Payment confirmation

🌐

Lee esta página en español

Signing in to your account and moving money in D-ONE CASH now ask for two confirmations from you.
This page explains what they are, how to turn them on and — most importantly — what to do if you
lose one.

---

Why two, and not one

Once both confirmations are active, your email is no longer enough to send or withdraw your money. If
someone got into your inbox, a single confirmation would give them everything they need.

We follow the European strong customer authentication (SCA) rules, which require two factors of
different kinds for payment operations. That's why we ask for:

Being different kinds is exactly what makes them strong: whoever steals your phone doesn't know your
PIN, and whoever watches you type the PIN doesn't have your phone.

⚠️

We will never ask for your PIN by email, phone or chat. If someone does, it isn't D-ONE

CASH. Email us at [email protected].

---

How to turn them on

Go to Settings → Security and payment confirmation, section Payment confirmation. You'll see
both steps.

If you sign in as a team member of a Business Panel, your confirmations are your own: you reach that
screen from Security settings ›, at the bottom of the panel.

1. The passkey first

Press Add. To register your first confirmation we verify that the email is yours: we send you a
6-digit code, you type it in Code we sent to your email and press Confirm and add. That code
arrives in your inbox: it is not your PIN or a number you choose. Then your device
will ask for your fingerprint, your face or the device's own PIN, and create the key. There's nothing
to invent or memorise: your device keeps it.

If the code doesn't arrive or has expired, press Send another code. And if you cancel your device's
dialog, that code has already been used: press Add again and we'll send you a new one.

🖥️

Your browser doesn't support passkeys? You'll see a notice on that same screen. Try an

up-to-date Chrome, Safari or Edge or, if you can't switch browsers, email us at
[email protected].

2. Then the PIN

The PIN field only appears once you have a passkey. That's on purpose: the order matters. With
the key in place, pick 6 digits and confirm them.

We'll ask for your passkey to save it. That way, someone who only had your open session couldn't set
a PIN behind your back.

💡

Avoid easy PINs. We reject 123456, 000000 and 654321: they're the first ones anyone

tries.

3. Register a second passkey

As soon as you have both confirmations, add another key on a different device (Add another). This
isn't a polite suggestion: if you lose the only one you have, regaining access is much slower. With a
second one, you solve it yourself in a minute.

Since both are already active, when you press Add another we'll ask for your PIN and a passkey you
already have.

---

What happens from now on

When you send money, withdraw to your bank (withdrawals also from Withdraw in the
Business Panel), pay payroll (right away or by approving a request), schedule payroll, or
sign a pending payroll cycle, we'll ask for both on every operation: first your PIN, then your
passkey. Nothing else — no email or SMS codes.

That confirmation is valid only for that exact operation: the amount and destination for a
transfer or withdrawal, or the full list of employees and their amounts for a payroll run. If anything
changes before it completes, the operation doesn't go out and you'll need to confirm it again.
Confirming a possible duplicate payroll (Yes, pay anyway) doesn't skip this step: that payment asks
for both too.

We'll also ask for both on each action when you add a contact, register a new bank
account, add an employee, invite someone to your team, change their role or revoke their
access, create or revoke an API key, register or delete a webhook and delete your
account. Deleting a contact doesn't ask for them.

Withdrawing to a bank account you've already used takes one confirmation; to a new account,
two: one to register it and one for the withdrawal.

To send payroll for approval, reject an approval request, and remove employees or
resend their KYC, we don't ask for them on each action, but you need to have them turned on.

If you haven't turned them on yet, those operations won't complete and you'll see: “Set up your
passkey and PIN in Settings → Security to continue.”

🔒

If you enter a wrong PIN 5 times in a row, you'll have to wait 15 minutes before trying

again. The app tells you how many attempts you have left.

---

When you sign in

To see your balance, your activity or any other part of the app we ask for both confirmations when you
sign in: first your PIN, then your passkey. We ask for them again in two cases:

• after 5 minutes without touching the screen (no mouse movement, typing or tapping), we cover it
  completely: for your security we stop showing your account, and anything you had half-done on that
  screen is lost. When you confirm, you're back on the same screen;
• if 5 minutes go by without you doing anything that reaches our server —opening a screen, sending,
  saving—, the session expires even if you were typing into a form or looking at your balance: automatic
  refreshes don't count. We ask for your passkey and PIN the next time the app talks to our server (when
  you press a button, or sooner if the screen refreshes on its own); whatever you had on screen is still
  there and, if you pressed a button, the operation goes on.

Also:

• If you haven't turned them on yet, you'll see a notice with a link to this guide and a Set up now
  button that takes you to Settings → Security. When you finish, we ask once for the passkey and PIN you
  just created and take you back to the screen you were on.
• If you lost your passkey or your PIN, tap “Lost your passkey or your PIN?” in that same window: it
  takes you to Settings → Security, where you can report the loss (below).
• If you have an access recovery in progress, you'll see that it's underway, how to email us and a link
  to see which step it is at. Once you confirm your passkey and PIN in Settings → Security (for example,
  when you finish registering them again with the recovery code), you can see your account again; but until
  the recovery ends, your money can't leave and sensitive changes stay blocked (below).
• If your browser doesn't support passkeys, we can't let you in from it: try another browser or device,
  or email us at [email protected].
• If your subscription isn't active and you haven't registered any passkey yet, we can't send you the code
  to do it: renew your plan on the Plans page with this same email, or
  email us at [email protected] and we'll help you.

Every one of these windows has a Sign out button.

---

Changing your PIN

In Settings → Security and payment confirmation → Change your PIN. We'll ask for your current
PIN and your passkey: knowing the PIN is not enough to change it.

⏳

After the change, money transfers out pause for 72 hours.

This is deliberate. If someone managed to change your PIN, those 72 hours are your window to
notice and tell us before anything can leave. It cannot be cancelled — not by you, not by us —
and it lifts on its own. During that window you also can't add contacts, bank accounts or
employees, invite team members, change a member's role (except to "Read-only"), create API keys or
webhooks, or close your account. You can still remove access. You can keep receiving money normally.

If you have an urgent payment, make it before changing your PIN.

---

Removing a passkey

If you lose a device or stop using it, go to Your passkeys, find the key by its date and press
Remove. We'll ask for your PIN and one of your keys.

You can't remove the last one: being left with none isn't solved by deleting, but through access
recovery (below).

---

🔴 If you lose a confirmation

This is the important part, and the one worth reading before you need it.

You lost your phone, or forgot your PIN

Go to Settings → Security and payment confirmation → Access recovery and press I lost a
confirmation.

We'll ask for the one you still have:

• Lost the passkey → confirm with your PIN.
• Forgot the PIN → confirm with your passkey.

The moment you report it, your money can no longer leave: withdrawals, transfers and payroll are
blocked. Sensitive changes in the Business Panel, such as those in Team, Employees,
Integrations and Treasury, and deleting your account are blocked too. In a Business Panel the
block applies only to you: other team members with permission to move money or make those changes can
still do so, although the scheduled payrolls you created don't run while the recovery stays open.
You can still receive. We'll contact you to verify your identity and restore access.

The 5 steps of recovery

On that same screen you'll see which step you're on, with the same numbers support uses:

1. Report that you lost a confirmation. You do it yourself, by reporting it.
2. Support checks who you are and approves. Nothing for you to do: we'll call or write through
   the channel you agreed on.
3. A second support agent hands over the code. At that point your current confirmations stop
   working.
4. Register your two confirmations again. Your turn: paste the code in Recovery code and
   register your passkey and PIN again just like the first time, including the 6-digit code that
   reaches your email. The recovery code expires after 24 hours; you'll see the date on screen. If
   the app asks you to sign in again, that's expected: sign in with your email and paste the code
   again.
5. Support closes the recovery and you can move money again.

⚠️

We give you the recovery code by phone or video call. We will never ask for it or send it by
email.

It was a mistake

If you reported it by accident, you still have both confirmations and support hasn't handed you
the code yet, press It was a mistake, cancel. It will ask for both and the recovery will be
cancelled immediately (if you had a pause from a PIN change, it stays until it ends).

Reporting the loss closes the sessions you already had open, so it's normal for the app to ask you to
sign in again with your email after you confirm: sign in and press it again. Cancelling closes the
ones on your other devices; on the device where you cancel, you stay signed in.

You lost both

Then there's nothing you can present — and rightly so: if asking were enough, it would also be enough
for whoever stole your account. Email us at [email protected]. We'll verify your identity on a
video call, open the recovery for you, and you'll follow the same steps to register new
confirmations.

---

Why your other sessions get closed

When you register your first passkey, change your PIN, remove a passkey, report a loss or cancel it, the
sessions open on your other devices stop working: they can no longer see your balance or activity or
move your money, and as soon as they try they'll have to sign in again with your email. The same happens
when support hands you the recovery code and when it closes the recovery.

It may feel inconvenient, and it's exactly what we want to happen: if someone had your session open
somewhere else, reacting has to stop them from seeing your balance and activity and from moving your
money. On the device where you register your
first passkey, change your PIN, remove a passkey or cancel a loss, nothing happens to you — you've just
proved it's you. When you report a loss, though, you'll also need to sign in again on that device.

If you suspect someone has your session open, report a loss (above) and email us.

---

Questions?

[email protected]. We email you every time a passkey is registered or removed, your PIN is
changed or an access recovery is opened on your account. If you get one of those alerts and it wasn't
you, or you think someone has got into your account, email us before doing anything else: the
sooner we know, the sooner we stop it.