Security

Last updated: 6 October 2026

The short version

Every withdrawal, bill payment and new bank account needs your transaction PIN or fingerprint/face.
Signing in on a new device needs a code sent to your email.
Every withdrawal needs your PIN or fingerprint, and we show you the account name from the bank before money leaves. Bank transfers can’t be reversed, so check it’s the right person.
Egoyibo staff will never ask for your password, PIN or the codes we email you.

1. Protecting your account

Transaction PIN. You set a 4-digit PIN when you join. Easy-to-guess PINs such as 1234 or 0000 are not allowed. After 5 wrong attempts your PIN is locked for 30 minutes.
Fingerprint or face. In the Egoyibo mobile app you can approve sign-ins and payments with your phone's biometrics instead of typing your PIN. Your fingerprint or face never leaves your phone.
New-device confirmation. The first time you sign in on a phone or browser, we email you a one-time code. Codes expire after 10 minutes and stop working after 5 wrong tries.
Your devices. Me → Devices lists every phone and browser signed in to your account. You can remove any you don't recognise.
Automatic sign-out. If you are inactive for 5 minutes, Egoyibo locks and asks for your PIN, fingerprint or face again.
Bot protection. Sign-up is protected against automated account creation, and sign-in, PIN and code checks are rate-limited.

2. Protecting your money

Card payments by our payment partner. When you top up by card, your card details are entered on our payment partner's secure checkout. Egoyibo never sees or stores your full card number.
Own-name payouts only. Naira withdrawals can only go to a Nigerian bank account whose name, as confirmed by the bank, matches your Egoyibo account. You can save up to 3 accounts, and adding one needs your PIN or biometrics.
Reviews before unusual payments. Withdrawals that match a sanctions list or a blocked bank account are held for a person to review. See our AML & Fraud Policy.
Every balance change is recorded. Your balance is kept as a ledger: each top-up, withdrawal, bill payment and refund is a separate entry with its own reference.

3. Protecting your data

All connections to Egoyibo use HTTPS encryption.
Passwords and PINs are stored only as one-way hashes, so nobody, including our staff, can read them.
Your NIN is encrypted in our database. Verification selfies are kept in private storage, and their backups are encrypted.
Staff use a separate admin system with its own accounts. Only authorised staff can see customer data, and staff actions such as approvals, freezes and balance adjustments are logged.

4. What you can do

Use a password you don't use anywhere else, and protect your email account with two-step verification.
Never share your PIN, password or email codes with anyone, including someone who says they work for Egoyibo.
Only sign in at app.egoyibo.com or in the official Egoyibo app. Check the address bar before you type your password.
Use a screen lock on your phone.

More tips: Keep your Egoyibo account safe.

5. If something goes wrong

If you think someone has accessed your account, change your password and PIN straight away, remove unknown devices in Me → Devices, and email [email protected] from your registered email address with the subject line "Account security".

6. Reporting a security vulnerability

If you have found a security weakness in Egoyibo, please email [email protected] with the subject line "Security report" and enough detail for us to reproduce it. Please give us a reasonable time to fix it before telling anyone else. Do not access other people's accounts or data, disrupt the Service or move funds while testing. We don't currently run a paid bug bounty, but we will thank you and keep you updated on the fix.