Security
What we will never ask you for.
Almost every loss to fraud begins with a payment the customer authorised themselves, while being told a convincing story. The most useful thing we can publish is a short list of things that are always a lie.
Nobody from this bank will ever ask for:
- Your password, in full or in part.
- Your card PIN.
- A one-time code we have sent you.
- Remote access to your computer or telephone.
- That you move money to a “safe account”. There is no such thing.
If a call, message or email asks for any of these, it is not us. End the conversation and telephone +370 5 210 4400 yourself, using a number you looked up rather than one you were given.
If something is wrong
What to do, in order.
- 1
Freeze the card
From the Cards screen in your dashboard. It stops every new authorisation immediately and can be undone.
- 2
Check your statement
Look for anything you do not recognise, including small amounts — a test charge often precedes a large one.
- 3
Telephone us
Call +370 5 210 4400. The line for lost and stolen cards is answered at any hour.
On our side
What we do to protect the account.
Payments are reviewed by a person
Money does not leave the bank automatically. Every outbound payment is released by a banker, which is deliberately slower than an instant transfer and is the single control that most reliably stops a payment made under pressure.
Passwords are never stored
We keep a scrypt hash — a one-way transformation with a deliberately high memory cost. Even with a copy of our database, recovering a password from it is impractical. It also means we genuinely cannot tell you what your password is, only set a new one.
Sessions can be ended
Sessions are held server-side rather than in a self-contained token, so we can end every session on an account the moment there is a reason to. Changing your password ends them all.
Every privileged action is recorded
Anything a member of staff does to your account — an adjustment, a freeze, a password reset — writes an entry naming who did it and when. That record is append-only and cannot be edited from inside the application.