Crypto card security: protect the card, the app and the coins

A stolen card number on an ordinary debit card exposes one account. On a crypto card it can expose an app that also holds coins, and crypto transfers are hard to reverse. Most protection comes from settings you turn on yourself.

Lock the account

• Use a unique, long password and a password manager.
• Use an authenticator app or passkey for two-step verification where offered; SMS codes can be hijacked by SIM swap.
• Turn on withdrawal address allow-listing and any withdrawal delay the platform offers, so a thief cannot send coins to a new address straight away.
• Remove old devices from the account’s trusted-device list.

Lock the card

• Use the in-app freeze when the card is not in use, and turn off online or foreign transactions if you don’t need them.
• Prefer Apple Pay or Google Pay at the till where supported: wallets pass a device token rather than your card number.
• Set spending notifications for every transaction.

Limit what is at risk

Keep only what you plan to spend on a card-linked account. Larger holdings belong in an account or wallet that no card can draw on. If you self-custody, your seed phrase never goes in a photo, an email, a cloud note or a website form. No real support agent will ever ask for it.

Spot the common scams

• Fake “support” on social media or in search ads that asks for your login or seed phrase.
• Messages saying your card is locked and you must “verify” through a link.
• Cards advertised with impossible rewards from platforms that are not on the CSA lists.

More in scams and card fraud.

If something goes wrong

1. Freeze the card in the app and change your password from a clean device.
2. Contact the platform through the official app, never through a link someone sent you.
3. Report to the Canadian Anti-Fraud Centre through the National Fraud and Cybercrime Reporting System, and to local police.
4. For card transactions, ask the issuer about a dispute; card network dispute rights generally apply to card payments, not to crypto you sent on-chain.

Which security features do the verified cards offer?

What should I do in the first ten minutes after losing a card?

1. Lock or freeze the card in the app. Shakepay lets you “instantly lock your card” and, if it is permanently lost, replace it from the card tab, which issues new card details.
2. Check recent transactions and note any you did not make, with dates and amounts.
3. Change the account password and confirm two-step verification is still on, from a device you trust.
4. If crypto has moved out of the account, contact the platform through its official app at once; on-chain transfers usually cannot be reversed.
5. Report fraud to the Canadian Anti-Fraud Centre and keep the reference number.

How much should I keep on a crypto card?

Enough for the next few weeks of planned spending. Shakepay’s card spends your CAD balance and Crypto.com’s card spends a CAD card balance capped at C$35,000, so the money at risk if the account is taken over is whatever you leave there plus any crypto in the same account. Keep long-term crypto holdings in an account or wallet that no card can draw on, and move money onto the card when you need it. Neither balance is CDIC insured.

Why is SMS a weak second factor?

In a SIM swap, a fraudster persuades a mobile carrier to move your number to their SIM and then receives your login codes. An authenticator app or a passkey ties the second factor to your device instead of your phone number. Many carriers also let you add a port-out PIN; ask yours.

Why do phone wallets help?

Apple Pay and Google Pay give the merchant a device token, not your card number. If the merchant is breached, the token is useless elsewhere. All three verified cards say they work with both wallets.

What if I hold my own keys?

With a self-custody card the seed phrase is the account. Write it on paper or metal, store it offline in two places, and never type it into a website or share it with “support”. No company can reverse a transfer you signed.

Educational information, not financial, tax or legal advice. 7 min read. Reviewed October 31, 2026.