Security
Your money is safe here. Here's exactly why.
No vague promises and no badges. These are the actual rules LBPay follows, written in plain language so you can check them yourself.
Your account
Only you can get in.
Verified email
Every new account confirms its email with a 6-digit code before it can move money.
Password and PIN
Sign in with your password, then your 4-digit PIN. Two different things you know.
Stored so no one can read them
Passwords and PINs are kept as salted scrypt hashes. Even with full database access, nobody can see them.
Lockout on wrong guesses
Four wrong PIN attempts lock your PIN for a while, so it can't be guessed.
Sessions that close themselves
On the web, LBPay signs you out after 15 quiet minutes. In the app, coming back asks for your PIN.
Secure cookies
Your session lives in an HTTP-only cookie that page scripts can't read, sent only over HTTPS.
Your money
Every franc is accounted for.
Your PIN on every payment
Sending, withdrawing and paying all need your PIN. No exceptions, no saved approvals.
A ledger entry for each move
Every movement is recorded with its own reference, amount, fee and status, so your history always adds up.
Automatic, one-time refunds
If MTN or Orange rejects a payout, the amount and fee return to your wallet, exactly once, never twice.
Fees before you confirm
The fee and the total are on screen before you enter your PIN. What you see is what you pay.
Daily limits
Until your ID is verified, outgoing transfers are capped at 500 000 XAF a day, and each Mobile Money payout at 500 000 XAF.
Established payment networks
Mobile Money payments run on the MTN Mobile Money and Orange Money networks through our payment processing partner.
Our side
Rules for us, too.
Verified businesses
Business accounts are reviewed by a person before they can collect payments from the public.
Fresh code for staff access
Our operations console asks for a new one-time email code every time someone on the team opens it.
Every staff action is logged
Freezes, corrections and reviews are written to an audit log with who did it and when.
API secrets stored hashed
Developer secret keys are stored as hashes. Sandbox keys can never move real money.
Your part
The one rule that beats every scam.
Your PIN is yours alone. Nobody from LBPay will ever ask for it.
- 1LBPay will never ask for your PIN, password or email code by phone, SMS or WhatsApp.
- 2Only enter your PIN inside the LBPay app or on the lbpay website you opened yourself.
- 3Check the name and the total on the confirm screen before you enter your PIN.
- 4If something looks wrong, contact us right away so we can freeze the account while we check.
Something wrong with your account?
A payment you don't recognise, a lost phone, or a message pretending to be us. Open Support in the app or email us. Tell us your @handle, never your PIN.
Contact securityFound a vulnerability?
We welcome reports from security researchers. Send the details privately, give us reasonable time to fix it, and don't access other people's data. We'll reply and credit you if you'd like.
Report responsiblySafe by design. Simple by choice.
Open your free account and see every rule above working for you.