How your account is protected
These controls sit behind your sign-in. They matter most in the case you never see: if account records were ever copied, your password could not be read from them and a stored session could not be replayed.
| Protection | What it means for you |
|---|---|
| Your password is never stored | Only a scrypt hash of it is kept, with a salt unique to your account. Nobody can read your password back — not customer care, not anyone with access to the database. Checking it uses a constant-time comparison, so a wrong password cannot be narrowed down by how long the response takes. |
| Sign-in tokens are stored hashed | When you sign in, the server keeps only a SHA-256 hash of the token your browser holds. A copied database record cannot be used to resume your session. |
| The session cookie is locked down | It is marked HttpOnly, so scripts in the page cannot read it, and SameSite=Lax, which limits what another site can make your browser send. In production it is sent only over HTTPS. |
| Sessions expire | Every session carries an expiry that the server checks on each request, rather than trusting the cookie's own lifetime. An old session cannot be revived. |
| Access is checked on every request | Account data and customer-care conversations are checked for ownership each time they are requested, including over the live message connection. Staff access is authorised separately. |
| No third-party tracking | There are no analytics, advertising or tracking scripts. Fonts, icons and photographs are served from ARUPS itself, so opening a page does not tell another company you were here. |
Passwords and sign-in
Your password is the part of account security entirely in your hands. Nearly all credential theft at scale comes down to reuse: a password taken from a breach somewhere else and tried here.
- Use a password you use nowhere else. Reuse is what turns one site's breach into a problem on every account that shares it.
- Length beats complexity. A long passphrase of ordinary words resists guessing better than a short string of substituted characters, and you will actually remember it.
- Use a password manager. It removes the need to reuse, and it will not autofill on a lookalike domain — which makes it a phishing defence as well as a convenience.
- Protect your email account first. It is the account that can reset most of the others, so it deserves your strongest password.
- Sign out on shared devices. Treat a session left open on a public machine as a credential given away.
Multi-factor sign-in asks for something beyond the password — a code from an app, or a passkey held by your device — so a stolen password alone is not enough to get in. A passkey or security key is the stronger choice: it is tied to the real site and cannot be read out to someone over the phone. A code sent by text is weaker than an app or a key, and far better than a password alone. Turn it on wherever an account offers it, starting with your email.
Recognising phishing
Phishing aims to get you to enter credentials on a page the attacker controls, or to approve something you did not initiate. It is overwhelmingly the way bank customers lose money, and it does not depend on any flaw in the bank's software.
- Never sign in from a link
Type the address yourself or use your own bookmark. A link in an email or message is the one thing an attacker fully controls.
- Check the domain carefully
Look at the registered domain, not the whole string. Attackers use convincing subdomains and lookalike characters. 'Secure' in a URL and a padlock in the address bar say nothing about who owns the site.
- Treat urgency as the signal
Account suspension, a suspicious payment to approve, a deadline in hours. Urgency exists to stop you checking, which is exactly when you should.
- Verify independently
Contact the organisation through details you already held — a previous statement or your own bookmark — never details supplied in the message.
- Never read out a one-time code
These exist to prove it is you. Reading one to a caller authorises whatever they are doing, which is usually a payment or a password change.
Impersonation scams
The most damaging frauds work by persuading you to authorise the payment yourself. That removes most technical defences and makes the money far harder to recover.
- "Your account is compromised — move your money to a safe account." No bank ever asks this. The safe account belongs to the criminal.
- Invoice redirection. A supplier or conveyancer emails new bank details, often mid-transaction. Verify by phone on a number you already held. This fraud routinely targets house purchases, where the sums are large and the timing is known.
- Support impersonation. A caller claims to be from your bank or a technology company and asks you to install remote-access software. Genuine support does not cold-call asking for remote access.
- Investment fraud. Guaranteed returns, pressure to decide quickly, and difficulty withdrawing. See investment risk for the full pattern.
- Romance and long-con approaches. A relationship built over weeks before money is mentioned. The time invested is the technique.
If a call makes you uneasy, end it and call back on a number you already had. A genuine organisation will not mind. Wait a few minutes or use a different phone: a caller can hold a landline connection open.
If something is wrong
Speed matters more than certainty. Acting on a suspicion that turns out to be nothing costs you a few minutes; waiting for proof can cost the money.
- Change your password, from a device you trust
If you reused it anywhere else, change it there too, starting with your email — the account that can reset all the others.
- Tell us, and tell any institution holding the money
Message customer care from inside your account. Where a payment is involved, contact the bank or card issuer on the number printed on your card or statement and ask them to stop pending payments and secure the account.
- Report it formally
Most countries operate a national fraud reporting service. Reporting creates a reference you will need for any claim.
- Record everything
Dates, times, reference numbers, screenshots and the names of everyone you spoke to.
- Watch for follow-up approaches
Victims are frequently targeted again by people offering to recover the money for a fee. Recovery fraud is a second fraud on the same victim.
Reporting a security concern
Sign in and open the message panel. Say what you saw and when — the screen you were on, the address of any page you were sent to, the number or address a message came from, and anything you clicked or replied to. Forwarding the message itself, or a screenshot of it, is more useful than a description of it.
Never include your password, a one-time code, a PIN or a full account number in a message, even when reporting fraud. They are not needed to act, and the team handling the conversation can read it. The contact page covers the channel in full.
Frequently asked questions
Can ARUPS staff see my password?
No. Only a scrypt hash of it is stored, so nobody can read your password back. Any request for it is fraudulent, whoever it appears to come from.
Someone called saying they are from ARUPS. Is that genuine?
Treat it as not genuine. Replies from customer care arrive in the message panel inside your account, in the same conversation you started. If a caller asks for a password, a one-time code or a transfer, end the call and report it from inside your account.
Why should I never read out a one-time code?
A one-time code is proof that it is you. Reading it to someone authorises whatever they are doing at that moment — usually a payment or a password change. No genuine organisation ever needs you to say one aloud.
What makes a message look genuine when it is not?
Logos, formatting, a convincing sender name and a lookalike domain are all cheap to copy. What an attacker cannot copy is the route you chose yourself: your own bookmark, or the address typed by hand. Judge a message by what it asks you to do, not by how it looks.
I think I used my ARUPS password on another site. What now?
Change it here and on the other site, starting with whichever account protects the others — usually your email. Use a different password on each, and let a password manager remember them.
