Security centre
Every control in one place, what each one actually prevents, and what to do first.
Last updated
This site holds nothing
Before anything else: this site has no server, no account and no stored credential. The sign-in form validates nothing and protects nothing. Never type a real password into it.
If something is wrong, in order
The order matters more than the individual steps:
- Freeze the card. It is instant and reversible; cancelling is neither.
- Check recent authorisations for anything you do not recognise.
- Rotate the card number and CVV if a checkout may have been breached.
- Revoke any device you no longer control.
- Change your password and confirm multi-factor authentication is still bound to a device you hold.
- Report unauthorised transactions immediately — liability usually depends on reporting speed.
The controls, and what each prevents
- Freeze at the authorisation layer — prevents the next transaction, rather than reversing the last one.
- Rotatable number and CVV — makes a leaked number worthless without replacing the physical card.
- Virtual cards — contains a merchant breach to that merchant.
- Device biometrics — the device attests it recognised you; the biometric never reaches us.
- Multi-factor authentication — blocks a stolen password on its own.
- Notification on every authorisation — turns a month's delay into seconds.
- Segregated cold storage — assets are never lent, staked or rehypothecated.
What we will never do
No real institution will ask for your full password, your CVV, or a one-time code, by phone, email or message. Anyone doing so is attacking you, regardless of the number they appear to be calling from — caller ID is trivially forged.