Home/Security
Security
Your money, watched over
whether you're looking or not.
Banking on a phone should feel safer than banking anywhere else, not riskier. This page explains exactly what we do to keep your account safe, what we will never ask you for, and what to do the moment something feels off.
If you only read one thing
Nobody from Yusr will ever ask for your PIN, your password, your full card number or a one-time code. Not by phone, not by SMS, not in chat. If someone asks, they are not from Yusr — hang up and call us on 920 00 4444.
Reach the fraud teamThe foundations
Four things that are true of every Yusr account
Before any clever feature, the basics have to be right.
Your data stays home
All customer data is hosted in the Kingdom of Saudi Arabia.
In transit and at rest
Everything moving between your phone and Yusr is encrypted, and everything we store stays encrypted on disk.
Licensed by SAMA
Yusr is licensed and supervised as a digital bank by the Saudi Central Bank, and held to the same standards as any bank in the Kingdom.
Deposits covered
Your balance is covered by the Kingdom's deposit protection framework, on the same terms as any licensed Saudi bank.
Always on
We are reading your account even when you aren't
Fraud rarely announces itself. It looks like an ordinary payment made at a slightly odd hour, from a device that has never touched your account before, to a merchant you've never used. So Yusr doesn't wait for you to notice. Our systems review activity on every account continuously, every hour of every day.
That review is running while you sleep, while you're on a flight, and in the two seconds between tapping your card and the payment clearing.
The shape of your payments
How much, how often, to whom, and at what time of day. A pattern that has held for months and then suddenly doesn't is one of the clearest signals there is.
The device and the place
Which device a payment came from and where it was made. A card used in Riyadh at 14:10 and in another country at 14:25 is a story worth interrupting.
Whether it looks like you
Every account gets measured against its own history, not against some national average. Your normal is what counts.
Step one
Something falls out of pattern
The activity doesn't fit how this account normally behaves, so it gets picked up the moment it happens rather than on a report the next morning.
Step two
It goes to our risk team
Flagged activity is passed to the specialists in Riyadh who work on nothing else. They look at the full picture around the payment, not just the payment.
Step three
You hear from us
If we need you, you get a push notification and, if you don't answer it, a call. Confirming it was you takes one tap and everything carries on.
24/7
Monitoring, every day of the year
Every
Payment reviewed, not a sample
< 1 sec
Typical time to check a card payment
Riyadh
Where our risk team sits
Getting in
Only your phone, only you
Your Yusr account is tied to one device at a time. Adding a new one is deliberately a little slow — that friction is the whole point.
If someone tries to sign in as you from a phone we don't recognise, they will get stopped, and you will get told about it within seconds.
Read the full guide in the Help centreOne device, registered to you
Yusr runs on the phone you set it up on. Moving to a new handset means proving who you are again, with your ID and a live check.
Face or fingerprint to open the app
Your phone's own biometric lock guards the app, with a six-digit passcode behind it. Neither ever leaves your device.
A step-up when it matters
Adding a new payee, raising a limit or changing your phone number always asks for a second confirmation, whatever the amount.
You get told, every time
Every sign-in, every new device and every change to your details produces a notification you can't switch off. Security alerts are not marketing, and you can't unsubscribe from them.
In your hands
Controls you can use in one tap
| Control | What it does | Where to find it |
|---|---|---|
| Freeze card | Stops the card immediately, everywhere. Nothing is cancelled and nothing is reissued — unfreeze it when the card turns up in your other jacket. | Card → Freeze |
| Online payments | Switch card-not-present payments off entirely and turn them on only when you're about to buy something online. | Card → Controls |
| Overseas use | Block payments made outside the Kingdom. Useful if you know your card is only ever going to be used at home. | Card → Controls |
| Your own limits | Set a per-transaction and daily ceiling for contactless, in-store, online, overseas and ATM spending. Lower limits mean a smaller loss if a card ever does go missing — the full limit table is on the Card page. | Card → Limits |
| Report and replace | Kill the card permanently and order a new one in the same flow. A digital card is ready to use before the plastic arrives. | Card → Report an issue |
Scams
The weak point is almost never the bank
Most money lost to fraud is handed over willingly, by someone who has been convinced they're talking to their bank. Knowing our rules is the best protection there is.
Yusr will never ask you for
- Your app passcode, password or PIN — not part of it, not all of it
- A one-time code we've sent you, for any reason at all
- Your full card number, expiry date or the three digits on the back
- Permission to install remote-access or "support" software on your phone
- A transfer to a "safe account" while we investigate — no such account exists
- Payment of a fee to release money, unblock a card or clear a hold
What we actually do
- Contact you in the app first, through a notification you can open yourself
- Ask you to confirm or reject a specific payment, with the merchant and amount shown
- Tell you our name and give you the option to hang up and call 920 00 4444 back
- Never rush you. If you want to check with someone first, that is always fine
- Freeze the card ourselves rather than asking you to move your money anywhere
The scams we see most in the Kingdom
Someone calls claiming to be from Yusr's fraud team. They already know your name and perhaps your last transaction, which makes them sound legitimate. They tell you your account is compromised and walk you through "securing" it — which ends with a code, a transfer, or an app installed on your phone.
What to do: hang up. Open the Yusr app yourself. If there is a genuine problem it will be waiting for you there. Then call 800 124 0500 from your own contacts, never a number the caller gave you.
Our number is 920 00 4444. It is printed on the back of your card and shown inside the app.
A text says a parcel is held, a traffic fine is due, or your Absher details need updating, with a link and a small amount to pay. The page it opens is a convincing copy of a real payment screen and collects your full card details.
What to do: never pay from a link in a message. Go to the organisation's own app or site and check there. Yusr's messages never ask you to enter card details on a web page.
You list something for sale. A buyer agrees the price instantly, says the payment has been sent, and asks you to read out a code to "release" it. There is no such thing. The code is a one-time password that lets them into an account or authorises a payment from yours.
What to do: receiving money never requires a code. If someone asks for one, the transaction is not what they say it is.
A message on social media or a group chat offers guaranteed returns, often quoting a real Saudi company or a well-known name. Early small withdrawals work, which builds confidence, and then a larger deposit is requested and disappears.
What to do: check whether the firm is authorised by the Capital Market Authority before sending anything. Guaranteed returns do not exist, and a real firm will never pressure you to decide today.
A message from a family member or friend, sometimes from their real hacked account, asks urgently for money for a medical bill or a stranded relative. The story is designed to make you act before you think.
What to do: call the person on the number you already have for them. One phone call ends this scam every time.
If something looks wrong
Do this first, worry after
You will never be told off for reporting something that turns out to be nothing. We would far rather check a payment you'd forgotten about than hear about a real one a week late.
Phone and in-app chat are open 24 hours a day, every day of the year, including public holidays.
Freeze your card in the app
Card → Freeze. It takes one tap and takes effect immediately. You can undo it just as fast.
Tell us through chat or by phone
In-app chat gets you to a person fastest. If you'd rather speak to someone, call 920 00 4444 from inside the Kingdom or +966 92 000 4444 from abroad.
Change your passcode
If you think anyone has seen it, or you entered it somewhere that wasn't the Yusr app, replace it before you do anything else.
Let us take it from there
We'll investigate, keep you updated in the app, and tell you plainly what we find. If you're unhappy with how a case is handled, our complaints process is open to you and escalates to SAMA.
Your side of it
Four habits worth having
We do a great deal, but the last few metres are yours. None of these take more than a minute.
Keep the app updated
Updates carry security fixes. Turn on automatic updates and forget about it.
Use a passcode you use nowhere else
Not your phone unlock, not your building door, not your birth year.
Read your notifications
Thirty seconds a day is usually the difference between one fraudulent payment and ten.
Slow down when you're rushed
Urgency is the tool every scam relies on. Pressure to act now is itself the warning.