Securing Your VTU Business: A Practical Checklist

A VTU business holds other people's money and moves it quickly, which makes it a target for fraudsters. Most losses come from a few well-known tricks, not from clever hacking. This checklist covers the protections built into the platform, including what each one does and does not do, and the habits you need to add yourself.

Protections the platform gives you

Transaction PIN. Turn it on under Settings, then Transaction PIN. It is off until you switch it on. Once it is on, customers must set a PIN of 4 to 6 digits before they can buy, and then every purchase on your website needs it. Changing a PIN needs the current one, and a customer who forgets it can reset it with a code sent to their email. This protects a customer whose phone is borrowed or stolen. Two things to know: the PIN is not asked for on the developer API, which has its own keys, and wrong guesses are slowed by the request limits below but do not lock the account. So encourage customers to choose six digits that are not a birthday or a repeated number.

Request limits. The platform limits how fast any one source can try things, which blunts guessing and abuse. Sign-in and sign-up attempts are limited to 10 a minute, password reset codes to 6 a minute, purchases to 40 a minute, wallet funding to 20 a minute, the public developer API to 90 a minute, and settlement requests to 5 a minute.

Banned customers and numbers. You can ban a customer's account, and a ban takes effect immediately: someone already signed in is cut off, and any API key they hold stops working. In the Zenith admin you can also block phone numbers from registering or receiving purchases. See managing customers and wallets. Ban rather than delete, so the records you need in a dispute are kept.

Payment notifications are checked. For Paystack, Monnify, PaymentPoint, Billstack and PocketFi, every payment notification carries a signature that the platform checks against the secret key you saved. If the secret is blank or the signature is wrong, the notification is rejected, so nobody can credit a wallet by posting a fake "payment received" message to your address. Flutterwave notifications are never trusted on their own: the platform asks Flutterwave whether the payment really happened first. PalmPay notifications are rejected outright for now. Save every secret key, as explained in the payment gateways guide.

Slow providers do not cost you twice. When a provider takes your order and then goes quiet, the purchase is held for your confirmation instead of being refunded straight away, because refunding an order that was actually delivered would mean paying twice. You confirm or refund it, or it is refunded automatically after a wait you set. A refund can only be applied once, so a double click cannot pay a customer back twice.

Settlement bank account protection. If you use the Xpiria Biz settlement feature, changing the bank account where your money is paid out is deliberately hard. Only a site admin can do it. It needs a fresh code sent to your email and your password. You also get an alert email, and a waiting period of 24 hours starts before you can withdraw to the new account. Each withdrawal needs a further code, and all of this is logged. That sequence is built to stop someone who gets into your account from quickly redirecting your money. Do not weaken it by sharing codes or leaving your email open on shared devices.

Project-scoped API keys. Customer API keys belong to one project and are tied to that customer's wallet. They only work if your site plan includes API access, and they stop working if the customer is banned.

What the platform does not do

• The BVN/NIN step is not identity verification. When a customer enters a BVN or NIN, the platform checks only that it is exactly 11 digits and then marks them verified. It does not check the number against any bank or government record. It exists so that gateways that need those details can create a dedicated account. Treat it as collecting information, not as proof of who someone is, and handle what you collect carefully. Our guide on the NDPR explains your duties.
• Admin sign-in has no second factor. Two-step login is not currently offered on VTU site admin accounts, so your email is your strongest lock.
• Admin access is all or nothing. There are no partial permissions, so every admin can see and change everything.
• It cannot judge a manual deposit. A receipt image is just a picture. Only your bank account can tell you whether the money arrived.

What you must do yourself

• Protect the email you log in with. Your email receives your codes and resets. Use a strong, unique password and switch on two-step verification for the email account itself.
• Give admin access sparingly. Remove it when someone leaves, and review the list monthly.
• Never share codes. No genuine support person will ask for a one-time code or a password.
• Keep a limited balance with your provider. Top it up as needed instead of leaving a large amount sitting there.
• Reconcile daily. Compare your provider's statement with your Transactions list. Early detection limits losses.
• Be careful with manual approvals. Confirm funding in your own bank app before you approve a screenshot. See accepting manual transfers.
• Keep your gateway and provider keys private. If you think a key was exposed, replace it straight away in the provider's dashboard and paste the new one in your admin.

The scams to expect

Fake "funding alerts", messages that pretend to be from your provider or support, and attempts to take over your phone number are among the most common attacks. Our guides on how VTU owners actually get scammed, SIM swap fraud, WhatsApp impersonation scams and two-factor authentication explain what they look like and what to do.

If something looks wrong

• Change your password, and your email password, from a device you trust.
• Check recent wallet adjustments, funding approvals and any change to your settlement details.
• Ban any account you suspect, which now stops it at once, and remove admin access you do not recognise.
• Contact your provider and gateway if keys may have been exposed.
• Tell support quickly, with transaction references.

A monthly check

Once a month, review who has admin access, whether your PIN setting is on, how many banned numbers you have and why, which gateways have a secret key saved, and when you last changed your main passwords. Scan your Transactions for held purchases and unusually large wallet adjustments, and make sure each one has an explanation.