Security
Your money, properly protected
What we do to keep your account safe — and the handful of habits that make the biggest difference on your side.
How we protect you
Encrypted end to end
Every connection between your device and the bank is encrypted in transit. Your session is tied to a cookie that expires.
A separate transaction PIN
Your password signs you in; a different 4-digit PIN authorises every debit. Three wrong attempts locks the PIN for 15 minutes.
Verified account ownership
Every operation is checked against the accounts your profile is verified to own before it reaches the core banking system.
Nothing sensitive on screen
Your BVN, NIN and PIN are never shown in full anywhere in the app, and your PIN is never stored in a form we could read back.
Your own audit trail
Sign-ins, PIN changes and authorised payments are recorded on your profile so you can review them yourself at any time.
Confirm before you send
We resolve and display the recipient's real name from their bank, and summarise the transfer, before a single naira moves.
How to protect yourself
- Never share your password, transaction PIN or a one-time password (OTP) with anyone — including anyone who says they work for the bank.
- Use a password you do not use on any other website, and change it if you think someone has seen it.
- Avoid PINs that are easy to guess: repeated digits like 1111, sequences like 1234, or your year of birth.
- Check the recipient's name that we display before you approve a transfer. If it is not who you expect, stop.
- Log out when you finish, especially on a shared or public computer.
- Keep your phone number and email address current so our alerts actually reach you.
- Review the security activity list on your profile from time to time.
How to spot a scam
Fraudsters do not break encryption — they talk people into handing over their credentials. Treat any of the following as a warning sign:
- Someone calls or messages claiming to be from the bank and asks for your PIN, password or OTP. We will never ask for these.
- You are told your account will be blocked unless you act immediately. Urgency is the oldest trick there is.
- You are sent a link asking you to 'reconfirm' your BVN or account details. Type the address yourself instead of tapping the link.
- Someone sends you money 'by mistake' and asks you to send it back to a different account.
- You are asked to receive money into your account for a stranger. That is money laundering, and it is your name on the account.
Reporting a security issue
If you are a security researcher and have found a vulnerability in Stark App, please report it privately to support@tudunwadamfb.com.ng with enough detail for us to reproduce it. Please do not access, modify or retain any other customer's data while investigating.
Our privacy policy explains what we collect and why, and our terms of service set out your responsibilities for keeping your credentials safe.