Security
Assume nothing. Verify everything.
ECardPay is built on a simple discipline: every identity is verified, every sensitive action is challenged, and every credential is encrypted. We would rather add a second of friction than lose a cent of your money.
- Phishing-resistant passkeys
- Step-up on every sensitive action
- Hardware-backed key management
Defence in depth
Five layers between an attacker and your money
No single control is trusted to hold on its own. Each layer assumes the one above it may fail — and is designed to catch what slips through.
- 01
Identity
Document and biometric verification through leading regulated identity partners, with sanctions and PEP screening at onboarding and on an ongoing basis.
- 02
Authentication
WebAuthn passkeys, authenticator two-factor and device intelligence decide who gets a session in the first place.
- 03
Step-up verification
Sensitive actions demand a fresh challenge at that moment — a valid session is never enough on its own.
- 04
Transaction controls
Card limits, merchant-category rules, payout review-and-approval and transaction screening are enforced before money moves.
- 05
Encryption
TLS in transit, encryption at rest, and hardware-backed key management with envelope encryption around the most sensitive credentials.
In practice
How each layer works day to day
The controls below run on every account, on every plan — they are not optional extras.
Identity and onboarding
Individuals and businesses complete document and biometric identity verification through regulated identity-verification partners. Screening against global sanctions and PEP lists happens at onboarding and continues for the life of the account, and risk-based requests for information are handled entirely in-app.
Authentication
Sign in with phishing-resistant WebAuthn passkeys, TOTP authenticator codes or email one-time codes. Device intelligence flags unfamiliar hardware, sessions are monitored continuously, and your full security-activity history is visible in your account.
Step-up verification
Revealing card numbers, viewing a PIN, moving funds or changing security settings each require a fresh verification challenge at that moment — even in the middle of an active session. A stolen session cannot reach the things that matter.
Card security
3-D Secure protects online purchases, with one-time passcodes delivered directly to the cardholder. Card numbers and CVV are never shown without step-up verification, cards freeze instantly, and merchant-category and limit rules are enforced at the moment of authorisation.
Money movement
Outgoing payouts pass through review-and-approval controls before funds leave the platform. Transactions are screened, and a single real-time ledger keeps every balance consistent with every movement.
Data protection
Data is encrypted in transit with TLS and encrypted at rest. Sensitive credentials are protected with hardware-backed key management and envelope encryption, access internally is strictly controlled and audited, and we collect only the data we need.
Your part
What we ask of you
The strongest platform controls still depend on a few habits on your side. These four cover most of the ground.
Use a passkey
Passkeys cannot be phished, guessed or reused. Add one in your security settings and make it your default way to sign in.
Check the address bar
Only ever sign in at app.ecardpay.com. We will never ask you to sign in through a link in an unexpected email or message.
Never share codes
One-time codes are for your eyes only. No one from ECardPay will ever ask for a verification code, a PIN or a password — anyone who does is not us.
Review your activity
Your security-activity history shows every sign-in, device and sensitive action. If something looks unfamiliar, freeze your cards and contact us straight away.
Responsible disclosure
Found something? Tell us.
We welcome reports from security researchers. If you believe you have found a vulnerability in an ECardPay product, write to us with enough detail to reproduce it and we will investigate promptly and keep you informed.
Write tohello@ecardpay.com
Please give us reasonable time to remediate before any public disclosure, and do not access or modify data that is not your own.
Ready to move money without borders?
Open your ECardPay account in minutes. Verify once, then issue cards, open currency accounts and send payouts worldwide.