How Kit Pay protects your account

Good security is layers, not a single wall. Kit Pay assumes any one thing can go wrong — a phone gets stolen, a password habit is weak, a scammer is convincing on a bad day — and puts independent checks between each failure and your money.

Getting in is not the same as moving money

Opening the app and spending from the wallet are deliberately separate. Signing in proves the device and number; moving money asks for more. Sensitive money actions require approval tied to what you are doing, using your wallet PIN or supported device security — an approval given for one payment cannot be replayed to authorise a different one, because it is bound to that specific action.

The layers, briefly

• Phone-number verification with one-time codes proves control of the SIM when you sign in on a device.
• Intent-bound approval — wallet PIN or supported device security — guards each sensitive money action.
• Sessions are visible and revocable, so a forgotten sign-in on an old phone can be ended from the phone in your hand.
• Every movement of money is written to a double-entry ledger as a new entry — the record grows rather than being rewritten, so history stays a faithful account.
• Support lives only inside the signed-in app, so there is no public inbox for impostors to imitate.

The layer only you can provide

No design survives a shared PIN. The system is built so that Kit Pay staff never need your PIN or your codes — which means anyone asking for them has told you exactly who they are. Keep the PIN private, glance at review screens before approving, and report anything odd from inside the app. Scam warning signs shows the patterns to watch for.

Security also improves in stages, like everything else on Kit Pay: identity verification is being prepared to ready accounts for regulated services before those switch on. The app announces what applies to your account as it changes.