Is a crypto card safe? The risks, and what Nomux does about them

The real risks with a crypto card

Most money lost through card accounts is lost to a stolen login, not to a broken payment network. The usual routes are phishing pages that copy a sign-in screen, fake support accounts in messengers, and reused passwords leaked from other sites.

No legitimate support agent needs your password, your two-factor code or a wallet recovery phrase. Treat any request for them as an attack, whoever it claims to come from. Nomux support runs in the Nomux Telegram bot.

A second risk is the card itself: a number skimmed or leaked from a shop. That risk is the same for any Visa or Mastercard, which is why it matters where the provider keeps card details, covered below.

Signing in

A Nomux account opens with a Telegram login or an email. At registration Nomux offers two-factor authentication by TOTP, the RFC 6238 standard that Google Authenticator, Aegis and other authenticator apps use.

Two-factor is optional, and it protects the sign-in: with it on, a password on its own is not enough to open the account. It does not ask for a code again on each payment or withdrawal once a session is open.

Turning two-factor on, or changing the password, signs out every other session. If you suspect someone else has access, that is the first thing to do.

Card details stay with the issuer

The card number, expiry and security code are drawn by the issuing partner in a secure window of its own inside the Nomux app. They do not pass through Nomux servers, and they are not in the Nomux database or logs.

So a breach of Nomux could not expose card numbers, because Nomux never had them.

A balance that cannot be rewritten

A Nomux balance is computed from entries in a ledger, and the database itself rejects any edit or deletion of an entry once it is posted. The application cannot change a posted entry even with full write access.

Errors are fixed by posting an offsetting entry, which leaves the earlier record in place, so the full history of the account stays readable.

Each blockchain deposit is credited exactly once, even if the network reports the same event more than once. That stops both a double credit and a lost one.

Notifications and what Nomux keeps

Topping up, ordering a card and subscribing all require the account to be connected to Telegram first, because that is where Nomux reports every movement of money. That way you hear about each one as it happens.

A virtual card comes without identity documents, so Nomux holds no passport scans for one. For a physical card a verification provider performs the check, and Nomux stores only the reference of the completed check.

Logs are kept for a short, fixed period and then deleted. The application also runs without permission to change the database structure, so a compromised application cannot drop a table.

What you can do yourself

Turn on two-factor sign-in, use a password you do not use anywhere else, and keep the Telegram notifications on so an unexpected charge does not go unnoticed.

Keep on the card balance roughly what you plan to spend. If you also use the Nomux wallet, write its recovery phrase down offline and keep it away from screenshots and cloud notes. The wallet is non-custodial by default, with the key protected by your passcode, and its own security page covers it in detail.