Security

Lorapay moves money, sometimes through other people's phones. Here is what protects every payment, what we will never ask you for, and how to tell us about a security problem.

Payments without internet

When you pay with no signal, your phone builds the payment and protects it in three ways before it leaves:

• Sealed for Lorapay only. The payment, including your PIN, is encrypted on your phone with a key only Lorapay's server holds. Phones that pass it along see a sealed packet: not the amount, not who you're paying, not your PIN.
• Signed by your phone. Your phone signs every payment with its own key, registered to your account. A payment changed by even one character on the way is refused.
• Sent once, paid once. Every payment has its own number. A copy delivered twice, or through two different phones, is paid only once, and old payments can't be replayed.

When it reaches Lorapay, it goes through the same checks as a payment made online: your PIN, your balance, your limits and the recipient. Nothing moves if any of them fails, and the answer travels back to your phone sealed and signed by Lorapay.

Protecting your account

• Your PIN for every payment. Five wrong PINs pause payments for 30 minutes, and ten in a day pause them for 24 hours. Wrong PINs typed on someone else's phone can't lock your own phone out.
• A pause after a PIN reset. If your PIN is reset, payments are held for 24 hours and we tell you by SMS and email, so a stolen SIM can't be used to empty your account straight away.
• New phones need an SMS code. Logging in on a new phone needs your PIN and a code sent to your number.
• Signing out removes the phone. A phone you sign out of can no longer send payments for you, even without internet.
• Limits. Payments sent without internet have lower limits than online ones, and every account has a daily total.

What we will never ask for

Lorapay staff will never ask for your PIN, the codes we send by SMS, your BVN, or your card details, by phone, SMS, WhatsApp, email or social media. Anyone who asks is not from Lorapay. Don't share them, and tell us at hello@lorapay.io.

Report a vulnerability

If you think you've found a security problem in Lorapay's app, website or servers, please email security@lorapay.io with what you found and how to reproduce it. We'll reply within three working days and keep you updated until it's fixed.

Please

• Only test with your own account and your own money, and never access or change other people's data.
• Don't run tests that could disrupt the service for others (denial of service, spam, jamming Bluetooth in public places).
• Give us reasonable time to fix the problem before telling anyone else.

Our promise

If you follow these rules in good faith, we won't take legal action against you for your research, and we'll credit you when the fix ships if you'd like. [Bug bounty: state whether you pay rewards, and how much.]

Our security.txt has the same contact details for automated tools.