Fraud prevention and security

1. How we protect your account

• You sign in with a passkey on your device, so there's no password to steal. Where we've agreed to it, you can use codes from an authenticator app instead.
• Payments, crypto sends and other important actions need a second confirmation with your passkey.
• Payments from an account at our payment partner also need a code from the partner.
• On a business account, you choose who can view, prepare and approve. Only approvers, admins and owners can release payments.
• New crypto addresses, large transfers and unusual activity can trigger extra checks, a waiting period or a review by our staff.
• Data travels encrypted and is stored encrypted. Our staff see only what their role needs, and key decisions need a second staff member.

2. What we will never do

• Ask for your passkey, a sign-in code, an authenticator code or a payment code, by phone, email or message.
• Ask you to move money to a "safe account" or to a new address to protect it.
• Ask you to install remote access software.
• Send an identity verification link that opens anything other than a Sumsub or Gemba address.

Anyone who does any of these is not us.

3. Common scams

• Invoice and supplier fraud: an email says a supplier's bank details have changed. Check by phone, on a number you already have.
• Impersonation: someone claims to be from Valtora, a bank, the police or a tax office and pressures you to act fast.
• Investment scams: promises of high or guaranteed returns, often in crypto.
• Wrong network: crypto sent on a network other than the one shown for the address may be lost.

4. If something looks wrong

Tell us straight away through our contact form or the in-app chat if you think someone else has access to your account, a payment you didn't make appears, or you've been tricked into sending money. We may freeze your account to protect you while we check. Crypto transfers can't be reversed once sent, so speed matters.

5. Your part

• Keep your devices, passkeys, email account and authenticator app secure, and don't share them.
• Remove team members who leave your business.
• Check the payee, amount, currency and network before you confirm.

6. Reporting a security issue

If you find a security weakness in our website or platform, tell us through our contact form and don't test it on other people's accounts.