Most accounts that get taken over are not hacked in any clever way. Someone is talked into handing over a code, or sends money to a person who isn’t who they claim to be. The settings below help, and so does knowing what the common scams look like.
Sign-in codes instead of passwords
TransferCove doesn’t use passwords. Each time you sign in, we email you a fresh six-digit code. It works once and expires quickly.
That removes the usual password problems. There is nothing to reuse from another site, and nothing to leak in someone else’s data breach. It does mean your email account is now the key to your TransferCove account, so protect it well: use a strong password there and turn on that provider’s own two-step verification.
A sign-in code is only for you to type into our site or app. Nobody else needs it, ever.
Passkeys
A passkey lets you sign in with Face ID, a fingerprint, your device PIN or a hardware security key. Your device keeps the private part and never sends it to us.
Passkeys only work on our real site. If a fake page copies our design and asks you to sign in, your passkey won’t work there. That makes passkeys the strongest option we offer against phishing.
To add one, go to Settings, then Security, and add a passkey. You can add more than one, like one on your phone and one on your laptop, and remove any you no longer use.
Two-step verification and recovery codes
Two-step verification adds a second code from an authenticator app at sign-in, after the emailed code. Someone who gets into your email still can’t get into TransferCove without your phone.
When you turn it on, you get 10 recovery codes, and we show them only once. Each one works a single time, in place of the authenticator code, if you lose your phone. Save them somewhere safe and separate from your phone: a password manager, or a printed copy at home. If you think someone has seen them, generate a new set in Settings. That cancels the old ones.
Signing in with a passkey counts as both steps, so you won’t be asked for the authenticator code as well.
Your PIN
Your 6-digit PIN confirms every payment: sending money, paying a request and withdrawing. Signing in alone isn’t enough to move money.
After 5 wrong tries, the PIN locks for 15 minutes. We store a salted hash of it, never the PIN itself, so not even our staff can see it.
Some habits that keep it useful:
- Don’t use your birthday, a run like 123456, or the same digit repeated.
- Don’t reuse your phone passcode or your bank card PIN.
- Don’t write it next to your email address or keep it in your notes app.
- Cover the screen when you type it in public.
If you forget it, or think someone knows it, reset it from Settings. We email you a code to confirm the reset, and the reset also clears any lockout.
Sessions and devices
Settings, then Security, lists every device signed in to your account, with when it was last used. If you see one you don’t recognize, sign it out. You can also sign out every other session at once.
It’s a good idea to check this list after you use a shared or public computer, after you sell or give away a phone, and any time something feels off.
Scams to know about
Overpayment and refund scams
Someone sends you more than they owe you, or pays you “by mistake”, then asks you to send the extra back. Often they ask you to send it to a different account, or through a different method. Later the original money turns out to be from a stolen account or a deposit that gets reversed, and the money you sent back is gone.
If someone says they overpaid you, don’t send anything yourself. Contact us and we’ll look at the payment.
Impersonation
Scammers pretend to be our support team, a delivery company, a landlord or a friend with a new account. They may use a @handle that looks a lot like the real one, or a display name copied from someone you know.
We block handles that imitate TransferCove or our staff, but we can’t catch every lookalike of every person. Before you send, check the name, photo and handle on the confirmation screen. If a friend suddenly asks for money from a new account, call them first.
Pressure to act now
“Your account will be closed in 10 minutes.” “Pay now or the deal is off.” Urgency is how scammers stop you from checking. A real problem with your account will still be there after you take a minute to look in the app yourself.
What we will never ask for
We will never ask for your PIN, a sign-in code, a recovery code or your authenticator code, whether by email, phone, text or chat. We will never ask you to move money to a “safe account”, or to install remote-access software.
Anyone who asks for any of these is not us, even if their message looks official or they know some of your details.
If something goes wrong
If you think someone else has access to your account:
- Go to Settings, then Security, and sign out every session.
- Reset your PIN.
- Secure your email account, since that’s where sign-in codes go.
- Contact us at support@transfercove.com and choose “Security” as the topic. We reply within one business day.
While we look into a problem, we may pause outgoing payments on the account. Money can still come in, and we’ll tell you what’s happening.
