Security at OnePay

Security at OnePay

At OnePay, your account security is important to us. We use different tools and strategies to keep your OnePay account secure.

Encryption

OnePay protects data with 256-bit AES level encryption. All accounts are protected by requiring multi-factor authentication for login, as well as a multi-layered risk and anomaly analysis of each login attempt. In addition, customers can use biometric identification, such as Face ID and fingerprint authentication, to open the OnePay app after their first login.

Notifications

OnePay customers may receive alerts regarding actions taken on their account. To receive these alerts, turn on notifications during account setup or in your phone's settings.

What is Phishing?

Phishing is when a scammer sends a message designed to trick a victim into revealing sensitive personal information or allowing the scammer to plant malicious software into the victim’s accounts.

Please be aware that OnePay will never ask for any sign-in information, such as your app Passcode or one-time verification code, full Social Security number (aside from when you open an account), or account passwords. Any email correspondence from OnePay will be sent from an address ending in @onepay.com.

Responsible Disclosure for Security Researchers

OnePay is committed to protecting the confidentiality, integrity, and availability of our customer's data. We value collaboration with the security research community and welcome reports of potential vulnerabilities through OnePay's Vulnerability Disclosure Program (VDP). Reports may be sent to responsible-disclosure@onepay.com. We ask all researchers to operate in good faith and to notify us as soon as possible once a potential vulnerability is found. We also ask that researchers adhere to the below rules:

• Do not publicly disclose vulnerabilities or discuss them outside the VDP without prior consent from OnePay.
• Do not perform denial of service (DoS or DDoS) tests or other tests that could potentially impair access to OnePay's systems.
• Do not perform tests or actions that have the possibility of viewing, modifying, or destroying other users' data.

Customer Service Inquiries

If you are a OnePay customer with a specific question about your account, you can get help by:

• Chat with us 24/7 in-app or say Agent in chat to be connected to a OnePay Specialist.
• Call us at (855) 830-6200 between 9 a.m. - 9 p.m. ET, 7 days a week.

How do I replace my Physical Card if it’s damaged, missing, or stolen?

You can request a replacement card in the OnePay app.

If your card is missing or stolen, reporting it will deactivate your current card to help reduce the risk of unauthorized transactions.

To replace your card

• Select the card icon from the Checking or Savings screen of the app
• Tap Replace card
• Choose the reason (damaged, missing, or stolen)
• Confirm your mailing address
• Select Replace My Card to submit

Your new card typically arrives within 7–10 business days. You can check its status by tapping Track card from the Home tab.

If your card was reported as damaged

• You can continue using your current card until you activate your new one.
• Your replacement card will have the same card number, but a new expiration date and security code (CVC).
• Your updated card details will automatically appear in the OnePay app. If your card is saved in Apple Pay or Google Pay, the updated details will reflect there as well.
• Most subscriptions and recurring payments may update automatically, but it’s a good idea to check with your providers to avoid interruptions.

If your card was reported as stolen

• Your current card will be deactivated.
• Your replacement card will have a new card number, expiration date, and security code (CVC).
• Your new card will appear in the OnePay app.
• You'll need to re-add your new card to Apple Pay or Google Pay. You can do this by going to Home > Checking > Card Details and tapping Add to Apple Wallet or Add to Google Pay.
• You’ll need to update any subscriptions or recurring payments with your new card details.

If your card was reported as missing

• Your current card will be deactivated.
• Your replacement card will have a new card number, expiration date, and security code (CVC).
• Your updated card details will automatically appear in the OnePay app. If your card is saved in Apple Pay or Google Pay, the updated details will reflect there as well.
• Most subscriptions and recurring payments may update automatically, but it’s a good idea to check with your providers.

Note: OnePay Retail Cards that have not been activated or are activated for limited use cannot be replaced.

How do I freeze or unfreeze my Physical Card?

If your card is lost or stolen, or if you notice activity you don't recognize, you can freeze your card in the OnePay app or on the OnePay website. Freezing your card helps prevent new card transactions from being processed.

There are two ways to freeze your cards:

To freeze your physical card only:

• Select Card Details from the OnePay Cash section of the app
• Turn Freeze Card on

To freeze all cards and payments (physical and virtual):

• Go to Home
• Select Checking
• Tap Card Details
• Select Freeze All Cards and Payments

Note: When Freeze All Cards and Payments is turned on, digital wallet, ATM withdrawal and transactions made through a mobile wallet will also be blocked.

To unfreeze, follow the same steps and turn Freeze Card off. Your card can be used for purchases again as soon as the freeze is removed.