Loading
Security centre
Security is mostly unglamorous engineering. Here is the specific work, rather than a promise to take it seriously.
Your refresh token is replaced every time it is used and stored only as a hash. If an old one is ever presented, every session in that family is revoked immediately — because the only way that happens is theft.
Revealing a card number, adding a payee, moving a large sum or changing a security setting all require a fresh second factor. A stolen session is not enough.
Freezing a card, blocking a category or capping a channel is enforced during authorisation, not merely recorded. A control you can see but that does not decline is worse than none.
A newly added payee is capped for four hours. This single control stops most authorised-push-payment fraud, where an attacker with your session adds their own account and empties the balance in one move.
Every risk decision carries the rules that fired and what each contributed. If we hold a payment, you are told why in plain language, not given a reference number.
Every privileged action is appended to a hash-chained log. Altering a past entry breaks the chain, and the chain is verified nightly.
ICB will never ask for your password, your PIN, a one-time code, or the full number on your card. Not by phone, not by email, not by message. Anyone who does is not us, regardless of what the caller ID says.
ICB will neverask you to move money to a “safe account”. There is no such thing. A request to do so is fraud, without exception.
Emails from us come from a verified ICB domain and never carry an attachment you did not request. If a message asks you to act urgently, that urgency is the warning sign.
Eligible deposits are protected up to 250,000 per depositor. Protection covers the total across all your ICB accounts, not each one separately. How deposit protection works.