Protect sign-in details
Use your own account and the authentication protections available to you. Keep your device and app updated. Do not share passwords, one-time codes, app passcodes, wallet private keys or recovery phrases with someone claiming to offer support.
A message looks suspicious
Open BOS.PAY through your usual app or a website address you know, rather than following a message asking you to reconnect a wallet or move funds. Check the full destination address of links. A logo or display name does not establish who sent a message.
You suspect unauthorised access
Stop interacting with the suspicious person or page. Use a trusted device and the legitimate sign-in recovery process to secure access. Contact support with a concise description and the times of suspicious activity. If your card terminal or external wallet is affected, contact that provider through its official channel too.
Preserve useful evidence
Keep suspicious message text, sender details, relevant timestamps and affected payment references. Redact credentials and unrelated personal data. Do not send more money to someone promising to unlock or recover a payment.