Before you can move any money, we verify your identity with our verification partner, Didit. You photograph a government-issued ID, such as a national ID, driving licence or passport, and take a quick selfie with a liveness check, so a photo of someone else can't pass.

Until you're approved, your account can't deposit, withdraw, send, exchange or pay. Verification results reach us signed, so they can't be forged on the way. That means the people you send money to on DCash are verified too.

Set a 4-digit transaction PIN and DCash asks for it every time money leaves your wallet: transfers, withdrawals to mobile money, bill payments and merchant payments. Even someone with your phone and password can't move money without it.

• Wrong guesses lock it. After 5 incorrect attempts your PIN is locked for 5 minutes, then 10 minutes after 8, and 30 minutes after 10.
• Changing it needs the old one. Setting your first PIN needs your password; changing or removing it needs your current PIN.
• We only ever store it scrambled. Your PIN is hashed, so no one at DCash can read it.

The PIN is optional, but we strongly recommend it. Turn it on in Profile → Accounts & payments → Transaction PIN. Forgotten it? Contact support and, once we've confirmed it's you, we'll remove it so you can set a new one. We email you when that happens.

Turn on two-factor authentication and signing in takes your password plus a 6-digit code from an authenticator app like Google Authenticator, Microsoft Authenticator, Authy or 1Password. The code changes every 30 seconds, so a stolen password alone isn't enough.

• Strong passwords. At least 8 characters, with upper- and lowercase letters, a number and a symbol. Passwords are stored hashed, never in plain text.
• Guessing gets locked out. Repeated wrong passwords lock sign-in for 5 minutes, then 10, then 30.
• Face ID and Touch ID on iPhone. Your saved sign-in stays on that phone, and stops working if a new face or fingerprint is added.
• Automatic sign-out. Sessions expire, and the iPhone app signs you out after 30 minutes in the background.

When you add a wallet such as M-Pesa, Airtel Money or MTN MoMo, we text a 6-digit code to that number. It only works for about 5 minutes, and the number can't be used for deposits or withdrawals until you enter it.

You can review, edit and remove your connected numbers any time in Profile → Payment service providers.

Before you confirm a deposit, withdrawal, transfer, exchange or payment, DCash shows you where the money comes from, where it's going, the amount, the exchange rate, the fee and the limits that apply. You'll always see the exact cost before you confirm.

Each currency has minimum and maximum amounts, checked on both sides of an exchange, so an unexpected amount can't slip through.

Every transaction appears in your history with its status, and you can download an official DCash receipt for it. If something ever looks wrong, you'll have the details to show us.

When you link Deriv, you sign in on Deriv's own page and approve the connection there. DCash never sees your Deriv password. The link uses industry-standard OAuth with extra protection against interception, and an unfinished link-up expires after 30 minutes.

Withdrawals from Deriv also need a code that Deriv emails you, so money can't leave your trading account without your approval.

Connections between the DCash apps, our servers and our payment partners are encrypted. PINs and passwords are only ever stored hashed, and messages from our verification and payment partners are signed and checked before we act on them.

We email you when something important changes on your account: when your identity is verified, if your PIN or two-factor authentication is removed, and if your account's status changes. If you didn't expect one of these emails, contact us straight away.

Most fraud doesn't break in; it talks its way in. Scammers pose as support staff, buyers or even friends to get you to hand over a code.

• DCash will never ask for your PIN, password, two-factor code or SMS verification code by phone, text, WhatsApp or email.
• Only sign in through the DCash app or app.dcash.africa. Check the address before entering your password.
• Be wary of anyone who asks you to send money to "verify" or "unlock" your account, or who rushes you.
• Turn on your transaction PIN and two-factor authentication. Together they stop most account takeovers.

If you notice a transaction you don't recognise, think someone has your password, or received a suspicious message claiming to be from DCash, contact us right away. We can lock your account while we look into it.

Email

support@dcash.africa

WhatsApp

+254 705 333 888

Phone

+254 705 333 888

Looking for how-tos? Visit the help center.