Software Security

• Ensure that you’re running the most recent version of the Xapo Bank mobile application downloaded directly from either the Apple App Store or the Google Play Store.
• Ensure that your mobile device and computer are up to date with current operating system and malware protection software.

Device Security

We encourage the use of robust passcode, screen lock, and data protection security configurations on your mobile device in order to limit the risk of account compromise.

Browser Security

Make sure that you’re accessing our website via the secure https:// address in your browser window:

It should look like this: https://www.xapo.com/

If you spot a Xapo webpage which is using an unsecure http:// address, please avoid using it and report it to our customer support team because it may be an illegitimate and malicious website.

Secure Storage

Do not write down your sensitive information (e.g. your password, PIN and card number) and avoid the local unencrypted (plain text) storage of this information on your devices in order to avoid compromise in case of a lost or stolen device.

Wireless Connections

We discourage the use of publicly accessible WiFi and Bluetooth connections and we recommend verifying that private WiFi connections are enforcing wireless encryption security standards such as WPA2 and WPA3.

Phishing and Smishing

Bad actors may try to obtain your password or login credentials through fraudulent emails, SMS or forged websites. This type of malicious activity typically includes links that redirect to a simulated website, which may prompt you to provide sensitive information. These sites often replicate the design of the original legitimate service and are purposely designed to steal your sensitive information:

• Ensure that the website you’re browsing is in fact part of the xapo.com domain and secured by https://. For more information about this check our Safe Communication section.
• Remain cautious about your online activity and avoid clicking on suspicious links in emails or text messages. We will never ask you for sensitive information such as your password, your PIN or your card number by email or SMS. If you are unsure about the legitimacy of a communication sent to you, please contact our customer support team before proceeding.
• Pay attention and look for small typos in the URL of a web address. A common practice by criminals is to run websites with URLs that at a quick glance may seem legit but inspected closely include minor variations of the original web address.
• If you detect a Xapo Bank impersonator who may be asking for your sensitive information, please take a screenshot and report them to our customer support team so that we can take action and prevent other customers from being targets of the same malicious activity.