Crypto security checklist for NZ: seed phrases, 2FA and SIM swaps

Good crypto security in NZ comes down to five weak points: a seed phrase someone else can see, SMS codes a SIM swap can redirect, fake websites, unchecked send addresses, and an estate nobody can open. This checklist covers each one in order, starting with the losses that can never be reversed.

Tick each box only if it is fully true. A “mostly” on seed storage is a “no”.

Keep everything on an exchange? Some of this doesn’t apply yet, but read the account-security section closely, because your login is then the only thing between a thief and your coins. The trade-offs are explained in our guide to custodial and non-custodial wallets.

Which sections matter for where your crypto is held?

Where should you store a seed phrase? Offline, on paper or metal

Store it offline, written by hand on paper or a metal backup, somewhere out of sight. Your 12 or 24 recovery words are your Bitcoin: anyone who sees them can rebuild your wallet on their own device in minutes, from anywhere in the world.

• Written by hand, on paper or metal. Paper is fine to start with; a stamped or engraved metal backup survives fire and floods better.
• Never photographed. Phone photos sync to the cloud automatically, often without you noticing.
• Never typed into anything connected. Not a notes app, email draft, password manager or spreadsheet. The only place the words should ever be typed is the hardware wallet itself during a restore.
• Stored out of sight. Not under the keyboard, not on the fridge. Visitors, tradespeople and flatmates see more than you think.
• A second copy in a separate place, if you can secure one, so a single fire or burglary isn’t the end.
• Never shared with “support”. No wallet maker, exchange, bank, Police officer or IRD staff member will ever ask for it. The fake “migration” sites that followed Ledger’s January 2026 data leak asked for exactly this.

Do you need a BIP-39 passphrase? A second lock with a catch

You need one only if you can back it up as carefully as the seed itself. A BIP-39 passphrase, sometimes called the “25th word”, is an extra phrase you choose and add to your seed. The same 24 words with a different passphrase open a completely different wallet.

• If you use one, it’s long, unique and backed up somewhere different from the seed.
• You’ve tested restoring with both the words and the passphrase.

When is multisig worth it for larger Bitcoin holdings?

Multisig earns its complexity once a single device failure or theft would cost more than you could absorb. These wallets need several keys to spend, for example any two of three, so one stolen or faulty device can’t empty the wallet on its own.

• Keys are on devices from different manufacturers, so a single brand’s flaw or supply-chain problem can’t compromise more than one key. After the October 2026 case of a tampered Ledger sold through a reseller, Trezor itself pointed users to this approach.
• Each key’s seed is stored in a different location.
• You’ve saved the wallet configuration file (sometimes called an output descriptor). Without it, the seeds alone can be hard to recombine.
• The coordinating software is one you understand, such as Sparrow, Nunchuk or Electrum.

Extra keys bring extra ways to make mistakes. Until holdings justify the work, many people are better served by a single well-protected hardware wallet with a passphrase.

How to check a Bitcoin address before you send

Read the address on the hardware wallet’s own screen, compare the start and the end, and send a small test first. Clipboard malware relies on people checking only the first few characters.

• Check the address on the hardware wallet’s screen, not just on your computer. Malware can swap a copied address in your clipboard for the attacker’s.
• Compare the first and last several characters every time, not just the first few.
• Send a small test to any new address before a large amount, and wait for it to arrive.
• Choose the Bitcoin network when withdrawing BTC from a multi-coin exchange.

Which two-factor authentication is safest for NZ crypto exchanges?

A passkey or hardware security key is safest, an authenticator app is good, and SMS is the weakest common option. Start with your email, though: an attacker who controls it can usually reset your exchange password.

• Passkey or authenticator app on every exchange and on the email account behind them.
• SMS removed as a fallback, where the platform allows it.
• A dedicated email address used only for crypto accounts, not shared on social media or shopping sites.
• A unique password for every account, stored in a password manager. (Passwords yes; seed phrases never.)
• Withdrawal address allow-list switched on if your exchange offers one, so withdrawals can only go to addresses you’ve approved in advance.
• Backup codes for your authenticator printed and stored with your other important papers.

Can someone steal your crypto with a SIM swap in NZ?

Yes, if any crypto or email account still relies on SMS codes. A SIM swap moves your number to a SIM card the attacker holds, so your texts and calls go to them; a port-out moves your number to a different provider. Either can hand over SMS codes. Here is what New Zealand providers have in place, as far as we could confirm on 16 October 2026.

Since around October 2021, a number port in New Zealand only goes ahead after the account holder replies YES to a text from their current provider; Spark’s message comes from 2542. The Telecommunications Forum says the whole port, including that step, takes about 13 minutes on average. Got an unexpected porting text? Don’t reply, and call your provider straight away.

We didn’t find a US-style “port-out PIN” at One NZ, Spark or 2degrees; the reply-YES step is the closest local equivalent. One NZ says SIM swaps must be done in person in store with ID, and recommends setting a secure account PIN in My One NZ.

Spark advises using app-based two-factor authentication instead of SMS for bank accounts. We couldn’t find a specific SIM-swap page from 2degrees. All three providers are also building a joint SIM Swap API so that banks can check whether a number’s SIM changed recently before approving a risky payment.

• An account PIN or password is set with your mobile provider.
• You know what your provider’s porting text looks like, and you’d call them, not reply, if you didn’t request it.
• No crypto or email account relies on SMS alone.

How to avoid phishing domains and fake wallet apps

Log in only from your own bookmarks and install wallets only from the official site or a verified store listing. Search ads are the usual trap.

• Bookmarks for every official site you use, and you only log in from those bookmarks. Search ads for exchange and wallet names have been used to push fake login pages; the FMA has warned about one imitating Blockchain.com.
• Wallet software only from the official site or the verified store listing. Check the developer name. Official wallet sites include ledger.com, trezor.io, coinkite.com, bitbox.swiss, foundation.xyz, blockstream.com, keyst.one and sparrowwallet.com.
• No “urgent” emails acted on. Messages about account suspensions, firmware recalls or mergers that link to a page asking for your words are scams, every time.

Deepfake ads, fake Police calls and the other patterns currently aimed at New Zealanders, plus who to report them to, are in our crypto scams in NZ guide.

Keeping your home address private after Ledger’s customer-data leaks

Use a PO Box or pickup point for crypto deliveries and keep your holdings to yourself. Hardware-wallet buyers’ names, phone numbers and postal addresses have leaked twice from Ledger’s side, in 2020 and through its e-commerce provider Global-e in January 2026. Leaks like that turn an online risk into a physical one.

• A PO Box or pickup point for future hardware-wallet and crypto-related deliveries.
• No public talk about your holdings, online or at the pub. Screenshots of balances travel.
• Expect targeted phishing if you’ve ever bought from a company that leaked data, including letters and phone calls that use your real name and order details.

How to leave crypto in a New Zealand will without exposing the keys

Name the crypto in your will, but put the access instructions in a separate, secure letter of wishes. Crypto with no access plan is one of the few assets that can simply vanish when its owner dies.

NZ courts have treated cryptocurrency as property: the High Court did so in Ruscoe v Cryptopia, and the Family Court has treated it as relationship property. The Wills Act 2007 and the Administration Act 1969 don’t deal with digital assets specifically, so the practical side is up to you.

1. 01

   Make an inventory

   List each exchange, wallet and device, roughly what it holds, and where its backup is kept. Don’t include the seed words themselves.

2. 02

   Write a letter of wishes

   A separate letter or memorandum, kept somewhere secure, explaining how to find and use the backups. Your lawyer can advise how to reference it.

3. 03

   Choose a capable executor

   Consider a co-executor who understands Bitcoin, or a trusted adviser the executor can call on.

4. 04

   Consider a technical safety net

   Some people use multisig with a family member or professional holding one key, or wallet tools with time-locked inheritance features such as Nunchuk’s.

5. 05

   Review it every year

   Wallets change, exchanges close and devices fail. Check the letter still matches reality.

Public Trust notes that formal administration is typically needed for estates worth more than $40,000. We couldn’t find any crypto-specific guidance on Public Trust’s website, so ask whoever you appoint how they would handle digital assets before you rely on them.

Tax doesn’t stop at death either. Our explainer on when IRD taxes Bitcoin covers the records an executor will need.

Five crypto security habits that prevent most NZ losses

Most of this page reduces to five habits. Write the seed on paper or metal and never photograph it. Buy hardware direct from the manufacturer. Use passkeys or an authenticator app instead of SMS. Verify every address on the device and send a test first. And leave your family a way in that isn’t your will.

Still choosing the wallet itself? Our comparison of Bitcoin wallets for NZ users covers mobile, desktop and Lightning options.