When you accept money online you become a target. The good news is that a few simple habits stop almost all common attacks. Go through this list once and repeat it every few months.
Protect your account
- Turn on two-factor authentication. A password alone is not enough. Open Security and enable it with an authenticator app.
- Use a unique, long password that you do not use anywhere else, and keep it in a password manager.
- Check the address bar. Our website is
inzopay.com. Be careful with look-alike addresses and messages that ask you to log in through a link. - We never ask for your password, your two-factor code or any recovery phrase. Anyone who does is not us.
Protect your API keys
- Keep the secret key on your server only. Never put it in a web page, a mobile app or a public repository.
- Restrict each key to the permissions it needs and to your server addresses (IP allowlist).
- Rotate a key immediately if you think it was exposed, and delete keys you no longer use.
Protect your integrations
- Verify every webhook signature before you trust it, and reject old requests.
Protect your withdrawals
- Double-check the destination before saving a withdrawal address, and make sure it matches the network.
- Review your transactions regularly and report anything you do not recognise.
If something looks wrong
Change your password, rotate your keys and contact support right away. The sooner we know, the more we can help.