Our approach
Security is layered. No single control stops everything, so we assume each one can fail and design so that an attacker has to defeat several at once.
Encrypted end to end
Data is encrypted in transit and at rest. Credentials are one-way hashed and card data is tokenised, so neither can be read back — by anyone, including us.
Strong authentication
Two-factor authentication protects sign-in and every payment. New devices complete full verification before they can transact.
Continuous monitoring
Transactions and login attempts are scored in real time. Unusual patterns are held for review rather than executed and regretted.
Least-privilege access
Staff access is role-based, granted only where a job requires it, logged, and reviewed. No individual can act unilaterally on a customer account.
Independent testing
Our controls are independently assessed and penetration tested, and findings are tracked to closure.
Segregation and resilience
Environments are segregated, backups are tested, and we rehearse our incident response rather than improvising it.
What we will never ask you for
If someone asks for any of these, it is not us
End the conversation. Then contact us using the number on our contact page or the back of your card — never a number supplied by the person who called you.
- Your password, or any part of it.
- Your card PIN.
- A one-time passcode or authenticator code.
- Your full card number and security code over the phone or by email.
- To move money to a "safe account", a "holding account" or any account we name for you.
- To install remote access software so we can "fix" or "check" something.
- To pay a fee, tax or clearance charge in order to release a transfer, a loan or an inheritance.
- To buy gift cards or cryptocurrency for any reason.
We may call you about unusual activity. When we do, the conversation only ever goes one way: we ask you to confirm whether a transaction was yours. We will never ask you to move money, share a code, or grant access to your device.
Caller ID proves nothing
Displayed numbers can be forged to show our real number. Treat urgency and secrecy as the warning signs themselves — genuine security matters can always wait the two minutes it takes you to call us back on a number you found yourself.
The habits that matter most
Use a unique password
Most account takeovers begin with a password leaked from an unrelated website. Your banking password must exist nowhere else. A password manager makes this effortless.
Turn on two-factor authentication
An authenticator app is stronger than SMS because it works without signal and cannot be intercepted by a SIM swap. Save your backup codes offline.
Reach us by typing the address
Never get to your bank through a link in a message. Typing the address or using your own bookmark defeats every phishing email ever written.
Keep devices updated and locked
Most attacks exploit flaws that were already patched. Install updates promptly and lock every device with a PIN or biometric.
Review devices and beneficiaries
Profile → Security lists every device and recent sign-in. Remove anything you do not recognise, and check your beneficiary list every few months.
Recognising a scam
- Phishing and smishing
- An email or text imitating us, usually with a threat and a deadline, pointing at a lookalike site. Check the domain character by character before the first single slash — that is where you will actually land.
- Impersonation calls
- A caller claiming to be from the bank, the police or a supplier, creating urgency and asking you to move money or share a code.
- Invoice redirection
- A supplier's bank details appear to change. Always confirm new details by phoning a number you already had for them, never one printed on the new invoice.
- Investment and romance scams
- Pressure to move funds quickly into an opportunity you did not seek, often with a "guaranteed" return and a reason to keep it private.
- Remote access fraud
- Someone asks you to install software so they can help. Once installed, they can see and control everything on the device.
If something goes wrong
You are generally not liable for unauthorised transactions provided you kept your security details confidential and told us promptly once you knew or suspected a problem. Speed is the single factor that most changes the outcome.
- 1Freeze your cards in online banking under Cards. This takes seconds.
- 2Change your password from a device you trust, then choose "Sign out everywhere".
- 3Call us. Fraud and card-loss reporting is staffed 24 hours a day.
- 4Keep the evidence — messages, emails, references and numbers used.
- 5Report it to your local police or fraud authority and note the crime reference.
Never feel embarrassed
Modern scams are professionally produced and convincing. Reporting quickly matters far more than how it happened, and it is what allows us to try to stop funds in flight.
Reporting a vulnerability
If you are a security researcher and believe you have found a weakness in our systems, we would like to hear from you and we will not pursue you for good-faith research conducted within our published rules.
Contact the security team
Card loss and suspected fraud are handled 24/7. General security questions follow standard support hours: Monday to Friday, 08:00 – 20:00 local time. Card loss and fraud reporting is staffed 24/7.
Documents you may also need
Privacy Statement
What personal data Prime Wealth Corporation Bank collects, why we need it, who we share it with, how long we keep it, and the rights you have over it.
SecurityResponsible Disclosure
How to report a security vulnerability to Prime Wealth Corporation Bank, what is in scope, what we ask of you, and the safe harbour we offer for good-faith research.
Legal & RegulatoryTerms & Conditions
The terms on which you may use this website and our digital banking services, and the responsibilities each of us carries.
This document was last updated on 1 August 2026. We publish the current version here at all times; superseded versions are available on request.
If anything on this page is unclear, write to us and we will explain it.