Wallets, custody and account security
After this lesson you can choose where to hold your coins, store a seed phrase safely, and lock your accounts against phishing and SIM swaps.
Wallet, custody aur account ki hifazat
Coins teen jagah rakhe ja sakte hain. Exchange par trading asaan hai, lekin aap exchange aur apne login dono par bharosa karte hain. Hot wallet mein keys aap ke paas hain, lekin phishing aur fake apps ka khatra hai. Hardware wallet mein keys offline rehti hain. Asool yeh hai: sirf trading wali raqam exchange par, aur lambay arsay wali holding apne control wale wallet mein.
Seed phrase ke 12 ya 24 lafz hi asal paisa hain. Jis ke paas yeh lafz hain, coins us ke hain, aur wapsi mumkin nahi. Kaghaz ya steel par likhein aur do mehfooz jagah rakhein. Kabhi photo, email, Google Drive ya WhatsApp mein mat rakhein, aur 'support' ko kabhi mat batayein. Asli support kabhi seed phrase nahi maangta; jo maange woh chor hai.
SMS wala 2FA sab se kamzor hai, kyun ke SIM swap se aap ka number aur har code chor ke paas chala jata hai. Authenticator app, withdrawal whitelist aur anti-phishing code lagayein, aur call par kabhi OTP na batayein. 'Oont baandho aur Allah par bharosa karo' (Tirmidhi 2517): hifazat mehnat hai aur tawakkul us ke saath hai, us ki jagah nahi.
- Exchange par sirf trading ki raqam rakhein, baqi apne control wale wallet mein.
- Seed phrase hi paisa hai: kaghaz ya steel, do mehfooz jagah, kabhi photo ya cloud nahi.
- SMS ki jagah authenticator app istemal karein aur call karne wale ko kabhi OTP na dein.
Poora sabaq neeche English mein hai. Quiz English mein hai; asaan alfaaz mein.
Rizwan exports sports gloves from Sialkot and keeps about $1,800 of USDT on an exchange. One evening a polite caller says he is from Rizwan's mobile network: his SIM needs 'biometric re-verification' or it will be blocked, and a code is on its way. Rizwan reads out the code. By midnight his phone shows 'No service'. By morning his email password has been reset by SMS, his exchange account has been opened with SMS codes, and the USDT is gone. The exchange replies that every step used the correct codes.
Three places to hold coins, three kinds of risk
Where your coins sit decides what can go wrong. Most people need a mix: a small amount on an exchange for planned trades, and long-term holdings in a wallet they control once the amount is meaningful to them. Each option trades convenience against a different danger.
- Exchange account: easiest for trading, but you depend on the exchange staying solvent and on your login staying safe.
- Hot wallet, a phone or browser app: you hold the keys; the risks are phishing links, fake apps and malware.
- Hardware wallet: keys stay offline on a small device; the risks are losing the device and, above all, losing the seed phrase.
The seed phrase is the money
A self-custody wallet gives you 12 or 24 words, the seed phrase. Anyone who has those words owns your coins, from any device in the world, and no one can reverse it. Write the words on paper or steel, check each one, and keep copies in two safe places. Never photograph them, type them into a website, store them in email or the cloud, or share them with 'support'. No real support team ever asks for them.
Locking the doors: 2FA, SIM swaps and phishing
SMS codes are the weakest lock, because a SIM swap moves your number, and every code with it, to a thief's phone. Use an authenticator app or a hardware security key on your exchange and on the email linked to it. Turn on a withdrawal address whitelist, so coins can only go to your own saved addresses, and set the exchange's anti-phishing code so real emails carry your secret word.
- Never share an OTP with anyone who calls you, whoever they claim to be.
- Bookmark the exchange website; do not open it from ads or messages.
- Use a separate email for money accounts, with its own strong password.
- Install apps only through the official link on the exchange's own website.
How much to keep where
Rizwan's plan after rebuilding: he holds $2,000 in total and trades about $300 a month. $300 stays on the exchange (15%) and $1,700 moves to self-custody (85%). If his exchange account is ever drained again, the damage is $300, not $2,000.
A hardware wallet costs roughly $80. On $1,700 that is 4.7%, paid once; on $5,000 it is 1.6%. A reasonable rule for this course: once long-term holdings pass about 20 times the device's price, here $1,600, buy one.
Why the phrase matters more than the device: twelve words from a list of 2,048 can be arranged in 2,048 to the power of 12 ways, about 5.4 x 10^39. No one guesses a seed phrase. Thieves get it by tricking you into sharing it.
Guarding wealth is part of the trust you hold. 'Tie your camel and rely on Allah' (Jami at-Tirmidhi 2517) fits security exactly: 2FA, a safely stored seed phrase and a whitelist are the rope, and tawakkul comes with them, not instead of them. Custody also touches possession: scholars stress owning and controlling what you buy, and a wallet you control is the clearest form of that. Finally, think of your heirs. Leave a written note with someone you trust explaining what you hold and where the recovery phrase is kept, so wealth that is due to your family is not lost with you.
Education, not a fatwa. Where scholars differ, we say so. See what scholars say.
Storing the seed phrase as a phone photo, a WhatsApp message to yourself, a Google Drive file or an email draft. If any of those accounts is breached, your coins go with it. The second trap is 'support' asking for the phrase to verify, unlock or upgrade your wallet. No real support ever needs it; anyone who asks is stealing.
Open Scam Check and paste this sample: 'Dear user, your wallet will be suspended in 24 hours due to a security update. Verify now at this link using your 12-word recovery phrase.' Read every red flag it lists. Then spend ten minutes on your own accounts: switch 2FA from SMS to an authenticator app on your exchange and email, turn on the withdrawal whitelist, and check where your seed phrase lives.
Run a Scam Check →Key takeaways
- Keep only your trading amount on an exchange, and move long-term holdings to a wallet you control.
- Your seed phrase is the money: paper or steel, two safe places, never a photo, cloud file or 'support' chat.
- Use an authenticator app instead of SMS, and never share an OTP with anyone who calls you.
Check yourself
Pass with 2 of 3 to complete the lesson. Answers are checked on our server, so the certificate means something.
Barqish is an educational platform. Nothing here is financial advice or an instruction to buy or sell, and screening is not a fatwa. Spot ownership only: no leverage, no short selling. Updated 30 September 2026.