At Apaylo, protecting your funds and your customers’ trust is the foundation of everything we do.
Until now, Multi-Factor Authentication (MFA) was optional and only required when submitting Large Transaction Requests. Starting November 2, 2026, MFA will be mandatory for every user on every Apaylo account.
We know security changes can add a step to your day, so we want to explain why we’re making this change, how MFA protects your account, and how it fits alongside your AML obligations.
Why We’re Making This Change
Our merchants operate in fast-moving, high-volume industries such as remittances and collections, which makes their accounts valuable targets. Across the payments industry, account takeover attacks are becoming more frequent and more sophisticated, and we have seen attempts to use stolen credentials against accounts on our own platform.
Most of these attacks start the same way: with a compromised password. Passwords can be phished through fake login pages, exposed in third-party data breaches when they’re reused across sites, or harvested by malware on an infected device. Shared service accounts, such as info@company.com or support@company.com, add another layer of risk. When one password is shared among several people, and sometimes with external support teams, it becomes much harder to control who has it and much easier for it to leak. Once an attacker has a valid username and password, a password-only account has no further defence.
Protecting only large transactions wasn’t enough. An attacker with account access could still change settings, add payees, or move funds in smaller amounts. Securing the front door is the stronger approach.
How MFA Works
Authentication factors fall into three categories.
Something you know is a password or PIN.
Something you have is a phone, authenticator app, or hardware security key.
Something you are is a biometric, like a fingerprint or face scan.
MFA requires at least two factors from different categories, and its strength comes from their independence. An attacker who steals your password through a phishing email still doesn’t have your phone. To get in, they would need to compromise two separate systems at once.
Apaylo uses Time-based One-Time Password (TOTP) authentication, which works with authenticator apps including Google Authenticator, Microsoft Authenticator, 2FAS, and Aegis.
If you’re considering MFA for your own platform, here are the most common methods:
Authenticator apps (TOTP)
When you enroll, the service and your authenticator app share a secret key, usually through a QR code. Every 30 seconds, the app combines that key with the current time using a cryptographic function (HMAC) to generate a six-digit code. The server runs the same calculation independently. The codes only match if you hold the secret key, and because each code expires within seconds, an intercepted code quickly becomes useless.
Passkeys and hardware security keys (FIDO2/WebAuthn)
These use public-key cryptography. Your device stores a private key that never leaves it and uses it to sign a unique challenge from the server during login. Because the signature is tied to the genuine website address, a fake phishing site can’t trick it into working. This makes passkeys and security keys the most phishing-resistant option available.
SMS codes
Text message codes are better than a password alone, but they’re vulnerable to SIM-swap attacks, where a fraudster convinces a mobile carrier to transfer your number to their device. Where possible, we recommend an authenticator app or passkey instead.
The impact is significant. Microsoft has reported that MFA blocks over 99.9% of automated account compromise attacks.
Get Ready Before November 2
To keep your team’s access to Apaylo uninterrupted, complete these steps before November 2:
-
Give every user their own login.
Each team member needs an individual Apaylo user account with a unique email address. Shared or group email accounts will no longer be accepted.
-
Enroll in MFA.
Log in to the Apaylo Merchant Admin Portal and follow the prompts to connect your authenticator app.
-
Review your user list.
Account administrators should remove anyone who no longer needs access to your Apaylo account.
Users who haven’t enrolled by November 2 will be prompted to set up MFA at their next login. Enrolling now means no interruptions when the change takes effect.
Security Is Layered: The Role of AML, KYC, and KYB
MFA protects access to your account. The controls that protect the transactions flowing through it are just as important.
Many of our clients are Money Services Businesses registered with FINTRAC. For them, a strong Anti-Money Laundering (AML) program is both a regulatory obligation under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act and a critical line of defence. That includes a designated compliance officer, documented policies, a risk assessment, ongoing transaction monitoring, and timely reporting of suspicious activity.
Know Your Customer (KYC) processes use reliable identity verification methods to confirm your end users are who they claim to be. Know Your Business (KYB) extends this to business customers by confirming corporate registration, ownership structure, and ultimate beneficial owners.
These controls work together with MFA. Fraudsters often pair compromised accounts with synthetic identities or money mule networks to move illicit funds. Strong authentication keeps them out of your account, while rigorous KYC/KYB and AML monitoring stops them from exploiting your platform through your customers. A weakness in any one layer puts the whole system at risk.
Apaylo Is Here to Help
Security is a shared responsibility, and the Apaylo team is here to make this transition as smooth as possible.
Questions about MFA enrollment or your compliance program? Contact our team at customerservice@apaylo.com.
Lost access to your device or authenticator app? Contact apisupport@apaylo.com for account recovery support.
Log in to the Apaylo Merchant Admin Portal today to enroll in MFA. Thank you for helping us keep the Apaylo ecosystem safe.
