Security centre
How we protect your account — and how you can protect yourself.
Security at Jahihi is a shared responsibility. We use industry-standard controls to keep your money safe. These pages explain how, and what you should do.
Think you've been a victim of fraud?
Call us immediately on +256 700 123 456 or email fraud@jahihi.ug. We answer fraud reports 24 hours a day.
How we protect you
Controls on our side.
We operate to the security standard expected of a regulated financial institution in Uganda.
Encryption in transit and at rest
All traffic to our website and mobile app is encrypted with TLS. Customer data is encrypted at rest in our databases.
Hashed credentials
Passwords are hashed with PBKDF2-SHA-256 and a per-user salt. We never store your password in a readable form — not even we can read it.
Session controls
Sessions expire after 7 days. Only a hash of your session token is stored, so a database leak does not expose live sessions.
Failed-login lockout
After five failed sign-in attempts for one email in 15 minutes, we lock that email out for the rest of the window.
Continuous monitoring
We monitor for unusual activity on accounts and systems, and we test our defences regularly.
Regulator oversight
We are supervised by the Bank of Uganda under licence MDL/2024/1234. Our controls are reviewed as part of that supervision.
Remember
What Jahihi will never ask you for.
Anyone asking for any of the following is not from us, no matter how convincing they sound or what number appears on your phone.
- Your password, PIN or one-time code
- Your full card number or CVV
- Remote access to your device
- Payment to release a loan or prize
- Gift cards, vouchers or cryptocurrency as payment
Protect yourself
Six things that make you much harder to defraud.
Use a strong, unique password
At least 12 characters, not used on any other site. A password manager makes this easy.
Enable two-factor authentication
Turn on app-based 2FA in your account settings. We never send codes by SMS unless you initiated the action.
Check the URL
The only legitimate Jahihi URLs end in jahihi.com or the regional domains we publish on this site. Bookmark the site you use.
Be sceptical of urgency
Fraudsters create pressure — 'act now', 'account will be closed'. Real banks do not operate like that.
Verify unexpected messages
If you receive an email or SMS you did not expect, do not click the link. Open the app or call us on the number on this page.
Keep your devices updated
Install operating system and browser updates promptly. They patch security holes that fraudsters exploit.
Report a security concern
If something looks wrong, tell us.
You will not be wasting our time. Report anything that looks suspicious — a message, a call, a transaction you do not recognise — and we will investigate.
Reports are handled by our fraud team and reviewed within one hour during business hours, or the next morning for reports made overnight.
Help centre
Answers to common questions.
OpenPrivacy policy
How we handle your personal data.
OpenComplaints
Formal complaints and how we handle them.
Open