Security

Trust, engineered conservatively.

RepCode exists because trust is under attack. Here's how we make sure the verification you see is worth believing.

Codes that can't be guessed

RepCodes are generated with enough randomness that guessing one is practically impossible. A scammer can't make up a code and hope it works — if it's not real, the site says so.

Short-lived by design

Codes expire quickly. A code from last week's call won't verify today, so a leaked or overheard code has a very short window of usefulness.

Nothing personal required

Verifying a code never asks for your name, password, account number, or any personal details. If a page claiming to be RepCode asks for those, it isn't us.

Protected infrastructure

Our systems are encrypted in transit and at rest, with access limited to the engineers who operate the service and every access logged.

Abuse monitoring

We watch for patterns like mass code-guessing and fake verification attempts, and shut them down automatically.

Organizations are vetted

Before an organization can issue RepCodes, we verify it is a real, legitimate business. Impostors don't get codes in the first place.

Found a security issue?

If you've discovered a vulnerability or seen someone misusing RepCode, we want to hear from you right away. Email support@repcode.org with the details and our team will investigate promptly.