Security
How we protect your wealth
Every product decision goes through the same question: does this make the client's account safer? Here is what we do to protect you, and how to spot anyone pretending to be us.
Your DU wallet
Every account gets a unique address starting with DU, so it is easy to recognise. The key is generated by DUbank in an isolated environment, stored encrypted and delivered only to you, encrypted to a key created on your own device. Once delivered, DUbank's copy is deleted.
Signed on your device
Transactions are signed on your device. Your private key never travels and is never stored in plain text on our servers.
Encrypted vault
On your device, the key sits in a vault encrypted with AES-GCM, using a key derived from your password. The optional backup stores only the encrypted content, never your password.
Recovery is in your hands
If you lose both your recovery phrase and your backup password, nobody can recover the funds, not even DUbank. Keep both away from your phone and computer, somewhere safe.
Two-step verification and passkeys
Transfers, key exports and card creation require a code from your authenticator app. You can also confirm with a passkey, using your device's biometrics or screen lock.
Alerts and limits you control
Security changes, such as a new password or a new passkey, always trigger an email alert. You can lower your sending limits at any time and turn on travel mode, which only allows transfers to contacts you have already approved. Idle sessions end on their own.
Four-eyes approval
Withdrawals in reais above a reference amount are held until a second team member approves them. Every currency movement is recorded in an accounting ledger.
Identity verification
Handled by Didit, a specialist partner. We do not keep your documents, only the result of the verification. The more complete your verification, the higher your account limits.
Card data
The card number and CVV stay with the licensed issuer and are displayed by its secure component. DUbank never stores them.
How to spot a scam
Scammers copy the names, logos and tone of reputable companies. Be suspicious whenever you notice any of these signs.
Pressure
Messages saying your account will be blocked or money will be lost unless you act right now.
Support that comes looking for you
Someone claims to be from DUbank and reaches out by phone, WhatsApp, Telegram, social media or private message. To talk to us, use the contact page on our website.
Look-alike addresses
Pages using our name on another domain, shortened links or sponsored ads. Type the website address yourself or use a saved bookmark.
Guaranteed returns
Fixed yields, surprise airdrops or an DUC “presale”. The official token address is published only on the DUC page.
Requests for access
Any request to see your screen, install a remote access app or scan a QR code to “validate” your account.
What DUbank will never ask for
Not by email, phone, message or on the forum. If someone asks, it is a scam: do not reply, and let us know.
- Your recovery phrase or your wallet backup file.
- Your password.
- Your authenticator app code or your passkey confirmation.
- That you move money to a “safe account” or pay to “unlock” a withdrawal.
- An upfront payment to release a prize, reward or limit.
- Remote access to your computer or phone.
Good habits
- Check the full address and the network before sending. Blockchain transactions cannot be reversed.
- Always sign in through the official address, typed or saved as a bookmark, and check the padlock in your browser.
- Write your recovery phrase down on paper. No photos, screenshots, cloud storage or phone notes.
If something feels wrong
- Stop. Do not reply, click or scan any QR code in the suspicious message.
- Sign in through the official website, change your password and end your other sessions under Profile.
- Contact us through the contact page. If you showed your recovery phrase or a code to anyone, tell us right away: every minute counts.