Get Guardian on GoogleStop using text-message codes as the second lock on your crypto and email accounts. Use an authenticator app at minimum, and a passkey or hardware security key where the service offers one.
A SIM swap hands a criminal your phone number, and every SMS code sent to that number goes with it. The steps below take about an hour, they cost little or nothing, and they remove the single weakest link that most Nigerian crypto users still depend on.
A SIM swap turns your phone number into a master key
A SIM swap is a fraud in which someone persuades a mobile network to move your number to a SIM card they control. It’s a social engineering attack in which attackers convince carriers to transfer control of a user’s phone number to a SIM card they hold, which gives them control of the victim’s phone line.
Once they hold your number, they do not need to break into anything. They request a password reset, the service sends a code by SMS, and the code arrives on their phone instead of yours. Bank-side coverage of the problem says the same thing: bne IntelliNews reported in April 2026 that in SIM swap attacks fraudsters gain control of a customer’s number, intercept one-time passwords and authorize transactions without breaching bank systems.
For a crypto user, the account at risk is usually not the bank. It is the email account, the exchange login, or the wallet app tied to that number. Anything that can reset a password by text can be reset by someone else holding your number.
What Nigeria’s regulators have done, and where it stops
Nigeria has two layers of defense, and both sit mostly with banks and networks. The first is the SIM replacement rule. A subscriber replacing a lost, stolen, or damaged SIM must present a National Identification Number (NIN), the National Identity Management Commission must verify it, and the network must follow the NCC’s replacement guidelines.
The second layer is newer. In April 2026, the Central Bank of Nigeria (CBN) and the NCC signed a memorandum of understanding creating the Telecom Identity Risk Management System. It is meant to let banks check whether a phone number linked to a transaction was recently swapped, reassigned, or flagged, though the report says rollout timelines and technical details had not yet been disclosed. The same report cited NIBSS data that Nigerian banks lost ₦25.85 billion to electronic payment fraud in 2025, down 51% from the year before, and noted a January 2026 policy brief warning that SIM swap, phishing, and insider collusion remain dominant threats.
Read that carefully, because the headline sounds more reassuring than it is. These systems help banks that are plugged into them, and none of them is announced as covering your crypto exchange, wallet app, or email provider. For those, the lock is the one you set yourself.
Rank your second factors from weakest to strongest
Not all two-factor authentication (2FA) is equal, and the gap is wide. CISA’s fact sheet ranks the options from strongest to weakest by how they hold up against phishing, push bombing, SS7 interception, and SIM swaps.
| Second factor | What CISA says about it | Hit by SIM swap? |
| Passkey or hardware key (FIDO/WebAuthn) | Phishing-resistant, the “gold standard” | Not applicable |
| Authenticator app with number matching | Resistant to push bombing, still phishable | Not applicable |
| Authenticator app or hardware token showing a 6-digit code | Resistant to push bombing, still vulnerable to phishing | Not applicable |
| Authenticator push without number matching | Open to push bombing and user error | Not applicable |
| SMS or voice code | “Last resort”, vulnerable to phishing, SS7 and SIM swap | Yes |
The practical lesson is that every app-based option beats SMS on this one threat. Authenticator apps generate codes on the phone itself, so moving your number to another SIM does not move the codes.
Keep in mind that a code from an app can still be typed into a fake login page, which is why the passkey sits at the top: it will not sign in to a site that is not the real one.
Passkeys let you sign in with a fingerprint, face scan or screen lock and are described as more secure against phishing because they cannot be shared, copied or accidentally given away. Anyone who can open your phone can use a passkey stored on it, so a strong, private screen lock matters.
Pick wallets and platforms by their recovery path
When you choose where crypto lives, compare more than fees. Any list of the best crypto wallet in Nigeria should be filtered through two questions of your own. Does it support an authenticator app or passkey for sign-in and withdrawals? And can you recover the account without a text message to your phone number?
The second question catches a hidden weakness. A service can offer strong 2FA at login and still let anyone reset it with an SMS code, which quietly makes SMS the real lock again. If the recovery page asks only for a code to your phone, your security is exactly as good as your SIM.
A platform that sells crypto for cash raises the same question from a different angle. Your money passes through it for minutes, not months, so the point is that withdrawals and login are protected by something other than your number.
Breet is a crypto conversion and payments platform for users in Nigeria and Ghana. It is not a wallet for long-term storage: you get a deposit address per supported coin, and Breet converts incoming crypto to naira or cedis at the rate shown before you confirm, with optional Automatic Settlement to a bank account. It offers 2FA and is ISO/IEC 27001:2022 certified, which suits people who want cash rather than somewhere to keep coins.
The lock-down order that matters
Sequence matters, because attackers go after the account that can reset the others. Work through these in order and stop to finish each one.
- Email first.Your email resets your exchange, wallet, and social accounts. Add a passkey or an authenticator app to it, then remove your phone number as a recovery option if the provider lets you.
- Exchange and wallet apps next.Switch sign-in and withdrawal confirmation from SMS to an authenticator app, then switch off SMS as a fallback. If the app only allows SMS, that tells you something about the app.
- Store backup codes offline.Print or write them down and keep them somewhere separate from your phone. If your phone is stolen, backup codes get you in without the number.
- Ask your bank what protects your number.Ask whether your bank lets you turn off USSD banking or SMS-only approvals, and ask what checks it runs when your number changes. Some banks give customers more control than they advertise.
- Guard your NIN.The SIM replacement rule rests on a NIN, so treat it like a bank PIN. Do not send NIN slips to agents you do not know or share a photo of them in chats.
- Use withdrawal allowlists if offered.Some platforms let you restrict withdrawals to pre-approved addresses, with a delay when you add one. That delay gives you time to notice a takeover.
Picture a trader who does steps 1 and 2 on a Sunday afternoon and nothing else. A swapped SIM would now hand a criminal a phone number that no longer opens the email, the exchange, or the withdrawal screen. The attacker would still try the bank, which is why step 4 exists.
Signs of a swap and the first hour after one
A phone that loses service for no reason while everyone around you on the same network is fine deserves a quick call to your network provider. Treat it as urgent if you also get a login alert or a password-reset email you did not ask for. There is no guaranteed warning sign, and some swaps are quiet, so a habit of checking your accounts’ login history is worth more than waiting for a signal.
If you think your number has been swapped, work fast and in this order. Call your network from another phone and ask them to block the SIM. Call your bank on its official line and ask for a hold on digital channels. Then change your email password and authenticator settings from a device you trust, and contact your crypto platform to freeze withdrawals. Report to the police and keep a record of the times and reference numbers you were given.
Expect some friction. An authenticator app needs setup on a new phone, and backup codes need a safe place, so do the migration before you lose or replace a handset, not after. Keep the old phone working until every account has been moved and tested with a fresh login.
None of this is a guarantee. A passkey on a stolen phone that is still open is still a way in, and no setup removes the need for judgment. The aim is to turn a one-step takeover into a many-step one, so that most attackers move on to easier targets.
A final note for people who trade often: keep one phone number that you never publish. Numbers printed on business cards, WhatsApp bios, and invoices are easy for an attacker to match to a name, and a number that appears only on your bank and email accounts gives them less to work with. This is a habit, not a guarantee, but it costs nothing and narrows who can target you.
A twenty-minute audit you can do tonight
Open your phone and list every account that holds money or can reach money: bank apps, email, exchange, wallet, mobile money. For each one, write down how a stranger could reset your access. Any entry that says “text message” is your to-do list.
Do the email account first, then work down the list. Then check each account’s recovery page, because that is where weak setups hide: a login protected by a passkey can still be reset through a text sent to a number you no longer control. Save the sheet, because the next time you open a crypto account you will want to skip SMS from the first minute.
