can let the scammer get around two-factor authentication and even commit online banking fraud.

The signs: your phone loses all signal for a long time with no explanation, you get a notice that your SIM or number has been changed, or you can no longer log in to your email or social media.

What to do: contact your mobile operator and your bank straight away, and change your passwords.

Protection: use an authenticator app instead of SMS where you can, share as little personal information publicly as possible, and ask your mobile operator what extra protection is available for your account.

Icelandic e-ID: never approve what you didn't start

Rafræn skilríki, the Icelandic e-ID, open your online bank and many other services, including signing up with Myntkaup. That is why scammers often try to get people to approve a login on their behalf. Auðkenni, the e-ID provider, advises:

• You should always be the one who starts the login. If a request you don't recognise appears on your phone, don't approve it.
• Compare the text or number shown by the service with the one in the authentication request before you enter your PIN.
• If in doubt, cancel. You can always start again.
• Only you may know your PINs. Don't use the same PIN as for your online bank or your phone's lock screen. If you think someone knows it, change it straight away or revoke your e-ID on Auðkenni's My Pages (Mínar síður).

The police also point out that you never need to approve your e-ID to receive a payment.

Keep your devices updated

New flaws in software are found every day, and attackers can exploit them. Updates close them.

• Turn on automatic updates on your phone and computer.
• Lock your phone with a PIN or biometrics.
• Only download apps from the App Store or Google Play. The Myntkaup app is available in both.
• Never let a stranger take over your computer with programs such as AnyDesk. It is a well-known scammers' trick.

Check the wallet address on every withdrawal

When you send crypto to your own wallet, you enter the recipient's wallet addressWallet addressA string of letters and numbers you give out to receive crypto, much like a bank account number.. If the address is wrong, the crypto is lost. At Myntkaup, every supported coin except USDC can be sent to your own wallet, on each coin's native network.

The European Supervisory Authorities warn about a scam where someone sends a tiny amount to your wallet from an address that looks like one you have used before. The difference is often just a few characters in the middle of the address. If you copy the address from your transaction history, you send your crypto straight to the scammer.

• Copy the address from the source, for example the receive screen in your own walletCrypto walletAn app or device that holds the keys to your crypto and lets you receive, store and send it., not from your transaction history.
• Compare the whole address, not just the first and last characters. Do it again after pasting, because some malware swaps the address on your clipboard.
• Choose the right networkBlockchain networkThe blockchain a cryptocurrency or token is recorded and sent on, such as the Bitcoin network or the Ethereum network.. The same coin can exist on more than one network.
• Send a small test amount first when large sums are involved. It costs one extra network feeNetwork feeA fee paid to a crypto network, not to a bank or company, for including your transaction in a block. but can save you a big loss.

More in How to send crypto to another wallet.

If you think someone has got in

1. Change your email password first, then the password for the service itself.
2. Contact the service through its official channels. Myntkaup answers at myntkaup@myntkaup.is and through the contact form on its website.
3. Contact your bank if your card details or e-ID might be at risk.
4. Report it to the police through Ísland.is↗.

If you received suspicious messages before this happened, read What is phishing?

Closing thoughts

Many account break-ins don't start with sophisticated technology but with a stolen password, an unprotected email account or an approval given in a hurry. That is why simple habits make the biggest difference.

Set aside half an hour to go through your passwords, turn on two-factor authentication and check your email settings. After that, the main rule is this: never approve anything you didn't ask for.