Security

1. How Taco Pay works

Taco Pay is a technology platform, not a bank. We provide the app you use to manage prepaid virtual cards and add funds to them. The cards themselves are issued, and card payments processed, by third-party providers.

2. Protecting your account

• Email confirmation: your email address is confirmed with a code when you sign up.
• A code at every sign-in: each login is confirmed with a one-time code sent to your email.
• Hashed passwords: passwords are never stored in plain text.
• Password reset by code: resetting your password requires a code sent to your email.

3. Identity verification

Before you can add funds or request cards, you complete identity verification with an identity document and a selfie, through a specialised third-party provider. This helps keep fraud and stolen identities off the platform.

4. Protecting your cards

• Your full card number and security code are shown only after you enter a fresh code sent to your email.
• You can freeze a card at any time and unfreeze it when you need it.
• You can remove a card you no longer use.
• Cards are prepaid: payments use only the balance you have loaded onto the card.

5. Safe top-ups

• Agent top-ups go only to authorised agents listed in the app, and are checked against your proof of payment before funds are credited.
• USDT top-ups use the deposit address and network shown in the app for your top-up.
• Only follow payment instructions shown inside the Taco Pay app. If anyone asks you to pay through another channel, do not pay and contact us.

6. What you can do

• Never share your password or one-time codes with anyone, including people who claim to be from Taco Pay.
• Sign in only at app.tacopay.co and check the address before entering your details.
• Keep your email account secure, since the codes we send go there.
• If you notice anything unusual, freeze your cards and contact us.

7. Reporting a security issue

If you believe you have found a security vulnerability in Taco Pay, please email us with the details. Act in good faith: do not access other people's data, disrupt the service or make the issue public before we have had a chance to fix it.